Terms of Service

1PurposeLink to “Purpose”

These terms govern access to and use of the Nodium service. Nodium is an API gateway published by By-Tech.io. It connects the Customer's software to WhatsApp, through Meta's official Cloud API, and publishes the Customer's Apps on Muse, Meta's assistant.

Creating an account or using the service constitutes acceptance of these terms by the Customer and by every person the Customer gives access to.

2DefinitionsLink to “Definitions”

Customer: the person who opens a Nodium account in the course of their business, most often a developer or a software publisher.

Account: what the Customer administers and pays for. It groups the workspaces of its customers and its own company.

Workspace (or tenant): the service's unit of isolation. The data of one workspace cannot be reached from any other.

Recipient: the person who exchanges messages with the Customer through a channel. They have no Nodium account.

Channel: a WhatsApp Business number connected to a workspace.

App: a set of tools the Customer publishes on Muse. Nodium hosts it as an MCP server and, for each tool call, calls the Customer's API as described by its OpenAPI document.

API key: the secret attached to the account that lets the Customer's software act on its workspaces, or on the one it is pinned to.

Connect link: the hosted, single-use page through which a customer of the Customer connects its WhatsApp number.

3Account, keys and accessLink to “Account, keys and access”

The console is accessed through a personal account. The Customer is responsible for the access it grants, for revoking it in good time, and for everything done from its account and workspaces.

Everyone in an account has the same rights over that account and its workspaces; the Customer chooses with care whom it invites.

API keys are displayed only once, when created. Nodium keeps only a hash and cannot give them back. The Customer keeps them secret and revokes them as soon as it suspects a leak. A call made with a valid key is deemed to be made by the Customer.

A key pinned to a client creates no other key, and a key created by a key never expires after it.

The Nodium team may access a workspace for operations and support, strictly as needed. Every such access is recorded in an access log.

4What Nodium doesLink to “What Nodium does”

Nodium carries. It receives the messages sent to the Customer's channels, forwards them to the Customer's software through signed webhooks, and sends the messages that software hands to it.

Nodium never decides on content. It writes no message and sends none on its own initiative. No artificial intelligence chooses what to reply.

For Apps, Nodium handles the OAuth authorization of Muse users, calls the Customer's API for each tool call with the user's token, and keeps a log of these calls.

Received media are copied into the service's storage, so they remain readable after they expire at Meta.

5Responsibility for contentLink to “Responsibility for content”

The Customer is the sole author of, and solely responsible for, the messages sent from its channels, its message templates, the responses returned by its Apps' tools, and whatever it does with the messages it receives.

The Customer complies with the WhatsApp Business and Meta terms and policies, in particular the commerce policy and the prior approval of message templates, as well as the rules that apply to Apps published on Muse.

The Customer obtains its recipients' consent before any message it initiates, keeps proof of it, and honours any withdrawal of that consent.

The Customer refrains from unsolicited messaging, unlawful content and any misuse of the service. It only entrusts the service with data it is entitled to process, and informs its recipients of that processing.

Access to the WhatsApp API, the approval of a template and publication on Muse are for Meta alone to decide. By-Tech.io can neither guarantee them, nor commit to a timeline, nor overturn a refusal.

6Publishers and end customersLink to “Publishers and end customers”

The Customer may open workspaces for its own customers, through the API or the hosted connection link. The Customer then remains By-Tech.io's only contracting party.

The Customer answers for its customers' use of the service as for its own. It imposes on them terms at least equivalent to these, in particular on content, recipient consent and compliance with Meta's policies.

7Channel feesLink to “Channel fees”

Meta bills messages and conversations directly to the Customer's WhatsApp Business account, at its own rates, which vary by country.

These fees are neither collected by By-Tech.io nor included in Nodium's prices. Only Meta's statement is authoritative.

8Availability, changes and APILink to “Availability, changes and API”

The service is provided as is. It may be interrupted for maintenance. It depends on third parties, notably Meta and our hosting providers, whose unavailability may affect it without By-Tech.io being liable.

