API & Webhooks Terms & Conditions

The agreement you're making in order to use the Fitssey API and Webhooks.

1. Introduction

Please read the document carefully. These API and Webhooks Terms and Conditions regulate the conditions and rules for accessing and using the Fitssey API and Webhooks, as well as the rights and responsibilities of the Service Provider, the Studio and the Developer in relation to the API, the Webhooks and the data made available through them.

The Fitssey API allows Studios, and Developers acting on their behalf, to connect external software with the Application, among other things, to read the schedule and manage bookings and clients. Webhooks allow the Application to automatically notify external software about selected events taking place in the Studio, e.g. a new booking or a new order.

These API and Webhooks Terms and Conditions supplement the Terms and Conditions, which remain fully applicable to every Studio. In the event of discrepancies regarding the use of the API or Webhooks, these API and Webhooks Terms and Conditions shall prevail.

2. Definitions

The following definitions should help you better understand these Terms. Capitalized terms not defined below have the meaning given to them in the Terms and Conditions.

  1. Service Provider – lightenbody™ company located at al. Zwycięstwa 241/13, 81-521 Gdynia, Poland, email: [email protected], operating under EU VAT number PL7532294721, offering online Services, the Application, the API and Webhooks,

  2. API – the Fitssey application programming interface, including all endpoints, sample code and any other tools made available by the Service Provider that allow software to send requests to the Application,

  3. Webhook – automated notification sent by the Application to a Callback URL when events selected by the Studio take place,

  4. Callback URL – the address of an external system, configured by the Studio in the Application, to which Webhooks are delivered,

  5. Documentation – the technical documentation of the API and Webhooks published by the Service Provider at https://app.fitssey.com/docs/api for the API and https://app.fitssey.com/docs/webhooks for Webhooks, including the description of endpoints, events, authentication, error codes and Rate Limits,

  6. Studio – a Client of the Service Provider, within the meaning of the Terms and Conditions, who generates API Keys, configures Webhooks for its Studio account or authorizes a Developer to access its Studio Data,

  7. Developer – any natural person, legal person or organizational unit that accesses or uses the API or receives Webhooks, including the Studio itself and any third party acting on behalf of or for the benefit of the Studio,

  8. Integration – any software, website, application, script or service created or operated by the Developer that connects with the API or receives Webhooks,

  9. API Key – a unique credential generated within the Studio account in the Application that identifies the Studio and authenticates requests sent to the API,

  10. Webhook Secret – a confidential value configured for a Webhook, used to sign Webhooks or attached to them, so that the Integration can verify they were sent by the Application,

  11. Studio Data – any data relating to the Studio, its business, clients or members of staff, made available through the API or Webhooks, including personal data, class schedules, bookings, pricing options, orders and payments, regardless of whether it is public or non-public,

  12. Competing Product – any software, platform or service that offers, in whole or in part, functionality similar to the Application, in particular online booking, scheduling, client management, membership management or payment processing for studios, clubs, schools or other fitness and wellness businesses. An Integration built solely for the needs of a given Studio, operating on its behalf and as part of its own offering, is not considered a Competing Product,

  13. Competing Entity – any person or entity that develops, offers, operates or distributes a Competing Product, including its affiliates, subcontractors and agents,

  14. Rate Limits – the limits on the number and frequency of requests that can be sent to the API, as described in the Documentation or set individually by the Service Provider.

3. Acceptance of the Terms

  1. By generating an API Key, sending requests to the API, configuring Webhooks or receiving data through them, the Studio agrees to be bound by these API and Webhooks Terms and Conditions and undertakes to ensure that every Developer authorized by it, including the Studio's members of staff and third party software vendors, complies with these Terms.

  2. The Developer may use the API and Webhooks only with the authorization of the Studio and in accordance with these Terms. Failure to accept these Terms precludes the use of the API and Webhooks.

4. Access and credentials

  1. Access to the API and Webhooks is provided exclusively to Studios with an active account in the Application and to Developers authorized by them.

  2. API Keys and Webhooks are created, managed, suspended and removed by the Studio in the Integrations section of the Application.

