API Access and Usage Terms

Preamble

These terms govern the use of our public programming interface (the “API”) by developers of third-party applications (“apps”), and the rights and obligations of users who grant an app access to their account. They give substance to Terms section 4.8 and Creator Terms section 17. For developers they are contractual terms (B2B); for users they explain what granting access means.

Status: the API is not switched on at present; until it is, no apps can be registered and no access can be granted. We will announce the switch-on — first for approved developers, then generally — in the change log at legal.desioart.com/changelog; the documentation at docs.desioart.com will be available from that point.

---

1 Terms used

Term	Meaning
API	our public programming interface; its addresses, specification and change log are in the documentation at docs.desioart.com
Developer	the holder of a desioart account who has passed the identity check (stage 2) and registers an app
App	an application registered with us, with credentials of its own, that reaches the API on a user’s behalf once that user has granted access
Grant	a user’s agreement in the authorisation dialogue, by which an app receives particular permissions (scopes) for their account
Token	the technical keys an app receives after a grant; they are time-limited and become invalid when the grant is revoked (lifetimes: see the documentation)
API version	the dated version of the interface that an app names with every request (see the documentation)

---

2 Registering an app

1. Apps can be registered only from verified accounts; the developer’s identity is known to us (traceability, by analogy with Article 30 DSA). Companies name a responsible natural person.
2. On registering you give: the app’s name and description, its privacy policy (URL), a support contact, the scopes you need with your reasons, redirect URIs and webhook addresses (only domains you control) and — this is required — how your app handles content not suitable for all audiences (storage, display, disclosure, and how you check your own users’ ages).
3. Your app’s credentials are confidential; how you obtain and renew them is described in the documentation. An app may be registered only by the developer themselves — never on behalf of or at the direction of a third party (including a chatbot or a “service” that asks you to); handing your credentials, your webhook addresses or your redirect URIs to anyone else is prohibited (section 9).
4. We may review apps before release, limit access to approved developers during an introductory phase, and refuse apps whose purpose breaches our rules.
5. For apps acting on creators’ behalf (agencies, assistants, automation), Creator Terms section 4.7 applies as well: what the app does counts as what the creator does; the creator remains answerable and must never pass on their credentials — the grant always goes through the authorisation dialogue.

---

3 Users granting access

1. A user connects an app through the standard “Connect with desioart” flow. The authorisation dialogue shows every permission in plain words, the developer, the app’s privacy policy and, for apps with access to content not suitable for all audiences, a note saying so.
2. Particularly sensitive permissions (bank details, verification status, message contents, fan lists and spending, moderation and reporting features) require the user to authenticate again and are confirmed separately; they are available only to apps whose purpose we reviewed before release.
3. A user can see every grant under Settings → Account → Connected apps and revoke it at any time; revocation takes effect immediately; the app loses access at that moment. We show fans on a creator’s profile that connected apps may process fan data (Privacy section 5.6).
4. Users should connect only apps from developers they trust. We check apps for obvious breaches but do not guarantee their security or their compliance with the law; from the moment data is transmitted, the developer answers for it (section 7).

---

4 Scope of access, and versioning

Area	Typical permissions
Account and profile	read and change the profile, privacy settings
Content	create and schedule posts, manage the media library, uploads — every upload goes through the same checks as in the app (hash matching, the consent gate, the limits)
Messages	read conversations, send messages and broadcasts — within the limits and the anti-spam rules (Acceptable Use sections 5.3 and 7.1); AI-produced text must be labelled
Fans and lists	followers, subscribers, lists, fan labels (within Creator Terms section 10.7)
Statistics	earnings, subscriber numbers, top supporters (access is logged)
Tracking links, custom requests, notifications, AI tools (rate-limited separately, section 5)
Sensitive	bank details, verification status — only with a separate grant (section 3.2)

• Scopes are fixed when access is granted; widening them requires a fresh grant.
• Versions run through a lifecycle of active → deprecated → switched off. We announce deprecations in the documentation, in the responses of the interface and by email at least 6 months beforehand; security-related changes can happen at once.
• Webhooks notify your app of the events described in the documentation. Deliveries are signed, retried at growing intervals on failure, and deleted from our logs after 90 days.

---

5 Rate limits

The interface is rate-limited — per user and app, per app in total, and separately for individual endpoints. The limits in force, the response when they are exceeded and the behaviour expected of your app (retrying at growing intervals) are described in the documentation. We may adjust limits by route, app or user, and tighten them where stability is at risk. The platform’s own rate limits apply in addition and regardless of the route taken.

---

6 Permitted and impermissible use

Permitted is anything the granting user could do in the app themselves — within their grant and our rules.

