# Terms of Service Effective October 19, 2026 ## 1. Acceptance of these Terms These Terms of Service ("Terms") govern access to and use of SambungAPI (the "Service"). By creating an organization, signing in, or calling the Service's API, you agree to these Terms on behalf of yourself and, if you are acting for an organization, on behalf of that organization. If you do not agree, do not use the Service. These Terms are effective as of October 19, 2026. ## 2. The Service SambungAPI is a hosted service that lets your organization's bots and operators talk to people on channels, and lets your organization connect third-party tools and call them through one consistent API. For a tool, you connect an account for a supported provider (today, Google — Drive, Docs, Sheets, Slides, Calendar, Gmail, Meet), and your project can then invoke that provider's capabilities through SambungAPI's API without your application holding the underlying OAuth credential directly. The [Channels](/terms#channels) section describes each channel. Toolkits other than the ones named above are not offered in the product today. Microsoft is a partial exception: its OAuth application is registered and configured, so a connect flow for it can technically complete against our API on a deployment that holds Microsoft credentials, but it is not shown in the connect experience and has only been verified against a mocked Microsoft Graph, never a live account. GitHub, Notion, Linear, and Jira have no OAuth application registered, and they are not offered: they are not shown in the connect experience, and we do not support connecting them. We do not represent that any hidden or unconfigured toolkit is generally available for your use. ## 3. Channels A channel is a messaging platform on which your organization's bots and operators talk to people. On every channel, SambungAPI talks through an API that the platform permits for businesses, and it never automates a personal account. Today, the Service offers three channels: the WhatsApp Business Platform, Messenger and Instagram. On the WhatsApp Business Platform, your organization connects its own WhatsApp Business Account: with Meta's Embedded Signup, in which you sign in to Meta in a Meta window and accept Meta's terms there, or with a token from a Meta app that your organization registered itself. Your organization complies with the [WhatsApp Terms for WhatsApp Business Platform](https://www.whatsapp.com/legal/WhatsApp-Terms-for-WhatsApp-Business-Platform), the [Meta Terms for WhatsApp Business Platform](https://www.facebook.com/legal/Meta-Terms-for-WhatsApp-Business-Platform) and the [WhatsApp Business Messaging Policy](https://business.whatsapp.com/policy), and, for a phone number that it also uses in the WhatsApp Business app, the [WhatsApp Terms for WhatsApp Business App](https://www.whatsapp.com/legal/WhatsApp-Terms-for-WhatsApp-Business-App). Among other things, these require your organization to get a person's opt-in before it messages that person on WhatsApp, and to honor every request to stop. They also forbid a provider of artificial intelligence technology, such as a general-purpose AI assistant, to offer that technology on WhatsApp as its main service, except where Meta permits it. Meta charges your organization for WhatsApp messages at Meta's own prices and bills it directly; SambungAPI adds no charge to them. On Messenger and Instagram, your organization connects its own Facebook Pages and Instagram professional accounts. It signs in to Facebook in a Meta window (Page connect), or to Instagram in a Meta window (Instagram connect), and grants their access there. Your organization complies with the [Meta Platform Terms](https://developers.facebook.com/terms), the [Meta Developer Policies](https://developers.facebook.com/devpolicy/), the [Messenger Platform and IG Messaging API policy](https://developers.facebook.com/documentation/business-messaging/messenger-platform/policy) and the [Instagram Platform policies](https://developers.facebook.com/devpolicy/#instagramplatform) in the Developer Policies. Your organization's bots and operators reply to a person only within Meta's messaging windows. A reply with Meta's human agent tag comes from a person, never from a bot, and a utility message carries no promotion. SambungAPI adds no charge to Messenger or Instagram messages; a charge that Meta makes for them is between your organization and Meta. Your organization must not process the data that it receives through a channel in a way that violates these Terms or the terms and policies of that channel's platform, the [Meta Platform Terms](https://developers.facebook.com/terms) included. We process that data only for your organization and at its direction, to provide and secure the Service, and not for our own purposes or for another organization, except where the law requires us to disclose it. When your organization connects a WhatsApp Business Account, a Facebook Page or an Instagram professional account with a Meta app that it registered itself, this paragraph is our written agreement to what the Meta Platform Terms require of your organization's service providers. Our hosting provider processes personal data only to operate the Service, under its written data processing terms with us, and our backups are encrypted before they leave our infrastructure, with the keys that decrypt them held apart from the Service. If a channel's platform asks us to stop your organization's use of that channel, because the platform believes that your organization violated its terms or harms the people who use it, we stop that use. While that stop lasts, your organization cannot send, receive or read messages on that channel through the Service, and cannot connect that channel again. We keep your organization's data of that channel, and we delete it when your organization deletes it, when your organization is deleted, or when the platform tells us that the stop is final or asks us to delete that data. ## 4. Accounts and responsibilities - You are responsible for the accuracy of the information you give the Service, for the security of the password or the Google account that you sign in with, and for the security of your session and of each API key issued to your organization. - API keys are secrets. You are responsible for safeguarding them and for all activity that occurs under a key issued to your organization, whether or not you authorized the specific call. - You are responsible for your own use of any third-party provider you connect through the Service, and for complying with that provider's own terms (for example Google's API terms). The [Channels](/terms#channels) section