  3. API Keys and Webhook Secrets are confidential. The Studio and the Developer are responsible for keeping them safe and for not sharing them with any unauthorized third parties, in particular they must not be published in public repositories or embedded in client-side code available to end users.

  4. The Studio determines the scope of permissions of each API Key, including access to specific categories of data and the ability to read or write them, where the given API functionality allows it. The Studio is obliged to grant the Developer only the permissions necessary for the Integration to function properly and to regularly review whether they are still justified.

  5. The Studio is responsible for activity performed with its API Keys and for Webhooks configured in its Studio account by the Studio or by Developers authorized by it. The Studio is also responsible for the activity of unauthorized persons if they gained access to the Studio account or the credentials as a result of a breach by the Studio or an authorized Developer of the obligations arising from these Terms.

  6. In case of a suspected compromise of an API Key or Webhook Secret, the Studio is obliged to immediately revoke it or generate a new one in the Application and to inform the Service Provider at [email protected].

  7. The Developer must not obtain or attempt to obtain access to the API or Webhooks by any means other than the credentials issued in accordance with these Terms.

5. Studio authorization

  1. The Studio is the controller of Studio Data. The Developer may access and use Studio Data only to the extent specified by the Studio and for the purposes authorized by the Studio. The Developer must not use Studio Data for any other purposes without an appropriate legal basis and the consent of the Service Provider, where such consent is required under these Terms.

  2. Authorization granted by the Studio is limited to the data of that Studio only. Authorization granted by one Studio does not entitle the Developer to access or use the data of any other Studio.

  3. The Developer is obliged to stop accessing the API, stop processing Webhooks and stop using Studio Data immediately after the Studio revokes the API Key, removes the Webhook, withdraws its authorization or terminates its Agreement with the Service Provider.

  4. The Service Provider has the right to request from the Developer, at any time, proof of the authorization granted by the Studio.

6. Permitted use

  1. Subject to these Terms, the Service Provider grants the Developer a limited, non-exclusive, non-transferable and revocable right to use the API and Webhooks for the purpose of building and operating Integrations that support the Studio's own business, in particular:

    • displaying the Studio's schedule and offer on the Studio's website or mobile application,

    • managing bookings, clients and orders of the Studio,

    • synchronizing Studio Data with the Studio's accounting, marketing, access control or other internal systems,

    • reacting to events in the Studio, e.g. granting access to a facility after a booking or sending a message after an order,

    • preparing reports and analyses for the Studio's internal use.

  2. The Developer is obliged to use the API and Webhooks in line with these Terms, the Documentation, the Terms and Conditions and all applicable laws and regulations.

7. Prohibited use

The Developer is not allowed, either directly or through any third party, to:

  1. use the API, Webhooks, Studio Data or the Documentation to build, develop, improve, train, promote or operate a Competing Product, including making the offering of Studios available through it, enabling class bookings or selling memberships and other services, or migrating Studios to a Competing Product on a commercial basis, without the prior written consent of the Service Provider,

  2. aggregate Studio Data obtained through the API or Webhooks with data obtained from Competing Products for commercial purposes, except as expressly permitted in section 8 of these Terms,

  3. share, disclose, sell, license, rent or otherwise make Studio Data available to any Competing Entity, regardless of whether the data is in raw, processed, aggregated or anonymised form, including by configuring a Callback URL that delivers Webhooks to a Competing Entity or forwarding Webhooks to it,

  4. place excessive load on the API, in particular by sending requests in excess of the Rate Limits, continuing to send requests after receiving a rate limit response, polling the API with unnecessary frequency instead of using Webhooks where they are available, sending requests to the API for every Webhook received when the data is already included in the Webhook, circumventing the Rate Limits by using multiple Studio accounts, or performing load or stress tests without the prior written consent of the Service Provider,

  5. access, use, store or process Studio Data beyond the scope of the authorization granted by the Studio, in particular for purposes other than those authorized by the Studio, after the authorization has been withdrawn, or in relation to any Studio that has not granted the authorization,

  6. configure a Callback URL pointing to a system that neither the Studio nor the Developer is authorized to use, or use Webhooks to send requests to third party systems,

  7. sell, resell, sublicense or otherwise commercialize access to the API or Webhooks themselves,

