TimePlate — SlashHub Limited
Last updated: 2026-10-12 · Version 1.0.0
What this is. These API Terms govern programmatic access to the TimePlate API and webhooks. They supplement the Terms of Service (including ToS §12, API Terms) and, where signed, the Master Services Agreement ("MSA"). On API matters they prevail over the ToS and the MSA. Language. Drafted in English with a 繁體中文 translation. The English version governs unless a signed contract states otherwise.
1.1 "API" means the TimePlate application programming interfaces, webhooks, SDKs, sample code and related documentation ("API Docs"). "API Key" means any credential (key, token, client secret, service account) we issue for API access. "Developer" means the Customer and any person the Customer authorises to use an API Key on its behalf.
1.2 These API Terms apply whenever you access the API. If you are a Developer acting for a Customer, you confirm you are authorised by that Customer and that the Customer is bound by these terms.
1.3 Capitalised terms not defined here have the meaning in the Terms of Service or the MSA.
2.1 Access requires an API Key issued to an authorised account. API Keys are personal and confidential. You must not share, publish, sell or transfer them, and must store them in a secure secret manager (not in client-side code, public repositories, or logs).
2.2 You must rotate API Keys on a schedule and immediately upon any suspected compromise, and notify
us at security@slashhub.hk without undue delay if you believe a key has been exposed.
2.3 All API requests must be authenticated. We may revoke or rotate an API Key at any time if we reasonably believe it is compromised or being misused.
3.1 You may use the API only (a) to integrate your own authorised systems with TimePlate, and (b) in accordance with the API Docs and these terms.
3.2 You must not: (a) use the API to build a competing product or to train a competing AI model; (b) benchmark, load-test or stress-test the API without our prior written consent; (c) scrape, mine or bulk-extract data beyond the documented endpoints and your authorised scope; (d) bypass, circumvent or attempt to bypass any rate limit, quota, authentication or access control; (e) resell, sublicense or provide the API as a service to third parties; (f) reverse-engineer the API or its underlying software except as permitted by law; or (g) use the API to infringe any third-party right or breach any law.
3.3 You must respect tenant isolation and the scope of each API Key. You must not attempt to access data of a tenant, employee or record that is outside your authorised scope.
4.1 The API is subject to rate limits, quotas and fair-use rules, which we set and may change to protect the stability and security of the service. Current limits are described in the API Docs and may be per-account, per-key or per-endpoint.
4.2 When a limit is exceeded we may return an HTTP 429 (or equivalent) and may throttle your traffic. You must implement exponential back-off and retry with jitter, and must not retry aggressively against errors.
4.3 We may apply a burst cap, an IP allow-list, or additional controls for high-volume integrations, and may require an Enterprise plan for materially higher limits.
5.1 Data accessed or submitted through the API (including employee Personal Data) remains subject to the DPA, the Security & Compliance Schedule and the Customer's obligations as data user under the PDPO.
5.2 You must not use API-derived data to train, fine-tune or improve any AI model, and must not sell or share it except as permitted by the MSA and DPA.
5.3 You must comply with all applicable data-protection law when processing data obtained through the API, including obtaining any required consents and honouring data-subject rights.
6.1 Where we send webhooks, they are signed (for example, an HMAC signature header). You must verify the signature on every request and reject unsigned or invalid requests. Do not treat webhook payloads as trusted until the signature is verified.
6.2 Webhook delivery is at-least-once: you must handle duplicate deliveries idempotently. Delivery is retried on failure for a limited period; you should not rely on webhooks as the sole source of truth and should reconcile against the API.
7.1 The API is versioned. We may add, change or remove endpoints and fields in a backward-compatible way at any time.
7.2 For a breaking change, we will provide at least 90 days' notice (as stated in ToS §12). SlashHub may, at its discretion, provide a compatibility or deprecation period for the affected version; it does not commit to any fixed backward-compatibility period. A shorter notice period may apply where required for security or legal reasons.
7.3 Deprecations are announced in the API Docs and, where you have registered a contact, by email.
8.1 Where you are on a paid plan, the API is part of the production service covered by the SLA. Beta APIs are excluded from the SLA.
8.2 API support is provided under your support tier. We do not provide bespoke integration engineering unless agreed in a SOW.
9.1 You must use TLS for all API traffic, protect API Keys and any tokens, and follow the practices in the API Docs.
9.2 You must promptly report any vulnerability you discover to security@slashhub.hk and must not
exploit it or disclose it publicly before we have had a reasonable opportunity to remediate.
