API terms of use

Binding on any person or entity that accesses the VenueSumo API

Version 1.0 · Effective 1 September 2026

IMPORTANT. These VenueSumo API Terms of Use (“API Terms”) govern access to and use of the VenueSumo application programming interfaces. They apply to You whether or not You are a customer of VenueSumo. If You are entering into these API Terms on behalf of a company or other legal entity, You represent that You have authority to bind that entity, in which case “You” and “Your” refer to that entity.

These API Terms contain a limitation of liability (clause 15), an indemnity (clause 16), a non-solicitation obligation with liquidated damages (clause 18) and, for customers in the United States, a binding arbitration agreement and class action waiver (clause 22.5). Please read them carefully.

1. Scope and acceptance

1.1 These API Terms form a binding agreement between You and the VenueSumo Entity determined in accordance with clause 22.1 (“VenueSumo”, “We”, “Us”, “Our”).

1.2 You accept these API Terms by clicking to accept them, by submitting a request for API Credentials, or by accessing or using the API, whichever occurs first.

1.3 These API Terms apply to every person who accesses the API, including: (a) a Customer accessing the API directly; (b) an Integrator accessing the API using a Customer’s API Credentials or on a Customer’s behalf; and (c) any technology or channel partner integrating a product or service with the Platform.

1.4 Where You are a Customer, these API Terms supplement clause 2A of the Terms and Conditions of Use. If there is any inconsistency between these API Terms and the Terms and Conditions of Use in respect of API access, clause 2A prevails. Where You are not a Customer, these API Terms apply on a stand-alone basis.

1.5 Access to the API in respect of any particular Customer account is additionally conditional on that Customer having a current API Order Form with Us that authorises the relevant access.

2. Definitions

Capitalised terms used but not defined in these API Terms have the meaning given in the Terms and Conditions of Use published at venuesumo.com/terms-conditions. In addition:

“API” means the application programming interfaces made available by Us in connection with the Platform, including the VenueSumo Customer API and any bulk export, reporting, webhook or event-streaming interface, together with any associated SDKs, sandbox environments and Documentation.

“API Credentials” means client identifiers, client secrets, API keys, tokens, certificates and other credentials permitting access to the API.

“Customer” means a person or entity that has entered into a Software Subscription Agreement with Us for the VenueSumo Services.

“Customer Data” means all data and information (including personal information) originating from, derived from or relating to a Customer or its guests that is provided to You or processed through the API, including booking, ticketing, membership, waiver, transaction, guest profile and point of sale records.

“Integrator Data” means data and information that You have collected independently of the API and the VenueSumo Services and that You submit to Us through the API. It excludes Customer Data and VenueSumo Data.

“Security Incident” means any accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Data or VenueSumo Data, or any compromise of Your API Credentials or evidence of unauthorised access to the API.

“VenueSumo Data” means data and information generated by Us or by the Platform that is not Customer Data or Integrator Data, including record identifiers, schemas, data models, field structures, configuration metadata, logs, telemetry and analytical outputs.

“Your Application” means the application, product or service that You integrate with the Platform using the API.

3. Approval, registration and Customer authorisation

3.1 API access is granted only following Your written request and Our subsequent written approval. We may approve, refuse or revoke a request in Our absolute discretion, and may limit the endpoints, scopes, environments and data fields available to You.

3.2 You must not access any Customer account or any Customer Data unless and until: (a) the Customer has authorised Your access in writing or through an authorisation mechanism provided by Us; and (b) that Customer has a current API Order Form with Us covering the relevant access. Any other access to a Customer account or to Customer Data is strictly prohibited and is a material breach of these API Terms.

3.3 Before accessing any Customer Data, You must have in place a written agreement with the relevant Customer that contains terms at least as protective of Us as these API Terms, including the flow-down provisions required by clause 2A.14 of the Terms and Conditions of Use, and that names Us as an intended third party beneficiary entitled to enforce them.

3.4 We are under no obligation to certify, list, publish or promote Your Application, or to make it available to Customers, and nothing in these API Terms creates any such obligation.