  8. reverse engineer, decompile, scrape or attempt to extract the source code, structure or data of the Application other than through the API and Webhooks as described in the Documentation,

  9. test, probe or scan the API or Webhooks for vulnerabilities, or attempt to bypass any security or authentication measures, without the prior written consent of the Service Provider,

  10. create fictitious client accounts, enter false or misleading data, or perform operations that result in unauthorized modification or deletion of data in the Application,

  11. bulk download, copy or store Studio Data to an extent that is excessive or not justified by the functionality of the Integration, in particular create copies of entire databases of clients, bookings or orders where retrieving selected data or synchronizing it on an ongoing basis is sufficient to achieve the purpose of the Integration,

  12. use Studio Data to send unsolicited messages or for any other purpose that violates the Anti-spam Policy,

  13. use the API or Webhooks in a way that misrepresents the relationship between the Developer and the Service Provider, or suggests that an Integration is created, endorsed or certified by the Service Provider,

  14. use the API or Webhooks for any unlawful, harmful or discriminatory activities, or to transmit any malicious code.

8. Data aggregation

  1. Studio Data may be combined with data obtained from other platforms, including Competing Products, only if all of the following conditions are met:

    • the aggregation is performed on behalf of and at the explicit request of a single Studio,

    • the aggregated data concerns only that Studio and is used solely for its internal business purposes, e.g. consolidated reporting or accounting of a Studio that uses more than one system,

    • the aggregated data is made available only to that Studio and is not disclosed to any other Studio, Developer, Competing Entity or other third party.

  2. Any other aggregation of Studio Data with data obtained from Competing Products for commercial purposes is prohibited, in particular:

    • combining the data of multiple Studios in order to create benchmarks, market analyses, rankings, price comparisons or statistics offered to third parties,

    • creating marketplaces, booking aggregators or directories that present the offer of Studios together with the offer of businesses using Competing Products,

    • building databases, data sets or data products intended for sale, licensing or other commercial distribution,

    • using aggregated data to train or improve machine learning models used in a Competing Product.

  3. The Developer may apply for a written consent of the Service Provider to aggregate data in a way not described in section 8.1 by sending a detailed description of the intended use to [email protected]. The Service Provider may refuse to grant the consent without giving a reason, or make it conditional on a separate agreement.

9. Rate limits and fair use

  1. The API is subject to Rate Limits described in the Documentation. Unless the Service Provider decides otherwise, the Rate Limits apply per Studio and are shared by all API Keys of that Studio. Generating additional API Keys does not increase the Rate Limits.

  2. The Service Provider has the right to set individual Rate Limits for a specific Studio or API Key, in particular when the activity of an Integration negatively affects the performance or security of the API or the Application.

  3. When a Rate Limit is exceeded, the API rejects further requests until the lockout expires. The Developer is obliged to stop sending requests for the time indicated in the API response.

  4. An API Key that keeps sending requests while being rate limited may be automatically suspended. The Studio is informed about the suspension via email and may resume the API Key in the Application after correcting the behaviour of the Integration.

  5. The Developer is obliged to design the Integration in a way that minimizes the number of requests, in particular by caching data that does not change frequently, using Webhooks instead of repeated polling and applying a back-off strategy when retrying failed requests.

  6. The Service Provider reserves the right to change the Rate Limits and will notify the Studio of such changes reasonably in advance through the Documentation or by email. Where necessary to ensure the security, stability or proper functioning of the API and the Application, the Service Provider may change the Rate Limits with immediate effect, without prior notice.

10. Webhooks

  1. The Studio decides which events are delivered through Webhooks and to which Callback URL. The Studio is responsible for the correctness of the Callback URL and for ensuring that the system behind it is controlled by the Studio or by a Developer authorized by the Studio.

  2. The Callback URL should use an encrypted connection (HTTPS). The Service Provider recommends configuring a Webhook Secret for every Webhook. When a Webhook Secret is configured, the Developer is obliged to verify every Webhook with it, as described in the Documentation, and to reject Webhooks that fail the verification.

  3. The Integration should confirm the receipt of a Webhook promptly with a successful response and perform any time-consuming processing afterwards.