The published API is versioned (/api/v1). Within a version, changes remain backward compatible: new fields, routes or events may appear.

A change that breaks compatibility, or removes a feature the Customer uses, is announced by email with reasonable notice of at least thirty days, unless security requires otherwise or the change is imposed by Meta.

9Pricing and billingLink to “Pricing and billing”

The plans, their content and their prices are those shown on the site's Pricing page on the day of subscription. A plan's limits are counted across the whole account.

The free plan involves no payment, within the usage limits stated for it. Paid plans are charged to the payment method registered with our payment provider, Stripe, at the stated billing period.

A price change is announced at least thirty days in advance and applies only to subsequent periods. The Customer may terminate if it does not accept it.

10Term, termination and suspensionLink to “Term, termination and suspension”

The service is subscribed without a minimum term. It can be terminated at any time, effective at the end of the current period.

After termination, the data are kept for thirty days, to allow an export, then erased.

By-Tech.io may suspend access in the event of use contrary to these terms or a proven risk to the service, after notice, except in a genuine emergency.

11Processing of data on the Customer's behalfLink to “Processing of data on the Customer's behalf”

For the messages exchanged with its recipients and the data of its Apps, the Customer is the controller and By-Tech.io acts as processor, within the meaning of Article 28 of the GDPR. This section constitutes the data processing agreement.

Subject and duration: providing the service, for the whole term of the contract, then until the erasure provided for below.

Nature of the processing: hosting, routing and storage of messages and media; calls made to the Customer's API on behalf of App tools.

Data subjects: the Customer's recipients and the users of its Apps. Data: WhatsApp number, profile name, message content and attachments, timestamps and delivery statuses; for Apps, an identifier generated by Nodium, encrypted tokens and the call log.

Instructions: By-Tech.io processes these data only on the Customer's documented instructions, which consist of its workspace configuration and its API calls. It informs the Customer if an instruction appears to infringe the regulations, and departs from them only where the law requires it.

Confidentiality: the people authorised to access these data are bound by confidentiality. Their access is limited to what is necessary and recorded in the access log.

Security: secrets entrusted to the service are encrypted (AES-256-GCM); API keys and access tokens are kept only as hashes; each workspace is isolated; webhooks are signed; access by the Nodium team is logged.

Sub-processors: the Customer authorises those named in the privacy policy. By-Tech.io informs the Customer in advance of any addition or replacement; the Customer may object by terminating. Each sub-processor is bound by equivalent obligations.

Data subject rights: By-Tech.io helps the Customer respond to its recipients' requests, in particular by erasing a person and all their exchanges at the Customer's request.

Data breach: By-Tech.io notifies the Customer without undue delay, and no later than forty-eight hours after becoming aware of it, with the information available to it.

End of contract: the data are erased within thirty days, unless the law requires them to be kept. The Customer can export them through the API before that date.

Audit: By-Tech.io makes available to the Customer the information needed to demonstrate compliance with these obligations, and submits to an audit on reasonable request, carried out by an auditor bound by confidentiality.

12Intellectual propertyLink to “Intellectual property”

The Customer retains ownership of its data, messages, templates and Apps. By-Tech.io retains ownership of the service, its code and its documentation.

The Customer grants By-Tech.io the right to host and process its data only to the extent necessary to provide the service.

13Limitation of liabilityLink to “Limitation of liability”

By-Tech.io's liability is limited to direct, proven damage, and capped at the amounts paid by the Customer for the service in the twelve months preceding the event giving rise to it.

Indirect damage is excluded: operating loss, loss of revenue, reputational harm, data loss attributable to the Customer or a third party.

These limits do not apply in the event of gross negligence or wilful misconduct, personal injury, or where the law rules them out.

14Changes to these termsLink to “Changes to these terms”

These terms may change. The Customer is informed by email at least thirty days before the new version takes effect, and may terminate if it does not accept it.

15Governing law and jurisdictionLink to “Governing law and jurisdiction”

These terms are governed by French law. Failing an amicable settlement, any dispute falls within the jurisdiction of the courts of Paris.