API Terms.

01What these terms cover

These terms apply when you, or software acting for you, use an eBazoo API (“the APIs”):

• Mobile App Builder’s endpoint for AI tools, which uses the Model Context Protocol (MCP) and is included on the Scale plan and up;
• Mobile App Builder’s outbound webhooks, included on Enterprise and Custom plans;
• any other API we give you a key for, such as read-only access to our Help Center articles for a partner.

They add to our Terms of Service, our Privacy Policy and our Data Processing Agreement. Where they differ about the APIs, these terms win.

02Your licence

While your plan includes an API, eBazoo Technologies gives you a limited, non-exclusive, non-transferable and revocable licence to use it to work with your own store’s apps, under these terms. Everything not granted here stays with us.

03Keys and secrets

• Creating keys. You create a key for AI tools in Mobile App Builder (Settings → AI tools). It’s shown once, works for one store and one app, and expires after 30 days. One key per app is active at a time.
• Keeping them secret. Store keys and webhook secrets on a server you control. Never put them in a mobile app, a web page, a shared document or a public code repository.
• Your responsibility. Anything done with your key counts as done by you.
• If a key leaks, revoke it in the app straight away and tell us at hello@ebazoo.com. We may revoke a key ourselves if we see it exposed or misused.

04Limits

Other APIs may have their own limits, shown when you get the key. Don’t try to get around a limit, for example with several keys or several stores.

05AI tools you connect

• What they can do. An AI tool you connect can read your app’s design and propose, apply and undo changes to its draft. It can’t publish, send push notifications, change billing or releases, or read orders or customers. Every change it applies is recorded in the audit log, so you can review and undo it.
• Your tool, your choice. You choose the AI tool and its provider, and their terms apply to what you send them. We aren’t responsible for what a tool you connect does or suggests.
• You decide what goes live. Review drafts before you publish them.

06Webhooks

Outbound webhooks send events from Mobile App Builder to an HTTPS address you choose. The events are: a design is published, a campaign goes live, a release changes status, and a new order placed in your app is synced.

• Every delivery is signed the Standard Webhooks way, with webhook-id, webhook-timestamp and webhook-signature headers. Check the signature before you trust a delivery.
• Answer within 10 seconds. Do slow work after you’ve replied.
• Keep your endpoint secure, and keep its secret as safe as a key.

07Acceptable use

Don’t use the APIs to:

• reach data of a store you don’t run, or any data your plan doesn’t include;
• break the law, Shopify’s API terms or Apple’s and Google’s rules;
• overload our servers, scrape our apps or test our security outside our Vulnerability Reporting policy;
• copy, resell or sublicense access, or offer it as a service of your own without our written agreement;
• spread malware or spam, or mislead anyone about who they’re dealing with.

08Data you receive

You’re responsible for the data you receive through the APIs. Use it only for your own store, protect it at least as well as we do, keep it only as long as you need it, and follow data protection law and Shopify’s rules for customer data. Order events don’t include customers’ names, email addresses, phone numbers or street addresses.

09Changes to the APIs

The APIs will grow. For a change that could break your integration, we give you notice in the app or by email at least 30 days before it takes effect, unless a security or legal reason makes that impossible. Anything marked beta or “coming soon” may change without notice.

10Suspension and ending

We may suspend a key or an endpoint if it’s being misused, puts other stores at risk, or breaks these terms. Where we reasonably can, we warn you first. Your access ends when your plan no longer includes the API, or when you uninstall the app, which deletes your keys.

11Confidentiality, feedback and our name

• Confidentiality. Keys, secrets and any documentation we share privately are confidential.
• Feedback. If you send us ideas about the APIs, we may use them without owing you anything.
• Our name. You may say that your tool works with our apps. Don’t suggest that eBazoo endorses or built it, and don’t use our logo without written permission.

12Disclaimers, liability and law

The APIs are provided “as is” and “as available”, to the extent the law allows. The disclaimers and limits on liability in our Terms of Service apply to them. These terms are governed by the laws of Pakistan, like the Terms of Service.

13Contact us

Questions about the APIs or these terms: hello@ebazoo.com.

eBazoo Technologies · Lahore, Pakistan