TenantLoop API Terms

1. What these terms cover

These API Terms are part of your agreement with TenantLoop, Inc. [confirm legal entity] under the Terms of Service. They apply when you, your developers or an app you authorise use the TenantLoop application programming interface, API keys, webhooks, the MCP server behind Connect with Claude or the developer documentation (together, the "API"). If these API Terms conflict with the Terms of Service on an API matter, these API Terms apply.

A person accepts these terms in Settings before creating their first key. The developer documentation is at app.generationadvisory.com/developers.

2. API keys

• Only people whose role allows it can create, rename or revoke a key, and showing or changing keys requires a recent two-step verification.
• Each key acts with the role permissions and property access of the person who created it, never more. A key stops working when that person is deactivated.
• Connecting an AI assistant such as Claude needs an account owner or administrator to approve it; the assistant then acts with that person's permissions and can be disconnected in Settings at any time. Treat a key like a password: do not put it in public code, browser apps or shared documents.
• You are responsible for everything done with your keys. If a key may be exposed, revoke it in Settings straight away and tell us at legal@tenantloop.com [confirm].

3. Rate limits and fair use

We set limits on how many requests a key or account can make in a period, and on the size of requests and responses. Current limits are published in the API documentation and returned in response headers: today 50 requests a minute and 500 an hour for each key or connected app. If you go over a limit, requests are refused until the window resets. We may lower limits for a key that harms the Service for other customers, and we will tell you when we do.

4. Acceptable use

Use the API only to work with the data of the TenantLoop account the key belongs to, for that account's own property management. Do not:

• try to reach other customers' data, test our security without written permission, or get around limits, permissions or authentication;
• scrape the Service, resell API access, or build a product that copies the core features of TenantLoop;
• use the API to send spam or messages that break our Anti-Spam Policy, or to make decisions about applicants or tenants that break fair-housing, credit-reporting or privacy laws;
• send malware or content you have no right to share.

5. Data and privacy

Data you pull from the API is still your Customer Data and the personal information of your tenants, owners and vendors. Protect it at least as carefully as TenantLoop does, use it only for the purposes your own privacy notice allows, and delete it when you no longer need it. Our Privacy Policy and Data Processing Addendum apply to data while it is in TenantLoop. Once data leaves TenantLoop through your key, you are responsible for it.

6. Apps built by others

If you connect an app made by someone else (for example through Zapier, once available), that app works under your key or authorisation and its own terms. Check what it can access before you connect it, and revoke access when you stop using it. We are not responsible for third-party apps.

7. Webhooks

Webhooks send event data from TenantLoop to an address you choose. Use an HTTPS address you control and check the signature on every delivery as the documentation describes. We retry a failed delivery after about 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then mark it failed. A webhook whose address answers 410 Gone, or whose key or connected app is revoked, is switched off.

8. Changes, versions and availability

We version the API and give at least [90] days of notice before removing or changing a stable endpoint in a way that breaks existing use, unless a change is needed for security or the law. Features marked beta can change without notice. The API is provided as part of the Service and is not covered by any separate uptime commitment.

9. Suspension and ending access

We may suspend a key or API access straight away if it puts the Service, customer data or other users at risk, or if these terms are broken; we will tell you why when we can. You can stop using the API and revoke your keys at any time. When your TenantLoop subscription ends, API access ends with it.

10. Contact

Questions about these terms: legal@tenantloop.com [confirm], [company mailing address]. Security reports: use the contact page and do not include tenant data.