Developer & API Terms

Developer accounts are for identified developers or organisations. You are responsible for keeping client secrets and API keys confidential, rotating them when staff change or a leak is suspected, and for all activity under your credentials. Credentials are shown once and stored only as hashes; we cannot recover them. Keys may be revoked at any time for policy violations.

An app may act for a salon only after that salon's owner authorizes it through the consent screen, granting specific scopes. Sensitive scopes (client, payment, analytics and AI data) require explicit tenant consent and may be revoked by the salon at any time. You must request the minimum scopes your integration needs and must not attempt to access salons or data you are not authorized for.

Each plan has a per-minute rate limit and a monthly request quota, enforced on every call; exceeding them returns HTTP 429. Do not circumvent limits, share credentials across unrelated apps, scrape data in bulk beyond your plan, or use the API to build a competing dataset. We may throttle, suspend, or terminate access that threatens platform stability, security, or other tenants.

Personal data accessed via the API may be used onlyto provide your integration's stated function to the authorizing salon and its clients. You must not resell it, use it for advertising or model training, or retain it beyond what the integration requires. When a salon revokes authorization or a data subject requests deletion, you must delete the corresponding data; deletion requests propagate (see our Privacy Policy and the data-subject-request process).

You must transmit and store data securely (TLS in transit, encryption at rest for secrets) and verify every webhook using the signature header (X-Dianova-Signature, HMAC-SHA256 over timestamp.body), rejecting stale timestamps to prevent replay. Report suspected vulnerabilities or credential compromise to us promptly.

The API is versioned by URL path (/api/v1). We may introduce new versions and deprecate old ones with reasonable notice via deprecation/sunset response headers and developer communications. You are responsible for migrating before a version's sunset date.

Where you process personal data on behalf of a salon, the salon is the controller, Dianova is a processor, and you act as a sub-processor. You must: process only on documented instructions, apply appropriate security measures, assist with data-subject requests, not engage further sub-processors without authorization, and delete or return data on termination. This summary supplements, and does not replace, a signed data-processing agreement where one is required.

For white-label apps, the salon (tenant) is the publisher and data controller: it publishes under its own developer/store account, provides its own privacy policy, and completes its own App Store Privacy / Google Data Safety disclosures. Dianova acts as a processor and provides the platform, build tooling and a privacy-policy template; the tenant is responsible for store compliance and user-facing disclosures.

Card data is handled by Stripe; Dianova and developers do not store card numbers (PCI scope stays with Stripe). For EU payments, strong customer authentication (PSD2/SCA) applies, and on supported devices a biometric/step-up factor may be used — biometrics are processed on-device and are never collected by Dianova.

The API is provided "as is"; we make no warranty of uninterrupted availability. We may suspend or terminate access for breach of these terms, and you may close your developer account at any time. On termination you must stop using the API and delete platform data as described above. Audit logs of API access and key rotation are retained as a security commitment.

We may update these terms; material changes will be communicated to developers. Continued use after changes take effect constitutes acceptance. Questions about the developer programme can be raised through your developer account contact channel.