API Terms of Use

PREAMBLE

SAS ALL IN BOX, a simplified joint-stock company with a share capital of €2,667.40, whose registered office is located at Parc des Varimonts, 10 avenue de Thionville, 57140 WOIPPY, France, registered with the Metz Trade and Companies Register under number 838 227 908, represented by Mr Barthélemy JEANROCH, acting as Deputy Managing Director, duly authorised for the purposes hereof, hereinafter referred to as "All in Box". All in Box makes available to certain of its Clients, as part of their subscription to the All in Box Platform, an application programming interface (hereinafter the "API") allowing programmatic access to certain features and data of the Platform. These API Terms of Use (hereinafter the "API Terms") define the specific conditions applicable to access to and use of the API. They supplement, without replacing, All in Box's Terms and Conditions of Sale ("T&Cs") and, where applicable, the User General Terms and Conditions of Use ("User Terms"), which remain fully applicable.

ARTICLE 1 — DEFINITIONS

"API": the application programming interface made available by All in Box, consisting of a set of endpoints, methods and technical specifications allowing programmatic access to the Platform.

"API Key": the unique identifier assigned to the Client enabling it to authenticate its API calls. "Token": any authentication element generated in connection with use of the API (access token, refresh token, OAuth token, etc.).

"Third-Party Application": any application, integration or service developed by the Client or by a service provider appointed by it, making use of the API.

"Quota": the quantitative limit imposed on use of the API, expressed as a number of calls per unit of time or as a volume of processed data.

ARTICLE 2 — PURPOSE AND SCOPE

These API Terms define the conditions for access to and use of the API by the Client. They are enforceable against the Client, its Users, and any person acting on its behalf in connection with the development, implementation or operation of a Third-Party Application.

The Client is responsible for compliance with these API Terms by any person acting on its behalf.

ARTICLE 3 — ACCEPTANCE

Use of the API is subject to the prior and unreserved acceptance of these API Terms. Acceptance takes place upon the Client's first generation of an API Key, or upon the first actual use of the API.

ARTICLE 4 — OPENING AND MANAGEMENT OF ACCESS

4.1 Opening of access

API access is opened to the Client under the conditions specified in its Contract or subscription offer. All in Box reserves the right to make the opening of API access subject to specific conditions (eligible plan, pricing tiers, prior agreement, etc.) and to refuse to open access without having to justify its decision.

4.2 Management of API Keys and Tokens

The Client generates and manages its own API Keys from its Account. The maximum number of simultaneously active API Keys may be limited by All in Box.

API Keys and Tokens are strictly confidential. The Client may only disclose them to a third party to the strict extent necessary for the operation of a Third-Party Application, and under its own responsibility.

The Client shall inform All in Box without delay of any compromise, suspected compromise, loss or unauthorised disclosure of an API Key or Token, so that appropriate measures can be taken (revocation, rotation, etc.). All in Box may revoke, at any time and without notice, any API Key or Token whose security is compromised or suspected of being compromised.

ARTICLE 5 — QUOTAS AND USAGE LIMITS

Use of the API is subject to Quotas, the values of which are specified in the API's technical documentation or in the Contract. These Quotas may relate in particular to the number of calls per second, per minute, per hour or per day, the volume of data transferred, or the number of concurrent calls.

All in Box may adjust the applicable Quotas at any time in order to preserve the stability, performance and security of the Platform. Exceeding the Quotas may result in the temporary rejection of calls ("rate limiting"), the temporary suspension of API access, or additional billing under the conditions defined in the Contract.

The Client shall ensure that its Third-Party Applications comply with the Quotas and implement appropriate error-handling and retry mechanisms so as not to overload the API.

ARTICLE 6 — AUTHORISED USES

The API is made available to enable the Client to integrate the Platform with its own information systems and to develop Third-Party Applications intended for its internal use or for use by its end users in the course of its business.

Authorised uses include in particular: importing and exporting Client Data, automating campaign sending, extracting analytics, and integrating Platform features into third-party tools.