  4. The Service Provider doesn’t guarantee that Webhooks will be delivered exactly once, in the order in which the events took place, or within a specific time. The Developer is obliged to design the Integration in a way that handles repeated, delayed or missing Webhooks, and may use the API to verify the current state of the data.

  5. A Webhook whose deliveries keep failing may be automatically suspended. The Studio is informed about the suspension via email and may resume the Webhook in the Application after correcting the Callback URL or the Integration.

  6. The Service Provider is not responsible for the way the Studio or the Developer processes and uses data after it has been delivered through Webhooks, nor for the consequences of an incorrect configuration of the Callback URL by the Studio or an authorized Developer, including the delivery of data to an incorrect Callback URL provided by the Studio or the Developer.

11. Fees for using the API and Webhooks

  1. The API and Webhooks are used on the terms set by the Service Provider, taking into account any fees specified in the applicable price list or in a separate agreement.

  2. The Service Provider may offer additional options for using the API and Webhooks, including increased Rate Limits or an extended scope of functionality, on individually agreed terms.

  3. The introduction of fees or a change to the pricing rules takes place in accordance with the rules for changing the terms of service, with appropriate notice to the Studio, unless the parties agree otherwise.

12. Data protection and security

  1. The Studio is the controller of personal data processed in the course of its business and made available through the API or Webhooks. The Studio and the Developer are obliged to correctly determine their respective roles in the processing of personal data and to ensure an appropriate legal basis for such processing. If the Developer processes personal data on behalf of the Studio as a processor, it is obliged to conclude with the Studio a data processing agreement compliant with Article 28 of Regulation (EU) 2016/679 (GDPR).

  2. The Developer is obliged to process Studio Data in accordance with all applicable data protection laws and to implement appropriate technical and organizational measures to protect Studio Data against unauthorized access, loss, destruction or disclosure, including encryption of data in transit.

  3. The Developer must not store Studio Data longer than necessary for the purposes authorized by the Studio. After the authorization is withdrawn, the Developer is obliged to delete or return to the Studio all Studio Data, unless further storage is required by law. Upon request of the Studio or the Service Provider, the Developer is obliged to confirm that this obligation has been fulfilled.

  4. In case of a security incident affecting Studio Data, the Developer is obliged to inform the Studio and the Service Provider at [email protected] without undue delay.

  5. Information on the rules for personal data protection and processing by the Service Provider can be found in the Privacy Policy and the Data Processing Addendum. The Service Provider is not responsible for the processing of Studio Data by the Developer once the data has been transferred to the Integration, either through the API or Webhooks.

13. Intellectual property

  1. The API, Webhooks, the Documentation, the Application and all related materials, names and logotypes belong to the Service Provider. These Terms do not transfer to the Developer any rights other than the limited right to use the API and Webhooks described in section 6.

  2. The Developer may use the name Fitssey only to truthfully indicate that the Integration is compatible with the Application. Any other use of the name or logotypes of the Service Provider requires a prior written permission of the Service Provider.

  3. The Developer retains all rights to the Integration, excluding the API, Webhooks, the Documentation and any Studio Data.

  4. Any feedback or suggestions regarding the API or Webhooks provided by the Developer may be used by the Service Provider without any obligations towards the Developer.

14. Changes to the API and Webhooks

  1. The Service Provider reserves the right to introduce changes to the API and Webhooks, including adding, modifying or removing endpoints, events, fields and functionalities, as well as releasing new versions of the API.

  2. The Service Provider will make reasonable efforts to inform Developers about changes that are not backward compatible in advance, through the Documentation or via email sent to the Studio.

  3. The Service Provider may introduce changes without prior notice if they are necessary to ensure the security of the API, Webhooks or the Application, or result from new law rules.

  4. The Developer is responsible for keeping the Integration up to date with the current version of the API, Webhooks and the Documentation. Integrations should ignore unknown fields and events instead of failing.

15. Suspension and termination

  1. The Service Provider reserves the right to limit, suspend or block access to the API or Webhooks for a specific Integration, API Key, Webhook or Studio, with immediate effect, under the following circumstances:

    • infringement of any rules described in these Terms, in particular in sections 7 and 8,

    • activity that negatively affects the performance, stability or security of the API, Webhooks or the Application, or harms other Studios,

    • reasonable suspicion that an API Key or Webhook Secret has been compromised or is used by unauthorized persons,

    • blocking or termination of the Studio account in accordance with the Terms and Conditions,

    • a request from a competent public authority.