names the terms that apply on each channel. - You are responsible for any data — including payload content — that you cause to be processed or stored through the Service. ## 5. Acceptable use & API limits You agree not to use the Service to: - Access or attempt to access another organization's or project's data without authorization. - Circumvent, probe, or attempt to bypass usage quotas, rate limits, or authentication. - Create an account with a script or other automated means, or create more than one account to get more usage quota. - Use a connected third-party account in a way that violates that provider's own terms of service. - Use a channel in a way that violates the terms or policies of its platform. - Transmit unlawful content, or use the Service to violate any applicable law. - Reverse engineer the Service except to the extent applicable law prohibits this restriction. The Service enforces usage quotas: by default, up to 10,000 accepted tool calls per project per day and up to 100,000 per organization per day (an operator may configure different defaults for a given deployment). One successfully authenticated, accepted call to the tool-execution endpoint counts as one usage unit. Each outbound message that a channel's platform accepts also counts as one usage unit. No quota applies to messages today, and the Service does not refuse a message because of that count. When a quota is exceeded, the Service responds with an HTTP 429 and a `Retry-After` header along with your remaining allowance and when it resets, rather than silently dropping or queuing the call. ## 6. Fees SambungAPI does not currently charge fees for use of the Service. There is no paid tier as of the effective date. If we introduce paid plans in the future, we will update these Terms with pricing and billing terms and provide notice before any charge applies to your organization. ## 7. Intellectual property SambungAPI and its underlying software, design, and documentation are owned by us and our licensors. These Terms grant you a limited, non-exclusive, non-transferable right to use the Service for your organization's own purposes. You retain all rights to the data and content your organization processes through the Service; we do not claim ownership of it. ## 8. Service availability The Service currently runs on **test-tier infrastructure**. We do not commit to an uptime service level agreement (SLA), and we do not hold, and do not represent that we hold, SOC 2, ISO 27001, or any other formal security or compliance certification. The Service is provided on a best-effort basis, and we may perform maintenance, change infrastructure, or experience downtime without a service-level penalty. We will update this section if the Service's infrastructure tier or availability commitment changes. To the maximum extent permitted by law, the Service is provided **"as is" and "as available"**, without warranties of any kind, whether express, implied, or statutory, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. ## 9. Termination You may stop using the Service at any time. You can delete your account in the console: open the account menu at the top of the page (your name or initials), then select Delete your account. Your account and every organization in which you are the only member are deleted 30 days later, and signing in before then cancels the deletion. During those 30 days, the API keys of those organizations stop working. For each organization where you are the only owner and other people are members, you choose one of them to become its owner at once. An owner of an organization can delete it in the console: open Settings in the Organization section of the navigation, select Delete organization, and sign in again to confirm. The organization is deleted 30 days later. During those 30 days, its API keys stop working, its members can still open it, and an owner can cancel the deletion. The deletion revokes active sessions and API keys, hard-deletes the organization's project data and stored files, and leaves only a minimal, non-sensitive record for a short window (30 days) before that record is purged as well. You can also contact us (see [Contact](/terms#contact)) to delete an organization. We may suspend or terminate your access if you violate these Terms (including the Acceptable Use section above), if required by law or legal process, or if we reasonably believe your use poses a security or integrity risk to the Service or to other organizations using it. Because the Service currently runs on test-tier infrastructure with no committed SLA, we may also need to suspend access for planned maintenance or infrastructure changes; see [Service availability](/terms#availability). ## 10. Limitation of liability To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, or punitive damages arising out of or related to these Terms or the Service. Each party's total aggregate liability arising out of or related to these Terms will not exceed the amount you paid us for the Service in the twelve months preceding the event giving rise to the claim — which, as of the effective date, is zero, because the Service does not currently charge fees (see [Fees](/terms#fees)). This limitation will not apply to the extent prohibited by applicable law. Because the Service holds customer's OAuth credentials on its users' behalf, the operator has evaluated this fees-based cap against the Service's risk profile and accepted it for the current no-fee phase; it will be revisited if and when paid plans are introduced. ## 11. Indemnification You agree to indemnify and hold us harmless from third-party claims, damages, and reasonable expenses arising out of your breach of these Terms, your violation of applicable law, or your misuse of a connected third-party provider through the Service, to the extent permitted by applicable law. ## 12. Governing law These Terms are governed by the laws of **Indonesia**, without regard to its conflict-of-laws principles, and disputes arising out of or relating to these Terms or the Service will be subject to the exclusive jurisdiction of the courts of Indonesia. This choice is consistent with the operator's incorporation and public headquarters location (Jakarta). ## 13. Changes to these Terms We may update these Terms as the Service changes. When we do, we will revise the effective date at the top of this page. Today, we do not send notice of a change by email or in the Service, so check this page for the current version. ## 14. Contact Questions about these Terms can be sent to [legal@metatech.id](mailto:legal@metatech.id). For privacy-specific questions, see our [Privacy Policy](/privacy).