ARTICLE 7 — PROHIBITED USES

In connection with its use of the API, the Client shall not:

Use the API to access data that does not belong to it or on behalf of unauthorised third parties;
Resell, rent, sub-license or monetise API access to a third party;
Reproduce all or part of the Platform via the API with a view to offering a competing service;
Engage in mass scraping, systematic archiving or the building of databases for resale purposes;
Circumvent the Quotas or the API's security mechanisms, in particular by using multiple API Keys intended to exceed the applicable limits;
Use the API to carry out load tests, stress-test operations or security audits without All in Box's prior written consent;
Develop or distribute Third-Party Applications whose operation would harm the security, stability or image of the Platform.

ARTICLE 8 — VERSIONS AND DEPRECATION

All in Box regularly develops the API as part of a documented versioning policy. Non-backward-compatible changes ("breaking changes") give rise to the publication of a new version of the API.

All in Box guarantees the availability of the current version of the API as well as the immediately preceding version (N-1) for a minimum period of six (6) months from the publication of a new version. At the end of this period, earlier versions may be deactivated.

All in Box will notify the Client, by any written means, including by publication in the technical documentation or by sending a message via the Platform, of any changes likely to affect Third-Party Applications.

ARTICLE 9 — API AVAILABILITY

All in Box implements reasonable means to ensure the availability of the API. However, given the technical nature of the API and its dependencies, no availability commitment beyond that provided for the Platform in Article 12 of the T&Cs is made in respect of the API.

All in Box may suspend or interrupt API access at any time for maintenance, security or stability reasons. Such interruptions shall not give rise to any compensation for the Client.

ARTICLE 10 — THIRD-PARTY APPLICATIONS

The Client is solely responsible for the Third-Party Applications it develops, operates or uses. All in Box has no contractual relationship with Third-Party Applications and disclaims all liability for their operation, security, regulatory compliance or any damage they may cause.

The Client shall indemnify All in Box against any action, claim or judgment resulting from a Third-Party Application, in particular in the event of infringement of third-party rights or of the rules applicable to the processing of personal data.

ARTICLE 11 — INTELLECTUAL PROPERTY

The API, its specifications, its documentation, its software development kits (SDKs) and all content made available by All in Box in this context are the exclusive property of All in Box or are licensed to it.

These API Terms do not entail any assignment of intellectual property rights to the Client. The Client has a personal, non-exclusive and non-transferable right to use the API, strictly limited to the authorised uses and to the duration of its Contract.

ARTICLE 12 — PERSONAL DATA

Personal data processing carried out via the API is governed by Article 14 of the T&Cs. The Client remains the data controller for the personal data it processes via the API.

The Client undertakes to implement, in its Third-Party Applications, appropriate technical and organisational measures to ensure the security of personal data, in particular encryption of data flows, secure storage of API Keys and access logging.

ARTICLE 13 — LIABILITY

All in Box's liability in respect of the API is governed by Article 18 of the T&Cs. No extension of the cap or scope of All in Box's liability results from these API Terms. The Client is solely responsible for its use of the API, for the Third-Party Applications it develops or operates, and for any harmful consequences that may result therefrom for All in Box, its other Clients or third parties.

ARTICLE 14 — SUSPENSION AND TERMINATION

All in Box may suspend, restrict or revoke, at any time and without notice, all or part of the Client's API access in the event of a proven or suspected breach of these API Terms, in the event of harm to the security, stability or performance of the Platform, or in the event of a claim against All in Box arising from the Client's use of the API.

Termination of the Contract between All in Box and the Client automatically entails termination of all API access.

ARTICLE 15 — AMENDMENT OF THE API TERMS

All in Box reserves the right to amend these API Terms at any time, in particular to reflect technical, functional or regulatory developments. Amendments are notified to the Client by any written means, including by publication in the API's technical documentation. Amendments come into force within thirty (30) days of their notification. In the absence of written objection within this period, the new API Terms are deemed accepted.

ARTICLE 16 — GOVERNING LAW — JURISDICTION

These API Terms are governed by French law.

Any dispute relating to their formation, interpretation or performance which cannot be resolved amicably shall fall within the exclusive jurisdiction of the Commercial Court of Metz, notwithstanding multiple defendants or third-party claims, including for urgent and protective proceedings.