  2. The Service Provider has the right to monitor and analyze the use of the API and Webhooks, in particular the number and frequency of requests, the endpoints used, the errors that occur and the operation of authentication mechanisms, in order to ensure the security, stability and proper functioning of the Application, as well as to verify compliance with these Terms. Monitoring is carried out in accordance with applicable law, including data protection laws.

  3. The Service Provider has the right to request from the Developer information about the Integration and the way Studio Data is used, in order to verify compliance with these Terms.

  4. The Service Provider may discontinue the API or Webhooks, in whole or in part, with a 30-day notice period.

  5. The Studio may stop using the API and Webhooks at any time by revoking its API Keys and removing its Webhooks in the Application.

  6. Upon discontinuation of the API or Webhooks, the Developer's right to use the relevant functionality expires, and related Integrations lose the ability to communicate with the Application. Termination of access does not release the Studio or the Developer from the obligations regarding the protection, storage and deletion of Studio Data set out in these Terms and in applicable law.

  7. In case of a violation of sections 7 or 8 of these Terms, the Service Provider has the right to request the Developer to immediately delete all Studio Data obtained in breach of these Terms and to claim compensation for any damages resulting from the violation.

  8. Sections 7, 8, 12, 13 and 16 remain in force after termination of access to the API and Webhooks.

16. Liability and exemptions

  1. The API and Webhooks are provided "as is" and "as available". The Service Provider doesn’t guarantee that the API and Webhooks will be free of errors or that access to them will be continuous or uninterrupted.

  2. The Service Provider disclaims any and all liability for any API or Webhooks interruptions in the event of:

    • circumstances beyond the Service Provider’s control (e.g. caused by force majeure, third party, the Studio or the Developer),

    • need to undertake any repairs, updates or modifications of the API, Webhooks or the Application,

    • application of Rate Limits or suspension of an API Key or Webhook in accordance with these Terms.

  3. The Service Provider doesn’t take responsibility for any Integration, its functioning, or any actions undertaken by the Developer, including the way the Developer processes Studio Data.

  4. The Service Provider doesn’t take responsibility for any data created, modified or deleted in the Application through the API by the Studio or any Developer acting on its behalf, nor for any actions taken by an Integration in response to Webhooks.

  5. The Studio and the Developer agree to cover reasonable damages, costs and expenses incurred by the Service Provider in connection with claims of third parties, including the Studio's clients and members of staff, arising from a breach of these Terms or applicable law by the Studio or the Developer, to the extent that they are responsible for the breach.

  6. The exclusions of the Service Provider’s liability set out in this section apply both to actual damage (damnum emergens) and to loss of profits (lucrum cessans), to the extent permitted by applicable law.

17. Final provisions

  1. The Service Provider reserves the right to amend these API and Webhooks Terms and Conditions. The Service Provider will inform the Studio about the changes by email or through the virtual inbox in the Application. If the Studio does not accept the changes, it may stop using the API and Webhooks before the changes come into force by revoking its API Keys and removing the configured Webhooks. Continuing to use the API or Webhooks after the changes come into force means accepting the amended Terms. Changes resulting from applicable law or from the need to ensure the security of the API, Webhooks or the Application may be introduced without prior notice where circumstances so require.

  2. In situations not regulated by these Terms, the Terms and Conditions and the law of the Republic of Poland apply.

  3. Any disputes between the parties that may arise from the interpretation of these API and Webhooks Terms and Conditions shall be resolved by the common court of law having its jurisdiction over the seat of the Service Provider.

  4. If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions remain in full force and effect.

  5. The original Polish version of these API and Webhooks Terms and Conditions has been translated to other languages. In the event of discrepancies between the Polish version and any other language versions, the Polish language version shall apply, prevail and be conclusive.

18. Questions & Concerns

If you have any questions or concerns about these API and Webhooks Terms and Conditions, please send us a detailed message to [email protected] or via postal mail at:

lightenbody™
al. Zwycięstwa 241/13
81-521 Gdynia
Poland

Updated November 8, 2026