Skip to main content

Terms and Conditions

Last updated: 23 August 2026

These developer terms (the Developer Terms) govern access to and use of the Remy API, developer documentation, API credentials, sample code, and related developer services (together, the Developer Services). By accessing or using the Developer Services, you confirm that you are authorised to accept these Developer Terms on behalf of the organisation that holds the Remy account (you).

1. Other agreements and order of precedence​

These Developer Terms supplement the commercial agreement, order form, data-processing agreement, and any other written terms agreed between you and Remy (the Agreement). They do not replace them. If these Developer Terms conflict with the Agreement, the Agreement takes precedence. Capitalised terms not defined here have the meaning given in the Agreement.

The documentation describes the technical behaviour of the Developer Services. It is not a service-level commitment or a warranty unless the Agreement expressly says otherwise.

2. Eligibility and account responsibility​

You must:

  • provide accurate account and integration information;
  • ensure that only authorised personnel and systems use the Developer Services;
  • remain responsible for your employees, contractors, applications, and service providers that access the Developer Services; and
  • comply with applicable laws, regulations, payment rules, consumer-protection requirements, and the Agreement.

You may not access the Developer Services if your access has been suspended or terminated, or if you are legally prohibited from receiving the services.

3. API credentials​

API keys are confidential credentials linked to a specific Remy merchant and integration. You must:

  • keep keys in a server-side secret manager or equivalently protected environment;
  • never embed keys in public websites, mobile applications, client-side code, source control, logs, tickets, or shared documents;
  • give each integration its own key where possible;
  • restrict access to personnel and systems that need it;
  • rotate keys promptly when personnel, suppliers, or systems change; and
  • notify Remy immediately if a key may have been exposed or misused.

You are responsible for activity performed using your credentials until Remy has been notified and the affected key has been revoked or replaced. Remy may revoke or rotate credentials where reasonably necessary to protect customers, merchants, or the service.

4. Permitted use​

You may use the Developer Services only to build, operate, test, and support an authorised integration with Remy for your organisation. Your use must follow the current documentation, the Developer Guidelines, applicable rate limits, and the Agreement.

Your integration must accurately represent its identity and purpose. It must not imply endorsement, partnership, or certification by Remy unless Remy has agreed to this in writing.

5. Prohibited use​

You must not, and must not enable anyone else to:

  • access data or resources belonging to another merchant or customer without authority;
  • use another merchant's credentials or share your credentials outside your authorised integration;
  • bypass authentication, authorisation, rate limits, security controls, or usage restrictions;
  • probe, scan, exploit, disrupt, overload, or interfere with the Developer Services;
  • introduce malware, malicious code, automated abuse, or fraudulent transactions;
  • use the Developer Services for unlawful, deceptive, discriminatory, or infringing activity;
  • misrepresent voucher value, status, ownership, expiry, redemption, or eligibility;
  • scrape or bulk-extract data except as reasonably necessary for the authorised integration;
  • reverse engineer the Developer Services except where applicable law expressly permits it and the right cannot be excluded; or
  • sell, sublicense, or provide API access as a standalone service without Remy's written approval.

6. Customer data and privacy​

You must collect, submit, access, store, and otherwise process personal data only where you have a lawful basis and only to the extent necessary for the integration. You are responsible for providing required privacy information and obtaining any required permissions from customers.

You must not send sensitive or unnecessary personal data in free-text fields, identifiers, request metadata, logs, or support messages. Retain API responses and customer data only for as long as required for the authorised purpose, then securely delete or anonymise them.

The parties' respective data-protection roles, international-transfer arrangements, security obligations, and processing instructions are governed by the Agreement and any applicable data-processing agreement.

7. Security obligations​

You must maintain technical and organisational safeguards appropriate to the nature of the data and the risks involved. At a minimum, you must:

  • use supported TLS connections and validate certificates;
  • keep operating systems, dependencies, and HTTP libraries supported and patched;
  • apply least-privilege access and multi-factor authentication to administrative systems;
  • separate production credentials and data from development and test environments;
  • prevent secrets and personal data from appearing in application logs;
  • monitor for unusual access, repeated failures, and unexpected redemption activity; and
  • maintain tested incident-response and credential-rotation procedures.

If you discover suspected unauthorised access, credential exposure, data loss, fraud, or a vulnerability affecting Remy or its users, stop the affected activity where safe to do so, preserve relevant evidence, rotate exposed credentials, and contact Remy promptly. Do not publicly disclose a vulnerability before Remy has had a reasonable opportunity to investigate and remediate it.

8. Orders, rewards, and issued vouchers​

You are responsible for the accuracy, completeness, and authorisation of every request submitted by your integration. In particular:

  • order events must represent genuine, eligible customer activity;
  • voucher and reward identifiers must refer to the issued customer resource, not a merchant template;
  • a redemption request must be initiated by an authorised system following a genuine customer redemption;
  • you must check the returned status and remaining value before confirming redemption to a customer;
  • partial redemption may be used only when the voucher allows it and the amount is valid;
  • retries must not create duplicate orders, rewards, or redemptions; and
  • your records must be reconciled against the API response, not an assumed result.

An HTTP timeout or connection failure does not prove that a write failed. Before retrying a write, determine whether it may already have completed. Contact Remy support before attempting manual corrections that could change customer value.

