Acceptable Use Policy

Version 2.0 · Effective: 14 November 2026

Who this applies to: everyone who uses a CitiXsys product or service (iVendNext, iVend Retail, iVend Cloud, our developer tools and our websites): our customers and their users, our partners, and builders. It is part of the agreement you have with us, such as the iVendNext Cloud Terms of Service, the CitiXsys Cloud Terms of Service, the CitiXsys Software License Agreement or the iVendNext Developer Terms.
Replaces: the Acceptable Use Policy effective 1 February 2020, which stays readable at its own address. That version covered our websites and cloud services; this one also covers iVend Retail installed on your own servers, as Section 1.5 says.

Previous version: the version effective 1 February 2020, replaced on 14 November 2026.

This policy says what you may not do with our products and services (the Services). It is short on purpose: what it does not forbid, and your agreement with us allows, is open to you. In this policy, you includes everyone who uses the Services through your account, and content means anything you or they put into, send through or build on the Services.

1. Using the Services as they are meant to be used

1.1 Connecting your systems is welcome. You may connect the Services to your own systems and to apps, through our published API, extension points, connectors and apps, including automated calls from your servers, your partner’s apps and the tools you choose. For a service we host, use the interfaces we document (for iVendNext, the API described in the Partner Kit and in iVendNext’s own documentation), not screen-scraping or interfaces we have not documented.

1.2 Keep the load reasonable. Use the API in proportion to what your business needs. We publish no fixed request limit today. If calls from one key or app put a site, or other customers, at risk, we may pause that key or app. We tell the key’s owner why and, where we can, the administrator of the site it serves. We tell you before we introduce fixed limits.

1.3 Testing. You may test what you build on a sandbox site we gave you, or on your own test site, in proportion to building it. A site you own or administer, such as your own iVendNext site, is yours to test in proportion; tell us before a load test, so we do not take it for an attack. You do not scan, probe, load-test or attack anything else in the Services, or any site that is not yours to test, except with our written permission. If you find a security weakness, report it to us privately (for iVendNext, as the Partner Kit’s SECURITY.md says) and do not publish it before we have had a reasonable time to fix it.

1.4 AI services you connect. You may connect an AI service or assistant of your choice to the Services, with your own key or sign-in. What it reads and what it does with your keys is yours, as if you had done it, and your own agreement with its provider governs what it does with your data.

1.5 Your own installation. If you license iVend Retail to run on your own servers, how you use your own installation and its database is governed by your licence agreement; this policy applies to the services we host for you.

2. What is not allowed

You will not use the Services to, or try to:

(a) get into any site, account, system or data you have not been given access to, or get around a sign-in, a permission or a licence count;
(b) disrupt the Services, other customers or the networks they run on, or put malicious code into them;
(c) copy, change or reverse engineer the Services, except as your agreement with us or the law allows;
(d) break the law, including data-protection, consumer, export-control and sanctions laws;
(e) collect, use or share anyone’s personal data without a lawful basis, or in a way your own privacy notice does not allow;
(f) send spam or unsolicited messages;
(g) pretend to be someone else, hide where something comes from, or suggest that CitiXsys sponsors or endorses you when it does not;
(h) store or share content that infringes anyone’s rights, that you have no right to share, or that is fraudulent, defamatory, threatening, harassing, hateful or sexually exploits children (which we report to the authorities); or
(i) help anyone else do any of these things.

3. If something breaks this policy

3.1 What we may do. We may remove the content concerned, or suspend the access, key, app or account concerned, as far as needed to stop the breach.

3.2 Telling you first. We tell you first and give you a chance to put it right, unless acting at once is needed because the operation of the Services or other customers is at risk, or the law requires it. Then we tell you as soon as we can. Your agreement with us says what happens beyond that.

3.3 Reporting a breach. To report a breach of this policy, write to us at the contact details on ivend.com/contact-us.

4. Changes

We may update this policy. A new version is published here with its effective date, and the previous versions stay readable. A change that would limit how you use the Services reaches you as your agreement with us says for changes to the documents it includes.