Developer Terms

These terms are between Dycern LLC, doing business as Xtimates ("Xtimates", "we", "us"), and anyone who connects software to the platform at https://app.xtimates.com ("you"). They add to the Terms of Service (xtimates.com/legal/terms) and the Acceptable Use Policy (xtimates.com/legal/acceptable-use). If you're a partner working for a client, the client's agreement with us applies too, and you act for that client.

Four things are covered:

• The website form endpoint, webhook URL and CSV import are created by an owner or admin in Settings › Connections. Each comes with its own secret.
• An API key for the usage API is issued by us, on request to support@xtimates.com, to a named account and purpose. We can limit what a key can read and we can revoke it.
• Keep every secret and key private. Don't put it in client-side code, in a public repository, or in a URL. Rotate it in Settings › Connections, or ask us to, if you think it leaked, and tell us.
• You're responsible for everything done with your keys until you tell us they're compromised.

Settings › Connections gives you an endpoint URL and a snippet for your website's estimate form. Each submission your form sends becomes a new estimate request on your board, with its source recorded. A test button lets you send a sample and see it arrive.

• Send only what the form asked the person for: name, phone, email, address or town, the job, and the page it came from.
• Submissions are checked for duplicates, rate-limited to stop abuse, and rejected if the secret is wrong.
• The snippet sets no cookies and loads nothing from a third party.
• If you change your website, keep the snippet's secret out of the page's source where you can; use a server-side call if your site can make one.

A webhook is a URL you post estimate requests to from Zapier, Make, your CRM or your own code. It accepts the same fields as the website form, plus a source label, and returns a success or an error code.

• Every request must carry the webhook's secret in the header we document in Settings › Connections. Requests without it are dropped.
• Send each request once. If you retry on a timeout, send the same request id so we can ignore the duplicate.
• We don't call your systems back. Reading happens on a schedule for the CRMs we connect to, and through the usage API below.
• Payloads we can't parse are rejected with a reason. We keep the last few rejected payloads for a short time so you can see what went wrong.

From Settings › Connections you can upload a CSV of past estimate requests and jobs. The import maps your columns to ours, shows a preview, and merges duplicates by phone and email. Imported rows are your records, not the platform's, and they don't count toward the guarantee or your bill.

The usage API returns counts for one account: estimates counted by period and source, flagged and removed requests, and the figures the billing page is built from. Xtimates's own billing and partner dashboards read it. It's read-only and returns numbers and ids, not homeowners' names or contact details.

• Every call carries an API key in the Authorization header. A key reads only the accounts it was issued for.
• Calls are rate-limited. The limits and the response format are documented where the key is issued. If you hit a limit, back off and retry later.
• Numbers can lag the dashboard by up to a sync cycle (about 5 minutes).
• Don't cache responses longer than a day, and don't show one client's numbers to another.

• Send only data you have the right to send, about people who asked the client for a price, as the Acceptable Use Policy says.
• Handle any data you receive as the Data Processing Addendum (xtimates.com/legal/dpa) requires of us: only for the authorizing client, protected, and deleted when they ask or when your access ends.
• Don't use the endpoints to load-test, probe, scrape or reach data you weren't given.
• Don't build something that pretends to be the platform or misstates where data comes from.
• Comply with the law where you operate, including privacy and anti-spam law.

The endpoints are provided as is. We work to keep them up, but they can be down for maintenance or reasons outside our control. We can change them. For a change that would break an integration, we'll email the key's owner at least 30 days ahead. For a security fix, we may change them right away and tell you after. We can suspend a key or endpoint immediately if it's misused or puts a client at risk, and we'll say why.

We don't charge for these endpoints today. If that changes, we'll tell you before it does, and current keys keep working until the notice period ends.

You can delete an endpoint or ask us to revoke a key at any time. When a client's service ends, their endpoints and any partner keys for their account stop working on the last day. Data already received stays with the client's account under the Data Deletion page.

These terms are governed by the laws of the State of Indiana. The dispute terms in the Terms of Service (xtimates.com/legal/terms) apply. Dycern LLC, doing business as Xtimates. Questions: support@xtimates.com.