Version 1.0 of 3 November 2026, effective on publication. Any material change is announced at least 30 days in advance. This is a translation: the Italian text prevails.

Business and API Terms

These apply to businesses and developers using ERERE's APIs (verification, aggregated data, Agent Gateway). The technical reference is the ERERE for developers page.

Access

• API keys belong to the business, are confidential and revocable. The business is responsible for the use of its keys.
• Permitted use: only for the purposes declared when requesting the key and in compliance with the law.

What is not allowed

• Attempting to identify the people behind aggregated data or fingerprints, combining data with other sources for that purpose, or reselling it.
• Using the APIs for decisions with legal effects on people based solely on the automated result, for surveillance or for discrimination.
• Exceeding rate limits or circumventing controls.

Data and roles

• Aggregated data is anonymous and stays above the anonymity thresholds: it is not personal data. 50% to 70% of its value, depending on the plan, goes back to the people who share it.
• For identity verification, ERERE and the business are independent controllers, each for its own purposes.
• If the business entrusts ERERE with personal data to process on its behalf, the agreement below applies (Article 28 GDPR).

Data processing agreement (Article 28 GDPR)

• Subject and duration: the processing described in the order, for the duration of the contract.
• Instructions: ERERE processes data only on the business's documented instructions.
• Confidentiality: authorised persons are bound by confidentiality.
• Security (Article 32): encryption in transit and at rest, least-privilege access with second factor, activity logs, encrypted backups, continuity plan.
• Sub-processors: list available on request; each new sub-processor is announced 30 days in advance, with a right to object.
• Assistance: help in answering data subject requests and with impact assessments.
• Data breaches: notified to the business without undue delay and in any case within 48 hours of discovery.
• End of contract: return or deletion of the data within 30 days, unless the law requires otherwise.
• Audits: compliance documentation on request; one inspection per year with 30 days' notice.
• Transfers outside the EU: only with an adequacy decision or the European Commission's standard contractual clauses.

Service levels

• Monthly API availability: 99.5% target, measured on /api/health, excluding maintenance announced 72 hours in advance.
• Service credits: below 99.5%, 10% of the month's fee; below 99%, 25%; below 95%, 50%. Request within 30 days.
• Support: response within 1 working day; for a full outage, within 4 hours.
• Service status: public at /stato.

Prices and payment

• Public price list (Agent Gateway) or the signed order; VAT excluded for businesses. Monthly invoicing, payment within 30 days.
• Prices change only with 30 days' notice; the business may terminate before they apply.

API versions

An incompatible change comes with 90 days' notice; the previous version stays available during that period.

Liability

Except for wilful misconduct or gross negligence and the mandatory limits of law, each party's liability is limited to the amounts paid by the business in the previous 12 months. Neither party is liable for indirect damages or lost profits.

Term and termination

Open-ended contract; either party may terminate with 30 days' notice. ERERE may immediately suspend a key in case of serious breaches or risks to people.

Law and venue

Italian law; courts of Rome, unless otherwise agreed in writing.

Contact

fishmania@pec.it · Terms of Service · Privacy Policy