1. About this policy
1.1 This policy applies to all use of the Taxxa Developer API (the "API") and of API keys: by you, by your staff and by your end users through your products. It is part of the Developer API Terms.
1.2 This policy adds to the acceptable use rules in the Terms and Conditions. You are responsible for making sure that your end users obey it.
2. Do not extract the knowledge base
- Do not scrape, crawl or export the knowledge base in bulk, through the API or in any other way.
- Do not send queries in a systematic pattern to list sources, categories or passages, for example a query for each word of a dictionary or each section of a law.
- Do not keep results to make a copy, an index or a dataset of the knowledge base.
- Do not use results to train, fine-tune or evaluate an AI model, unless we agree to it in writing.
3. Keep keys in your organization
- Do not share, sell or lend an API key to another organization, including your customers.
- Give your end users access through your own servers, not with your key.
- Do not put a key in browser code, mobile apps, public code repositories or logs.
- Use a different key for each application or environment, so that you can revoke one key without stopping the others.
4. Do not go around limits
- Do not make more keys, workspaces or accounts to get past rate limits, the limit on open requests or the spend cap.
- Do not use the key of another workspace, and do not change keys to get past a block.
- Do not run load tests or security tests on the API unless we agree to it in writing.
5. Do not attack the service
- Do not send prompt injection: content that tries to change the instructions of the service, show its prompts, make its tools do things outside their purpose, or get data of other customers.
- Do not try to get access to data of other workspaces or to systems that the API does not give you.
- Do not send malware, and do not try to stop or slow down the service.
- Do not try to reverse engineer the models, prompts or ranking of the service.
6. Automated decisions and high-risk use
- Do not use API results as the only basis for a decision that has a legal effect or a similar significant effect on a person, for example a tax position, a payroll calculation, credit, employment or benefits. A qualified person must review such a decision.
- Do not use the API for practices that the EU AI Act prohibits.
- If your product is a high-risk AI system under the EU AI Act, you are responsible for the obligations that the Act gives you.
- Do not show API results as advice from Taxxa AI or from a professional, unless a qualified person has reviewed them.
7. Lawful use
- Use the API only in a lawful way, and obey export control and sanctions laws.
- Send personal data only when you need to, and only with a valid legal basis. Do not send special categories of personal data unless the law permits it and your use needs it.
- Do not use the API to break the rights of other persons.
8. Report abuse
8.1 Tell us at contact@taxxa.ai if you see abuse of the API, an exposed key or a security problem. Include the request id, the time and what happened, if you have them.
8.2 To protect the service, we monitor usage counts and request patterns for each key and workspace. We do not keep the content of requests. If we see a break of this policy, we can block keys or suspend API access, as the Developer API Terms describe.