9.3 Where we offer a sandbox, you must not use production data in it.
10.1 We monitor API usage to ensure stability, security and fair use.
10.2 We may throttle, suspend or revoke API access, with or without notice, if your use poses a security or stability risk, breaches these terms or the AUP, exceeds limits, or is required by law. Where practicable, we will notify you and allow a reasonable opportunity to remedy.
11.1 We retain all rights in the API and the API Docs. We grant you a limited, non-exclusive, non-transferable, revocable licence to use the API during the term, within your authorised scope.
11.2 You retain rights in your own applications. You grant us a licence to process the data you send through the API solely to provide the API and as permitted by the DPA.
If API usage beyond your plan's allowance is chargeable, the applicable fees are stated in your Order Form or our pricing. We may change API-related fees on the notice in the MSA clause 5.6.
13.1 The API and API Docs are provided "as is", and the disclaimers, liability exclusions and cap in the Terms of Service / MSA apply. The API is a developer interface; you are responsible for your integration and for testing it before relying on it.
13.2 You shall indemnify us against claims arising from your use of the API, your application, or your breach of these terms.
14.1 These API Terms run while you have API access. We may suspend or terminate API access under clause 10, or on termination of your subscription.
14.2 On termination you must stop using the API and delete or return API-derived data as required by the MSA and DPA.
15.1 These API Terms are governed by the laws of the Hong Kong SAR, and disputes are resolved under the MSA / Terms of Service dispute-resolution clause (HKIAC arbitration, seat Hong Kong).
15.2 API enquiries: support@slashhub.hk. Security: security@slashhub.hk. Legal: legal@slashhub.hk.
最後更新:2026-10-11 · 版本 1.0.0(草擬本) · 狀態:範本 — 待香港法律審閱
請先閱讀。 本文件為借助 AI 起草的範本,並非法律意見,使用前必須由合資格香港律師審閱及簽署。 本文件是什麼。 本 API 條款規管對 TimePlate API 及 Webhook 的程式化存取,為服務條款(包括第 12 條「API 條款」)及(如已簽署)主服務協議(「MSA」)的補充。就 API 事宜,本條款優先於服務條款及 MSA。 語言。 本文件以英文草擬並附繁體中文譯本。除經簽署的合約另有訂明外,以英文版本為準。
1.1 「API」指 TimePlate 應用程式介面、Webhook、SDK、範例碼及相關文件(「API 文件」)。「API 金鑰」指我們為 API 存取而發出的任何憑證(金鑰、權杖、客戶密鑰、服務帳戶)。「開發者」指客戶及客戶授權代表其使用 API 金鑰的任何人。
1.2 本 API 條款於您存取 API 時適用。如您是代表客戶行事的開發者,您確認已獲該客戶授權,且該客戶受本條款約束。