4. Licence grant and permitted use

4.1 Subject to Your compliance with these API Terms, We grant You a limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, revocable, royalty-free right and licence to access and use the API and the Documentation solely for the purpose of building, testing, operating and supporting an integration between Your Application and the Platform for the benefit of Customers who have authorised You under clause 3.2 (the “Permitted Use”).

4.2 Any use of the API that is not expressly permitted by these API Terms is a material breach entitling Us to terminate these API Terms and revoke Your access with immediate effect.

4.3 All rights not expressly granted are reserved. These API Terms do not convey any ownership interest in the API, the Documentation, the Platform, the VenueSumo Services, VenueSumo Data or Customer Data.

5. Restrictions

You must not, and must not permit any third party to:

1. use the API, the Documentation, VenueSumo Data or Customer Data to build, support, benchmark against, or assist any third party to build or support, any product or service that competes with the VenueSumo Services;
2. reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, structure, sequence, organisation, algorithms or data model of the API or the Platform;
3. copy any feature, function, text or graphic of the API or the VenueSumo Services;
4. resell, sublicense, rent, lease, distribute, timeshare or otherwise commercially exploit the API, or provide the API to any third party as part of a bureau, outsourcing or managed service arrangement;
5. use the API to service or support any product or service other than Your Application as approved by Us;
6. scrape, crawl, harvest or mine data from the Platform or the VenueSumo Services other than through documented API endpoints and within the applicable API Limits;
7. access the API other than through the interfaces and authentication methods described in the Documentation;
8. circumvent, or attempt to circumvent, any API Limit, including by rotating or multiplying credentials, distributing requests across accounts or IP addresses, or operating multiple client identifiers for a single application;
9. use the API in a manner that damages, disables, overburdens, impairs or otherwise interferes with Our provision of the API or the VenueSumo Services, or that places excessive load on or causes material congestion to the Platform, or that is abnormal or excessive by comparison with the use made by Our other integration partners;
10. conduct any penetration test, vulnerability scan or load test against the API, the Platform or any network on which either is provided, without Our prior written consent;
11. misrepresent or mask Your identity, the identity of the owner of Your Application, or the origin of any API request, or forge or manipulate headers or identifiers;
12. submit to the API any material that is unlawful, misleading, defamatory, obscene, threatening, infringing, invasive of privacy or otherwise objectionable, or any virus, worm, trojan, backdoor, malware or other destructive code;
13. use the API or any Customer Data to send unsolicited commercial electronic messages, or otherwise in breach of the Spam Act 2003 (Cth), the CAN-SPAM Act or equivalent laws;
14. use the API in connection with any Customer account for which the required authorisation under clause 3.2 is not in place, or after that authorisation is withdrawn; or
15. engage any subcontractor or third party provider to use the API in connection with Your Application without Our prior written consent, and if consent is given You remain fully responsible and liable for that party’s acts and omissions.

Breach of any provision of this clause 5 is a material breach of these API Terms. You acknowledge that such a breach may cause Us irreparable harm for which damages alone would be an inadequate remedy, and that We are entitled to seek injunctive relief in addition to any other remedy.

6. API Credentials and security

6.1 You must maintain separate API Credentials for each Customer, each environment and each distinct application, and must not share credentials across Customers.

6.2 You must keep API Credentials confidential, treat them as Our Confidential Information, store them securely, and must not embed them in any client-side application, mobile application, browser code, public repository or open source project.

6.3 You must rotate API Credentials at least every twelve (12) months, and immediately upon the departure of any person with knowledge of them or upon any actual or suspected compromise.

6.4 You are responsible for all activity conducted using Your API Credentials, whether or not authorised by You.

6.5 You must implement and maintain appropriate technical, organisational and administrative safeguards to protect Your Application and all systems that access the API, and all Customer Data and VenueSumo Data in Your possession, against unauthorised or unlawful access, use, destruction, loss, alteration or disclosure. Those safeguards must be no less protective than accepted industry standards and must include, at a minimum, encryption of Customer Data in transit and at rest, role-based access control, logging of access to Customer Data, and documented vulnerability management.