You remain responsible for customer-facing fulfilment, refund, cancellation, accounting, tax, and consumer-rights obligations connected with your products and services.

9. Usage limits and fair use​

The default limits are published on the Rate Limits page. Endpoint-specific, daily, authentication-failure, and concurrency limits may all apply to one request. You must respect 429 responses and Retry-After headers and use bounded exponential backoff with jitter for retryable failures.

Remy may adjust or temporarily restrict limits where reasonably required for security, stability, legal compliance, or fair access. If your integration needs sustained higher throughput, contact Remy before launch or before materially increasing traffic.

10. Testing and operational responsibility​

Before production use, you must test successful and unsuccessful requests, authentication failures, timeouts, retries, rate limiting, pagination, partial and full voucher redemption, and unexpected response fields. You must monitor your integration, keep an audit trail sufficient to investigate transactions, and maintain a safe way to disable writes or rotate credentials.

Sample code and examples are illustrative. You are responsible for adapting, reviewing, securing, and testing them for your environment.

11. Changes, versioning, and deprecation​

Remy may make backwards-compatible changes within the current API version, including adding endpoints, optional request fields, response fields, and enum values. Your integration must ignore response fields it does not recognise and must not assume that documented enum lists will never expand.

Breaking changes will ordinarily use a new major version or be accompanied by migration guidance. Remy may change or retire a version or feature for operational, security, legal, or product reasons. Where reasonably practicable, Remy will document material changes in the Changelog and provide notice through an appropriate channel.

12. Availability and support​

The Developer Services may occasionally be unavailable because of maintenance, upgrades, faults, third-party dependencies, or events outside Remy's reasonable control. Unless the Agreement states otherwise, the Developer Services are provided without a separate uptime commitment.

You must design your integration to fail safely, use appropriate timeouts, avoid unbounded retries, and queue or reconcile recoverable work where appropriate. Support availability and response commitments, if any, are set by the Agreement.

13. Intellectual property and feedback​

Remy and its licensors retain all rights in the Developer Services, documentation, branding, and related technology. Subject to these Developer Terms and the Agreement, Remy grants you a limited, non-exclusive, non-transferable, revocable right to use the Developer Services for your authorised integration.

You retain rights in your own application and data. If you provide suggestions or feedback, Remy may use them without restriction or payment, provided this does not transfer ownership of your application or confidential information.

You may use Remy names and marks only as permitted in writing or in published brand guidance. You must not remove proprietary notices or register confusingly similar names, domains, or marks.

14. Third-party services​

Your integration may depend on hosting providers, commerce platforms, libraries, or other third-party services. You are responsible for selecting, configuring, securing, and complying with the terms of those services. Remy is not responsible for third-party services it does not control.

15. Monitoring, suspension, and termination​

Remy may monitor API usage to operate, secure, support, and improve the service and to verify compliance with these Developer Terms and the Agreement.

Remy may suspend, restrict, or revoke access where reasonably necessary to address suspected compromise, fraud, unlawful use, material breach, excessive load, risk to customers or merchants, or a legal or regulatory requirement. Where circumstances allow, Remy will try to provide notice and an opportunity to remedy the issue.

When access ends, you must stop using the Developer Services, stop presenting the integration as active, securely delete credentials, and handle retained data as required by the Agreement and applicable law. Provisions that by their nature should survive termination will continue to apply.

16. Confidentiality​

Non-public documentation, credentials, security information, customer information, and other confidential material must be protected and used only for the authorised integration. Confidentiality obligations in the Agreement continue to apply. Nothing here requires disclosure where it would breach law, another person's rights, or a binding duty of confidence.

17. Warranties and liability​

To the fullest extent permitted by applicable law, and except as expressly stated in the Agreement, the Developer Services and documentation are provided on an “as available” basis. Remy does not warrant that they will be uninterrupted, error-free, or suitable for every use case.

Any warranties, exclusions, indemnities, liability caps, and exclusions of loss are governed by the Agreement and applicable law. Nothing in these Developer Terms excludes or limits liability that cannot lawfully be excluded or limited.

18. Changes to these Developer Terms​

Remy may update these Developer Terms to reflect changes to the Developer Services, law, security requirements, or business practices. The current version and its update date will be published on this page. If a change is material, Remy will use reasonable efforts to provide additional notice through an appropriate channel. Continued use after an updated version takes effect constitutes acceptance to the extent permitted by applicable law; if you do not agree, you must stop using the Developer Services and contact Remy.

19. General​

The governing law, courts, notices, assignment, waiver, severability, force majeure, and entire-agreement provisions in the Agreement also apply to these Developer Terms. If no Agreement addresses a relevant issue, contact Remy before relying on an assumption about your legal rights or obligations.

20. Contact​

Contact Remy through your usual support or account-management channel for:

  • suspected credential compromise or security incidents;
  • requests to revoke or rotate an API key;
  • higher rate-limit or throughput requirements;
  • questions about customer data or legal compliance;
  • suspected duplicate or incorrect redemptions; or
  • a copy of the governing Agreement or clarification of these Developer Terms.

These Developer Terms are intended to be a comprehensive operational baseline for API use, but they should be reviewed alongside your signed Agreement and by your legal adviser where appropriate.