1.3 本條款未定義的粗體術語具有服務條款或 MSA 所賦予的涵義。
2.1 存取須由授權帳戶取得 API 金鑰。API 金鑰屬個人及機密。您不得分享、發佈、出售或轉讓金鑰,並須將其儲存於安全的密鑰管理工具(不得置於客戶端碼、公開儲存庫或日誌中)。
2.2 您須定期輪換 API 金鑰,並於懷疑任何洩露時立即輪換,且在您相信金鑰已外洩時及時通知 security@slashhub.hk。
2.3 所有 API 請求必須經認證。如我們合理相信金鑰已洩露或被濫用,可隨時撤銷或輪換該金鑰。
3.1 您僅可(a)為將您自身的授權系統與 TimePlate 整合,及(b)按照 API 文件及本條款使用 API。
3.2 您不得:(a) 使用 API 建立競爭產品或訓練競爭 AI 模型;(b) 未經我們事先書面同意對 API 進行基準測試、負載測試或壓力測試;(c) 超出已記錄端點及您的授權範圍抓取、挖掘或大量提取資料;(d) 繞過或試圖繞過任何速率限制、配額、認證或存取控制;(e) 轉售、再許可或將 API 作為服務提供予第三方;(f) 對 API 或其底層軟件進行反向工程,惟法律允許者除外;或 (g) 使用 API 侵犯任何第三方權利或違反任何法律。
3.3 您須尊重租戶隔離及每個 API 金鑰的範圍。您不得試圖存取您授權範圍以外的租戶、僱員或記錄的資料。
4.1 API 受速率限制、配額及合理使用規則約束,該等規則由我們設定並可變更,以保護服務的穩定性及安全性。現行限制載於 API 文件,並可能按帳戶、按金鑰或按端點計算。
4.2 超出限制時,我們可能回傳 HTTP 429(或等效)並限制您的流量。您須實作指數退避及帶抖動的重試,且不得針對錯誤積極重試。
4.3 我們可對高流量整合施加突發上限、IP 允許清單或額外控制,並可要求以 Enterprise 計劃提供大幅較高的限額。
5.1 透過 API 存取或提交的資料(包括僱員個人資料)仍受 DPA、保安及合規附表,以及客戶作為 PDPO 下資料使用者的義務規限。
5.2 您不得使用 API 衍生的資料訓練、微調或改進任何 AI 模型,亦不得出售或分享該等資料,惟 MSA 及 DPA 允許者除外。
5.3 您須在處理透過 API 取得的資料時遵守所有適用的資料保護法,包括取得任何所需同意及履行資料當事人權利。
6.1 在我們發送 Webhook 時,該等請求經簽署(例如 HMAC 簽署標頭)。您必須驗證簽署,並拒絕未簽署或無效的請求。在驗證簽署前,不得視 Webhook 負載為可信。
6.2 Webhook 傳送為至少一次:您須以幂等方式處理重複傳送。傳送會於失敗後在有限期間內重試;您不應以 Webhook 作為唯一資料來源,並應與 API 對帳。
7.1 API 設有版本。我們可隨時以向後兼容方式新增、變更或移除端點及欄位。
7.2 就破壞性變更,我們將提供至少 90 日通知,並會以商業上合理的努力在變更後至少 12 個月內維持向後兼容(如服務條款第 12 條所述),惟因保安或法律理由需要較短期間者除外。
7.3 淘汰事項會在 API 文件中公告,並在您已登記聯絡方式時以電郵通知。
8.1 如您使用付費計劃,API 屬 SLA 所涵蓋的正式環境服務一部分。測試版 API 不屬 SLA 範圍。
8.2 API 支援按您的支援級別提供。除 SOW 另有約定外,我們不提供度身訂造的整合工程。
9.1 您須就所有 API 流量使用 TLS,保護 API 金鑰及任何權杖,並遵循 API 文件中的做法。
9.2 您須及時向 security@slashhub.hk 舉報所發現的任何漏洞,且在我們有合理機會補救前,不得利用或公開披露該漏洞。
9.3 如我們提供沙盒,您不得在沙盒中使用正式環境資料。
10.1 我們監控 API 使用,以確保穩定性、安全性及合理使用。
10.2 如您的使用構成保安或穩定性風險、違反本條款或 AUP、超出限制,或法律要求,我們可(不論事前通知)限制、暫停或撤銷 API 存取。在可行情況下,我們會通知您並給予合理補救機會。
11.1 我們保留 API 及 API 文件的一切權利。我們授予您在期間內於授權範圍內使用 API 的有限、非獨家、不可轉讓、可撤銷許可。
11.2 您保留自身應用程式的權利。您授予我們一項許可,僅為提供 API 及按 DPA 允許而處理您透過 API 傳送的資料。
如超出計劃配額的 API 使用需收費,適用費用載於您的訂購表格或我們的定價。我們可按 MSA 第 5.6 條的通知更改 API 相關費用。
13.1 API 及 API 文件按「原樣」提供,服務條款/MSA 的免責聲明、責任除外及上限適用。API 屬開發者介面;您須負責您的整合及在依賴前進行測試。
13.2 您應就因您使用 API、您的應用程式,或您違反本條款而產生的申索,彌償我們。
14.1 本 API 條款於您擁有 API 存取期間生效。我們可按第 10 條,或在您的訂閱終止時,暫停或終止 API 存取。
14.2 終止時,您必須停止使用 API,並按 MSA 及 DPA 的要求刪除或交還 API 衍生資料。
15.1 本 API 條款受香港特別行政區法律管轄,爭議按 MSA/服務條款的爭議解決條款(香港國際仲裁中心仲裁,仲裁地為香港)解決。
15.2 API 查詢:support@slashhub.hk。保安:security@slashhub.hk。法律:legal@slashhub.hk。
SlashHub Limited © 2026 · For questions, contact legal@slashhub.hk