Impermissible:

• access without a valid grant, with someone else’s credentials, or through expired or revoked tokens; getting round authentication, scopes, versioning or rate limits
• scraping, bulk retrieval and stockpiling of content, profiles or fan data beyond the app’s purpose; downloading or redistributing media away from the platform without the rights to do so
• reselling or sub-licensing your API access, or handing the data or the responses to anyone else
• getting round the protection of minors, geoblocking, moderation, pricing or payout rules; automation that breaches the AUP (spam, bulk cold approaches, inflating interactions, card testing)
• processing fan data away from the platform for advertising or profiling (Creator Terms section 10.7 applies to apps accordingly)
• training AI models on content or messages from the platform without express rights; generating content depicting real people without their consent
• running an app for another creator without their own grant (agency access only through a separate grant from each creator)
• using third parties’ data without a legal basis of your own
• acting against our systems (load tests without agreement, security testing outside the disclosure policy, security@desioart.com)

---

7 Data protection and roles

1. The developer as processor: so far as your app processes data on behalf of the granting creator, you act as a processor. Before release you sign our data processing agreement (Article 28 GDPR), which covers instructions, confidentiality, security, sub-processors, third-country transfers, deletion and audit rights.
2. The developer as controller: where you process data for your own purposes (your own services, analytics, your own user accounts) you are a controller in your own right: your own legal basis, your own privacy policy (linked in the authorisation dialogue), data subjects’ rights, notification of breaches to the supervisory authority and to us within 24 hours (security@desioart.com), no disclosure to third parties without a legal basis, data minimisation, storage limitation, and third-country transfers only with safeguards.
3. Non-users: we are not responsible for people without a desioart account whose data your app processes.
4. We log API access (app, user, endpoint, time, hashed IP and user agent) for 90 days, log access to fan spending data additionally for anti-money-laundering checks, and tell users about connected apps (Privacy sections 5.6 and 7.1).
5. Users: your rights towards us are unaffected (Privacy section 9); for data an app has stored, go to the developer — we can neither see, change nor delete it, but we do block the app where it breaches these terms.

---

8 External integrations

If you connect the API to outside services (automation platforms, CRM, messengers, AI services, social media), you alone are responsible for making sure their terms permit the processing of adult content and platform data (many cloud services forbid it expressly), that no data reaches a service with no legal basis for it, and that content does not become accessible away from the platform (Creator Terms section 9.8: outside, only teasers suitable for all audiences). We are not liable for data that leaves the platform through your app.

---

9 Security requirements

• encrypted connections only; credentials kept securely, never in client code or in public repositories; renewed regularly, and immediately where you suspect exposure
• redirect URIs and webhooks only on your own domains; verify the signatures of deliveries; repeated deliveries must not lead to duplicate actions
• request only the scopes you need; store tokens securely; and delete tokens and data without delay once a grant is revoked
• a warning about social engineering: no service needs you to create an app “for it” or to hand over secrets — requests of that kind are fraudulent, and you should report them to security@desioart.com
• report security vulnerabilities in the API under our disclosure policy (desioart.com/security/disclosure-policy); test only within the limits set out there

---

10 Intellectual property and our brand

The API, the specification, the SDKs and the documentation belong to us or to our licensors; you receive a non-exclusive, revocable right to use them within these terms. Your app must not hold itself out as an official desioart app; “desioart” may be used only descriptively (“for desioart”) and in line with our brand guidelines (Terms section 8.5). Creators’ content remains theirs, and your app acquires no rights in it beyond the grant.

---

11 Charges, availability, liability

• The API is currently free; we may introduce charges for high volumes in future (announced 30 days beforehand).
• We owe no particular level of availability; we announce maintenance and changes wherever we can. Towards developers, as businesses, we are liable only as Creator Terms section 13 provides, applied accordingly; liability for lost profit and indirect loss is excluded save for intention, gross negligence and the breach of essential contractual duties.
• You indemnify us against third-party claims arising from your breach of these terms, of data protection law or of an outside service’s terms, so far as the breach is your responsibility.

---

12 Suspension, blocking and termination

We may suspend or end an app’s access for breaches of these terms or of the AUP, for security risks, for abuse, on users’ complaints, or for operational reasons — with reasons and a right to appeal (Appeals), and at once where there is immediate danger. Where credentials are passed on, where social engineering occurs, or where someone else’s account is accessed, we block immediately and permanently. After termination you delete every item of personal data received through the API, unless a legal basis of your own requires you to keep it, and confirm that on request. You can delete your app at any time (Developer → Apps → Delete), and existing grants then lapse.

---

13 Changes

We announce changes to these terms at least 15 days beforehand (for developers who are creators, Article 3 of Regulation (EU) 2019/1150); API deprecations follow section 4; security-related changes take effect at once. The current version is at legal.desioart.com/api, and the API’s own change log at docs.desioart.com/changelog.

---

14 Contact

Developer support: support@desioart.com (subject “API”) · security: security@desioart.com · data protection: privacy@desioart.com · appeals: appeals@desioart.com