6.6 Where Your Application transmits, processes or stores cardholder data, You must maintain and evidence compliance with the then-current Payment Card Industry Data Security Standard.

7. API Limits and monitoring

7.1 Your use of the API is subject to the API Limits published in the Documentation and to any additional limits notified to You or specified in the relevant API Order Form. We may set, vary and enforce API Limits in Our reasonable discretion, including on a per-endpoint, per-environment, per-Customer or per-Integrator basis.

7.2 You must implement a retry mechanism that respects any rate-limiting response returned by the API, including honouring any Retry-After header, and must implement exponential backoff. You must not retry a rate-limited request more frequently than the API response permits.

7.3 You must use webhooks or event subscriptions in preference to polling wherever We make them available for the relevant data, and must not poll any endpoint more frequently than the Documentation permits.

7.4 If You require capacity in excess of the applicable API Limits, You must obtain Our prior written consent. We may refuse, or condition Our consent on Your acceptance of additional terms, additional charges, or use of a designated bulk export or reporting endpoint.

7.5 We may monitor Your use of the API for security, capacity, billing, quality and compliance purposes, including by accessing and using Your Application to identify issues that could affect Us, Our Customers or the Platform. You must not interfere with that monitoring, and We may use any technical means to overcome interference.

7.6 We may immediately and without notice throttle, restrict, or suspend Your access to the API, in whole or in part, where We reasonably believe You are in breach of these API Terms, or where Your use poses a security, availability, performance, compliance or operational risk. We are not liable to You or to any Customer for any such action.

8. Data ownership and permitted data use

8.1 Customer Data. As between You and a Customer, the Customer owns all right, title and interest in its Customer Data. Neither We nor You grant the other any rights in Customer Data under these API Terms. Each party is solely responsible for obtaining from the relevant Customer the rights it requires to process Customer Data for its own purposes.

8.2 VenueSumo Data. As between You and Us, We own all right, title, interest and Intellectual Property Rights in VenueSumo Data. During the term, We grant You a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence to access and use VenueSumo Data solely as necessary for the Permitted Use. You must not use VenueSumo Data (a) other than for the Permitted Use; (b) in any manner for the benefit of any competitor of Ours or that is otherwise detrimental to Us; or (c) for benchmarking, competitive analysis, or to create aggregated datasets for sale, licensing or distribution.

8.3 Integrator Data. As between You and Us, You retain all right, title and interest in Integrator Data. You grant Us a worldwide, non-exclusive, royalty-free, fully paid-up licence to access and use Integrator Data for the purposes of providing You and the relevant Customer with access to and use of the API. You represent and warrant that You have all rights necessary to submit Integrator Data and to grant that licence.

8.4 Retention. You must not retain Customer Data for longer than is necessary for the Permitted Use, and must delete Customer Data on the earlier of the withdrawal of the relevant Customer’s authorisation, the termination of these API Terms, and the Customer’s written request.

8.5 Aggregated data. We may create anonymised or aggregated data from VenueSumo Data and Integrator Data that does not identify You, any Customer, or any individual, and may use that data for any lawful purpose. As between You and Us, We own all Intellectual Property Rights in that anonymised or aggregated data.

9. Artificial intelligence and model training

9.1 You must not use the API, the Documentation, Customer Data, VenueSumo Data or any data passing through the API, in whole or in part, to train, fine-tune, retrain, evaluate, benchmark or otherwise develop or improve any artificial intelligence or machine learning model, or to generate synthetic data derived from any of them for any such purpose, without Our prior written consent and, in respect of Customer Data, the prior written consent of the relevant Customer.

9.2 This restriction applies to any activity that would cause any model, whether operated by You or by a third party, to learn from, be optimised by, or incorporate the API or any data passing through it.

9.3 Clause 9.1 does not restrict Your use of artificial intelligence tools to operate, develop or support Your Application or to process Customer Data for the Permitted Use, provided that You have obtained the relevant Customer’s consent and that no provider of those tools retains, uses or discloses Customer Data for training purposes.

