API Policy

One API serves the findit customer app, the business app and the admin panel. This policy governs any programmatic access to it — what access is granted, on what conditions, and what ends it.

Effective 9 August 2026 Access by written approval only Supplements the Terms of Service

Current status

The findit API is not open. There is no public developer programme, no self-service key issuance and no published integration tier. Access exists only for findit's own clients and for partners with a signed written agreement. This policy sets out the terms that apply whenever access is granted.

1Scope

This policy applies to any access to a findit endpoint by anything other than an unmodified, officially distributed findit app — including scripts, servers, integrations, partner systems, testing tools and automation. It supplements the Terms of Service; where the two differ on an API matter, this policy governs.

"You" here means the organisation granted access and every person acting under its credentials.

2Who may have access

findit's own applications. The customer app and PWA, the business app and panel, and the internal admin panel.
Approved partners, under a written agreement naming the endpoints, the purpose and the duration.
Nobody else. Access is not granted for research, aggregation, price comparison, lead generation, competitive analysis or model training.

Approval is granted to a named organisation for a named purpose. It is not transferable, not sublicensable, and does not extend to affiliates, contractors or successor entities without fresh written approval.

3Credentials

Credentials are issued to you and identify you. Every call made with them is attributed to you, whoever made it.
Never embed a credential in client-side code — a mobile app binary, browser JavaScript, or anything else a user can read. Server-side only.
Never commit credentials to source control, log them, put them in a URL, or share them outside the people who need them.
Store them in a secrets manager, and rotate them on any staff change with access, and immediately on any suspected exposure.
Report a suspected compromise to security@getfindit.online at once. We may revoke a credential without notice where we believe it has been exposed.

Administrative endpoints are gated as a whole group, not per endpoint. Presenting an administrative credential you were not issued, or attempting to, is unauthorised access and is treated as such.

4Acceptable use

You may call the API only for the approved purpose, and only in ways a user could have produced through the app.

You must not:

Scrape, crawl, bulk-export, mirror or systematically enumerate requirements, responses, businesses, listings or users — including by iterating over identifiers.
Build any dataset, index, aggregate feed or derived database from findit data, or use findit data to train a machine-learning model.
Create, verify or enumerate accounts programmatically, or automate the posting of requirements or responses.
Circumvent, probe or test rate limits, authorisation checks, scoping rules or any other control.
Retain more data than the approved purpose needs, or keep it longer than the agreement allows.
Present findit data to end users in a way that misattributes its source, or that implies findit endorses your product.
Resell, redistribute or make findit data available to a third party in any form.

5Customer contact data

The rule that overrides everything else here

Customer names and phone numbers are never returned by business-facing endpoints except where the customer has explicitly shared them with that specific business on a specific response. If a response ever contains contact data you did not expect, stop, do not store it, and report it to security@getfindit.online immediately. Continuing to call an endpoint that is over-disclosing is a breach in itself.

Where you do legitimately receive customer contact data:

Use it only to discuss the requirement it was shared on.
Do not store it in any marketing system, CRM segment, broadcast list or messaging tool.
Do not transfer it to any other party, including affiliates and sister companies.
Delete it when the enquiry closes, when consent is withdrawn, or when we tell you consent has been withdrawn — whichever is first.
Apply access controls, encryption in transit, and logging at least equivalent to those described in our Privacy Policy.

You are an independent Data Fiduciary under the DPDP Act, 2023 for your own use of this data, and you carry the corresponding obligations directly.

6Rate limits and fair use

Request volumes are agreed in writing per integration. Stay within them.
Honour 429 responses. Back off exponentially with jitter; do not retry in a tight loop.
Retry only on 429 and 5xx. A 4xx is a bug on your side, and retrying it is abuse.
Cache what does not change. Reference data such as categories and cities should not be fetched on every request.
Poll no more often than the integration requires. Where we offer notification of a change, use it rather than polling.
Send a descriptive User-Agent identifying your integration and a contact address.

We may throttle, degrade or suspend an integration that threatens platform stability, without notice where the impact is live.

7Availability and change

The API carries no uptime commitment during the beta. Endpoints, request shapes, response shapes and validation rules may change.

Treat unknown fields in a response as ignorable rather than as an error — we add fields without warning.
Never depend on the ordering of a collection unless the endpoint documents it, or on the internal structure of an identifier.
Breaking changes are communicated to partners in advance where the change is planned. Security fixes may ship immediately.
Endpoints marked for development use are not available in production and must never be depended on.

8Security obligations

Call the API over HTTPS. Plain HTTP is refused, and you must not disable certificate validation.
Validate and sanitise anything you send. Do not relay unvalidated end-user input into the API.
Do not log request or response bodies containing personal data.
Notify us within 24 hours of becoming aware of any incident affecting findit data you hold.
Report vulnerabilities in the API to security@getfindit.online before disclosing them anywhere else. We do not pursue good-faith research that stops at demonstrating an issue and does not access, alter or retain other people's data.

9Suspension and termination

We monitor API usage. Where use breaches this policy, we may revoke credentials, suspend the integration, or terminate the agreement — immediately and without notice where customer data is at risk.

On termination or revocation you must stop calling the API, delete all findit data you hold except what the law requires you to keep, and confirm the deletion in writing on request.

10Contact

Integration enquiries: api@getfindit.online
Security reports: security@getfindit.online
Everything else: support@getfindit.online