Terms of Service (Test and Production Use)

Article 1 – Purpose and Governance

1.1. Incorporation. This document forms an integral and inseparable part of the [exact title of the master agreement] (the "Master Agreement") and of the Plumma® Connect Technical Documentation (the "Technical Documentation").

1.2. Applicability. These terms supplement the general obligations of the Master Agreement and apply specifically to the technical use, security and integrity of the API services and their commands. In case of conflict, the Master Agreement prevails.

Article 2 – Test Use

2.1. Demo numbers. The Supplier provides a set of demo numbers that return synthetic data and never reach a real subscriber. They may be used through the API or through the Sandbox page of the Plumma® console, solely for development, technical integration and functional testing. Calls about demo numbers are not charged.

2.2. Data restrictions. In test use, the Client shall use only the demo numbers and the test identities provided by the Supplier. The Client shall not enter real personal data, sensitive data or end-user data in test requests, including in the identity fields of the kyc_match command.

2.3. Limits.

a) Demo numbers. Calls about demo numbers are subject to the rate limits published in the Technical Documentation.

b) Live verification before approval. While an application is awaiting approval, the Client may make a limited number of live commands on real numbers, solely to verify the integration, up to [N] commands per day. These commands are charged as live commands. Once the daily allowance is used, further live commands are refused until the following day. [If an NDA is required before this step, state it here.]

2.4. No warranty. Demo numbers and the Sandbox page are provided "as is" and "as available", for testing only, without service levels or warranties of any kind. To the extent permitted by law, the Supplier is not liable for damages arising from their use.

Article 3 – Access to Production

3.1. Contractual prerequisites. Production use requires the prior acceptance and signature, electronic or physical, of the following documents, all valid and in force: i) the Master Agreement; ii) the Data Processing Addendum (DPA); iii) [Technical Addendum, if it is a separate document]; iv) these Terms of Service.

3.2. Activation. Production use is enabled when all of the following apply: the contractual prerequisites are met; the Client has an active paid plan; the Supplier has approved the Client's organization; and the Supplier has enabled the Client's key for the application concerned. From that moment, each command served in production is charged as described in the Billing section of the Technical Documentation and in the Master Agreement.

3.3. Prepaid plans. On a prepaid plan, each command served uses the Client's prepaid allowance. When the allowance is used up, production commands are refused until the allowance is topped up.

3.4. Credentials. The Client receives one API key per organization, used for both demo numbers and real numbers. Each key is valid for one year and can be regenerated by the Client at any time. The Client is solely responsible for the custody and security of its keys and for all commands made with them.

Article 4 – Production Use and Security

4.1. Rate limits. The Supplier applies limits to the number of requests the Client can make. The limits in force are published in the Technical Documentation. The Supplier may change them to protect the stability of the service or to prevent abuse.

4.2. Monitoring and suspension (in addition to Art. [5] of the Master Agreement).

a) The Supplier may monitor use of the API services to detect anomalous traffic, fraudulent or unauthorized use, or any activity that may compromise the stability, integrity or security of the services or of its providers.

b) Where fraudulent traffic, misuse of credentials or a clear security or compliance breach is detected, the Supplier may immediately suspend the services, including by disabling the Client's keys, without prior written notice, as provided in Art. [5] of the Master Agreement.

4.3. Indemnity (in addition to Art. [6.3] of the Master Agreement). The Client shall indemnify and hold the Supplier harmless against any claims, penalties, legal costs and losses arising from:

a) real personal data entered in test requests in breach of Art. 2.2;
b) misuse of the Client's API keys;
c) unauthorized or fraudulent production commands;
d) failure to obtain a valid legal basis or end-user consent, or any other breach of applicable regulation by the Client.

4.4. Limitation of liability. The Supplier is not liable for indirect, incidental or consequential losses, including loss of profit, fraud losses and chargebacks. The Supplier's total liability is subject to the caps set out in the Master Agreement.

Article 5 – Nature of the Services

5.1. Informational nature. The Client acknowledges that the responses to commands, including SIM swap, device swap, identity match and other fraud-related results, are informational. They are based on data provided by mobile network operators and other third parties, and they may be incomplete or unavailable for some numbers or countries. They shall not be the sole basis for identity verification, security or other critical business decisions.

5.2. No warranties. To the maximum extent permitted by law, the API services are provided "as is", without warranties of any kind, express or implied, including accuracy, merchantability, availability or fitness for a particular purpose, except as expressly provided in the Master Agreement.

5.3. Third-party providers. The services depend on infrastructure and data provided by third parties, including mobile network operators and aggregators. The Supplier is not liable for failures, delays, inaccuracies or unavailability caused by them.

Article 6 – Client Responsibilities

6.1. Independent decisions. The Client is solely responsible for the decisions, actions and outcomes based on the responses to its commands, and shall implement its own controls and secondary verification.

6.2. Legal basis and consent. The Client is solely responsible for having a lawful basis for each request, for obtaining any end-user consent required, and for complying with all applicable law, including the GDPR, the ePrivacy Directive and local telecommunications and consumer protection rules.

6.3. Prohibited use. The Client shall not use the API services for unlawful, deceptive or fraudulent purposes, for mass surveillance, for profiling without a lawful basis, for unauthorized resale, or for automated decisions with legal or similarly significant effects on individuals without human intervention.

6.4. Credential security. The Client is solely responsible for the security of its API keys and for all commands made with them. The Supplier is not liable for losses or unauthorized access arising from compromised or poorly managed credentials. The Client shall regenerate a key without delay if it may have been exposed.

Article 7 – Survival

7.1. The provisions on limitation of liability, disclaimers, indemnities and responsibility for commands survive the expiry or termination of these Terms of Service for any reason.