9.4 Clause 9.1 does not restrict Your use for training purposes of data that You have acquired independently of the API under a separate agreement with a Customer, provided that You have that Customer’s consent and the training occurs outside the API environment.

10. Data protection

10.1 You must comply with all applicable data protection and privacy laws in relation to Customer Data, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the UK GDPR and Data Protection Act 2018, the EU GDPR, and applicable United States state privacy laws.

10.2 You must not, by any act or omission, place Us or any Customer in breach of any applicable data protection law.

10.3 In relation to Customer Data obtained through the API, the Customer is the controller (or equivalent) and You act on the Customer’s instructions. You must not process Customer Data for any purpose other than the Permitted Use and the purposes authorised by the relevant Customer.

10.4 You must not disclose Customer Data to any third party except as expressly permitted by these API Terms and by the relevant Customer, and any permitted onward disclosure must be governed by a written agreement imposing obligations no less protective than these API Terms.

10.5 You must provide Us with reasonable assistance and cooperation in relation to Our compliance with applicable data protection laws, including in responding to individual rights requests and to notices from any regulator or law enforcement authority. If You receive any such request or notice relating to Us or to Customer Data, You must notify Us and must not respond without Our prior consent unless legally compelled.

10.6 You must not use the API to collect personal information relating to children beyond what is strictly necessary for the Permitted Use, and must apply heightened safeguards to any such information. You acknowledge that a substantial proportion of Customer Data in the attractions sector relates to minors.

11. Security Incidents

11.1 You must notify Us of any Security Incident promptly and in any event within twenty-four (24) hours of becoming aware of it, by email to security@venuesumo.com.

11.2 Your notification must include: (a) a description of the nature of the Security Incident; (b) the categories and approximate number of individuals and records affected; (c) the likely consequences; (d) the measures taken or proposed; and (e) the name and contact details of a person from whom further information can be obtained.

11.3 You must, at Your own cost, promptly remedy the Security Incident, cooperate fully with Our investigation, and take all steps reasonably necessary to prevent recurrence.

11.4 You must not make any public statement or notification regarding a Security Incident that identifies or refers to Us or to any Customer without Our prior written approval, except where required by law, in which case You must give Us as much prior notice as is lawful and practicable.

12. Audit

12.1 On reasonable notice, We or Our appointed auditor may audit Your systems, facilities, records and personnel to verify Your compliance with clauses 5 to 11. You must provide full cooperation.

12.2 We may audit no more than once in any calendar year, except where We have a reasonable suspicion of a Security Incident or of a breach of these API Terms, in which case We may audit more frequently.

12.3 Each party bears its own costs of an audit, except that You bear Our reasonable costs where the audit identifies a material breach. You must promptly remediate any non-compliance identified, at Your cost.

13. Insurance

13.1 You must maintain, at Your own expense and with reputable insurers, for the term and for two (2) years afterwards:

1. public and products liability insurance of not less than AUD 20,000,000 per occurrence;
2. professional indemnity insurance of not less than AUD 5,000,000 per claim and in the aggregate; and
3. cyber liability insurance of not less than AUD 5,000,000 per claim and in the aggregate, covering data breach response, regulatory investigation costs and third party liability.

13.2 You must provide certificates of currency on request.

14. Branding, attribution and publicity

14.1 Each party grants the other a limited, non-exclusive, non-transferable, revocable licence during the term to use the other’s trade marks, logos and brand features solely to identify the integration between Your Application and the Platform.

14.2 You must not use Our brand features to promote or market Your Application until We have approved it, and must obtain Our prior written consent before any public use.

14.3 You must not state or imply any partnership with, sponsorship by, or endorsement by Us beyond the fact of the integration.

