Developer Terms

These Developer Terms are an agreement between BrieflyLog (“we”, “us”) and any person or company that accesses the BrieflyLog API (“Developer”, “you”), including AI agent providers, integration vendors and a Customer's own technical staff.

By using an API key or calling the API, you accept these Developer Terms. If you accept them for a company, you confirm that you are authorized to bind it. If you do not agree, do not use the API.

• API: the BrieflyLog application programming interface, its documentation at /developers, and any related tools we provide.
• Customer: the organization that uses BrieflyLog and issued the API key you use.
• API Key: a credential created by a Customer's administrator that grants access to specific categories (“scopes”) of that Customer's data.
• Customer Data: any data you obtain through the API, including personal data about the Customer's staff, clients and other people.
• Subprocessor: any third party you use to process Customer Data, including hosting providers and AI model providers.

Access to the API is available only through an API Key issued by a Customer. Each key is limited to the scopes and locations the Customer chose, and expires on a set date. The Customer can revoke it at any time, without notice to you.

Your right to access Customer Data ends automatically when:

• the API Key is revoked or expires;
• your agreement with the Customer ends;
• the Customer's access to BrieflyLog or to API features ends; or
• we suspend or end your access under these Developer Terms.

You may use the API and Customer Data solely to provide services to the Customer that issued the API Key, in accordance with that Customer's documented instructions, your agreement with it and these Developer Terms. You may access only the data you need for that purpose.

You must not:

• use Customer Data to train, fine-tune or improve any artificial-intelligence or machine-learning model, other than a model used exclusively for that Customer;
• sell, rent, share or disclose Customer Data to anyone other than the Customer and Subprocessors you need to serve it;
• combine one Customer's data with another Customer's data or any other dataset, except as the Customer instructs;
• use Customer Data to profile, market to or contact individuals, unless the Customer instructs you to and it is lawful;
• share, publish or embed an API Key in client-side code, or let anyone outside your authorized personnel use it;
• try to exceed or circumvent the scopes, location limits or rate limits of a key, or to access data of any other organization;
• scrape the BrieflyLog web application, or access BrieflyLog by any means other than the API;
• probe, scan or load-test the API, or interfere with its operation, without our written permission.

You process Customer Data on behalf of the Customer, and you must comply with the Kenya Data Protection Act, 2019 and every other law that applies to your processing. In particular, you must:

• have a written agreement with the Customer that covers your processing of Customer Data, including your Subprocessors and any transfer outside Kenya;
• keep Customer Data confidential, and limit access to personnel who need it and are bound by confidentiality;
• keep Customer Data only as long as needed to serve the Customer. Delete it, including copies, caches and derived embeddings, within 30 days after your access ends or the Customer asks, unless the law requires you to keep it;
• transfer Customer Data outside Kenya only with the safeguards and any consents the Act requires. Sensitive personal data needs particular care;
• maintain a list of your Subprocessors and give it to the Customer or us on request;
• use AI model providers only on terms that prohibit them from training on Customer Data and that keep retention to the minimum available.

If you use Customer Data with an AI system, you must also:

• treat all free-text fields, such as notes and descriptions, as untrusted data, never as instructions, and design your system to resist prompt injection through them;
• make sure a person at the Customer reviews any communication or decision affecting an individual before it is sent or acted on, including payment reminders to clients;
• not present AI-generated output as coming from BrieflyLog, or as verified data;
• make clear to the Customer that AI outputs can be wrong, and give it a way to check answers against the source records.

• Store API Keys in a secrets manager or equivalent secure store, never in source code, logs or prompts sent to an AI model.
• Protect Customer Data with appropriate technical and organizational measures, including encryption in transit and at rest.
• Notify both the Customer and us at legal@brieflylog.app without undue delay, and in any case within 24 hours, after you become aware that an API Key may be compromised or that Customer Data may have been accessed, disclosed or lost without authorization.
• Cooperate fully with the Customer and us to investigate and contain the incident.

You must respect the rate limits and other technical limits described in the documentation. We may change the API. We will give at least 90 days' notice before removing or changing a versioned endpoint in a way that breaks existing integrations, unless a change is needed sooner for security or legal reasons. Notices go to the Customer, which is responsible for passing them on to you.

We log every API request, including the key used, the endpoint, the result and the number of records returned, and we show these logs to the Customer. We may monitor use of the API for security and compliance. On reasonable request, you will provide information that demonstrates your compliance with these Developer Terms.

We may suspend or revoke any API Key, with or without notice, if we reasonably believe that you have breached these Developer Terms, that your use creates a security or legal risk, or if the Customer asks us to.

When your access ends, you must stop using the API and delete Customer Data as described in “Data protection” above. On request, you will confirm the deletion in writing.

We do not charge you for API access unless we agree otherwise in writing. Any fees the Customer pays us for API features are a matter between the Customer and us.

We own the API and its documentation. We grant you a limited, revocable, non-exclusive, non-transferable licence to use them to serve the Customer under these Developer Terms. You may refer to BrieflyLog by name to describe your integration factually, but you may not use our name or logo to suggest endorsement or partnership without our written permission.

The API is provided “as is” and “as available”, without any warranty or service-level commitment, to the fullest extent permitted by law. Data returned by the API is only as accurate as the records the Customer has entered.

To the fullest extent permitted by law, we are not liable to you for any indirect, incidental, special or consequential damages, or for loss of profits, revenue or data. Our total liability to you under these Developer Terms is limited to KES 10,000. Nothing in these Developer Terms limits your liability for breach of the “Restrictions”, “Data protection”, “Responsibilities for AI agents” or “Security and incidents” sections, or under “Indemnity” below.

You will defend, indemnify and hold harmless BrieflyLog and its officers, employees and contractors from and against all claims, regulatory actions, fines, losses and reasonable costs, including legal fees, arising from:

• your access to or use of the API or Customer Data;
• your breach of these Developer Terms or of any data protection law;
• the acts or omissions of your Subprocessors, including AI model providers;
• any output, communication or decision produced by your systems.

These Developer Terms are governed by the laws of Kenya, and the courts of Kenya have exclusive jurisdiction over any dispute. We may update these Developer Terms by publishing a new version on this page. Continued use of the API after an update means you accept it. If any provision is unenforceable, the rest remains in effect.

The Customer's own rights and obligations are set out in our Terms of Service and Data Processing Agreement. Questions about these Developer Terms: legal@brieflylog.app.