Plain terms for using the NUMU API. They sit alongside NUMU's general terms of service; where the two differ on an API matter, this page governs.The access you are given#
A token acts for one store, and only within its scopes. Using it outside that is a breach, whether or not a check happens to stop you.
Access is tied to the merchant's plan, or to a grant from NUMU. It ends when either ends.
Tokens are secrets. Never embed one in a mobile app, a browser bundle, or anything a shopper can read. If one leaks, delete it and mint another.
Never use a merchant's token for a store or a purpose the merchant did not agree to.
Fair use#
300 requests a minute per token. Do not work around that with extra tokens, extra IP addresses or parallel crawls. If you need more, ask — we would rather raise your limit than discover the workaround. Prefer webhooks to polling. Polling a list endpoint on a short timer to detect change is the single most common reason integrations hit the limit.
Honour Retry-After on 429, and back off on 5xx.
Do not use the API to bulk-export another party's data, to probe for vulnerabilities without written permission, or to mirror a merchant's catalogue for a third party without that merchant's consent.
Merchant data#
The data you read belongs to the merchant. You process it on their instructions, not on ours and not on your own account.
Store only what your integration needs, for as long as it needs it. Customer records contain personal data — names, phone numbers, addresses — and fall under Egypt's Personal Data Protection Law.
Delete a merchant's data when they stop using your integration, and be able to show that you did.
Do not sell merchant or shopper data, and do not use it to build a product that competes with the merchant.
What we owe you#
Notice before breaking changes, per the versioning policy: announced in the changelog, a Deprecation header on the affected endpoints, and at least 90 days — 180 for anything touching orders or payments. A contract that matches reality: the OpenAPI document is generated from the running API rather than maintained by hand. Suspension#
We may suspend a token or a store's API access without notice when a live problem demands it: a leaked credential, traffic that threatens the platform, or use that puts merchant data at risk. We tell the merchant what happened and why, and restore access once the cause is fixed.Changes to these terms#
Material changes are announced in the changelog at least 30 days before they take effect. Modified at 2026-09-24 13:03:12