14.4 All goodwill arising from Your use of Our brand features enures to Our benefit.

15. Disclaimer and limitation of liability

15.1 THE API AND THE DOCUMENTATION ARE PROVIDED ON AN “AS IS”, “WITH ALL FAULTS” AND “AS AVAILABLE” BASIS. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTY OF MERCHANTABILITY, ACCURACY, FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT. WE DO NOT GUARANTEE THE AVAILABILITY, UPTIME, LATENCY OR THROUGHPUT OF THE API AND ARE NOT LIABLE FOR ANY DOWNTIME, INTERRUPTION, THROTTLING OR SUSPENSION.

15.2 TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE OR CONSEQUENTIAL LOSS, INCLUDING LOSS OF PROFITS, REVENUE, GOODWILL, BUSINESS OPPORTUNITY OR DATA, ARISING FROM OR RELATING TO THE API, WHETHER OR NOT FORESEEABLE.

15.3 TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THESE API TERMS WILL NOT EXCEED AUD 1,000.

15.4 Nothing in these API Terms excludes, restricts or modifies any right or remedy, or any guarantee, warranty or other term implied or imposed by law, that cannot lawfully be excluded, restricted or modified, including under the Australian Consumer Law. Where Our liability for a failure to comply with a statutory guarantee cannot be excluded but can be limited, Our liability is limited, at Our option, to resupplying the relevant services or paying the cost of having them resupplied.

16. Indemnity

You indemnify Us, Our affiliates and Our Personnel against all Claims arising directly or indirectly from: (a) Your access to or use of the API or the Documentation; (b) Your Application; (c) any breach of these API Terms by You or by any person using Your API Credentials; (d) any infringement by You of the Intellectual Property Rights of any person; (e) any Security Incident caused by Your act or omission; (f) any breach by You of any applicable law, including any data protection law; and (g) any Claim brought by a Customer arising from Your acts or omissions.

17. Confidentiality

17.1 Each party must keep the other’s Confidential Information confidential, use it only for the purposes of these API Terms, protect it with no less than a reasonable degree of care, and disclose it only to personnel and advisers who need to know and who are bound by equivalent obligations.

17.2 Our Confidential Information includes the API, the Documentation, VenueSumo Data, API Credentials and any non-public information about the Platform. Customer Data is the Confidential Information of the relevant Customer.

17.3 The obligations in this clause 17 do not apply to information that is or becomes public through no fault of the recipient, was lawfully received from a third party without restriction, or was independently developed without reference to the discloser’s Confidential Information.

17.4 On termination or on request, the recipient must return or destroy all Confidential Information and certify that it has done so, except for archival copies required by law.

18. Non-solicitation

18.1 During the term and for twelve (12) months afterwards, You must not directly or indirectly solicit, entice or attempt to persuade any Customer to terminate or reduce its relationship with Us.

18.2 A breach of clause 18.1 requires active solicitation directed at the termination or reduction of a Customer’s relationship with Us. General advertising not targeted at Customers, and a Customer’s own unsolicited decision, do not breach clause 18.1.

18.3 If You breach clause 18.1 and the relevant Customer terminates or materially reduces its subscription, You must pay Us, as a genuine pre-estimate of Our loss and not as a penalty, an amount equal to twice Our revenue from that Customer in the twelve (12) months ending on the date of termination or reduction. The parties agree that actual loss would be difficult to ascertain and that this amount is a reasonable estimate. If any jurisdiction treats this as a penalty, the amount is reduced to the maximum enforceable amount.

18.4 This clause survives termination.

19. Term, suspension and termination

19.1 These API Terms commence on acceptance and continue until terminated.

19.2 You may terminate at any time by ceasing to use the API and giving Us written notice.

19.3 We may suspend or revoke Your access to the API, and terminate these API Terms, at any time, with or without notice, in Our discretion and without liability, including where You are in breach, where Your use poses a risk, where a Customer withdraws its authorisation, or where the relevant Customer’s API Order Form expires or is terminated.

19.4 On termination You must immediately cease all use of the API and the Documentation, and must within thirty (30) days delete or destroy all VenueSumo Data, Documentation and Our Confidential Information in Your possession or control, and certify that deletion in writing on request. Customer Data must be dealt with in accordance with clause 8.4 and Your agreement with the relevant Customer.

19.5 Clauses 5, 8, 9, 10, 11, 15, 16, 17, 18, 19.4 and 22 survive termination.

20. Changes to the API

20.1 We may add to, modify, deprecate, discontinue or replace any part of the API or any version of it at any time.

20.2 We will give not less than twelve (12) months’ notice before withdrawing a version of the API affected by a Breaking Change, and not less than ninety (90) days’ notice of other material changes, except where a change is reasonably necessary to address a security vulnerability, to comply with law, to respond to a change imposed by a third party provider, or to protect the integrity or availability of the Platform, in which case We may act immediately.

20.3 A “Breaking Change” means a change that removes an endpoint or field, changes the type or semantics of an existing field, or otherwise renders a conforming client implementation non-functional.

20.4 Notices under this clause will be given by publication in the Documentation changelog and by email to the technical contact You have nominated. You must keep that contact current.

20.5 We are not obliged to provide support, maintenance or updates for the API. Any developer support is provided on a reasonable endeavours basis and may be subject to a separate paid support package.

21. Changes to these API Terms

21.1 We may amend these API Terms by publishing an amended version and notifying You by email to Your nominated contact. Amendments take effect thirty (30) days after notice, except that changes addressing new API functionality, or which impose no additional obligation on You, take effect immediately.

21.2 Your continued use of the API after the effective date constitutes acceptance. If You do not accept an amendment, You must notify Us in writing before the effective date and cease using the API.

22. General

22.1 Entity, governing law and jurisdiction. The VenueSumo Entity that is party to these API Terms, the governing law and the location of courts are determined by the VenueSumo Territory in which You are located, in accordance with the table in clause 17 of the Terms and Conditions of Use, which applies to these API Terms as if set out here. Where You are located in Australia, New Zealand, Singapore or elsewhere outside the United States, Canada, Europe and the United Kingdom, the governing law is the law of Victoria, Australia and the parties submit to the exclusive jurisdiction of the courts of Victoria.

22.2 Dispute escalation. Before commencing proceedings, each party must escalate the dispute to a senior representative, who must meet within fourteen (14) days of written notice and negotiate in good faith. This does not prevent either party from seeking urgent interlocutory relief.

22.3 Assignment. You may not assign or novate these API Terms, including by change of control, without Our prior written consent. We may assign freely to an affiliate or in connection with a merger, acquisition or sale of assets. You must notify Us within five (5) business days of any change of control affecting You.

22.4 Relationship. Nothing in these API Terms creates any partnership, joint venture, agency or employment relationship. These API Terms are not exclusive and do not restrict Us from competing with You or from contracting with others, including Your competitors.

22.5 Binding arbitration and class action waiver, United States. Where You are resident in the United States, any dispute will be finally resolved by binding individual arbitration administered by JAMS under its then-current rules before a single arbitrator, in the county where You reside, in accordance with the U.S. Federal Arbitration Act. Each party waives any right to a jury trial and to participate in any class or representative proceeding. Nothing in this clause prevents either party from bringing an eligible claim in small claims court or Us from seeking injunctive relief to protect Our proprietary interests.

22.6 Entire agreement. These API Terms, together with the Documentation and any applicable API Order Form, constitute the entire agreement between the parties in relation to the API and supersede all prior communications on that subject.

22.7 Severability. If any provision is invalid or unenforceable it is to be read down to the extent necessary, or severed, without affecting the remaining provisions.

22.8 Notices. Notices to Us must be sent to legal@venuesumo.com. Notices to You will be sent to the contact details You have nominated.

BY CLICKING “I AGREE”, OR BY REQUESTING API CREDENTIALS, OR BY ACCESSING OR USING THE API, YOU ACKNOWLEDGE THAT YOU HAVE READ AND AGREE TO BE BOUND BY THESE API TERMS AND, IF ACTING FOR AN ENTITY, THAT YOU HAVE AUTHORITY TO BIND THAT ENTITY.