Website Booking API Terms

These terms apply to businesses that use the Website Booking API, and to anyone who builds or runs a website on it for them. They form part of our Terms & Conditions, which apply to everything these terms do not cover, including the limits on liability and how disputes are resolved.

The API lets your website search your free rooms, beds and halls, and send booking requests. A request holds the places for a short time while your desk accepts or declines it. A request is not a booking, and no payment passes through the API.

Prices shown through the API come from your own rates in Quackzo and are confirmed by you with the guest.

You, or the developer you hire, build and run the website and the server that calls the API. We do not see or control them. You are responsible for: • keeping the API key secret: on your server only, never in a web page, an app, logs or a code repository; • the security of your website, server and hosting accounts; • stopping bots and abuse on your booking page, for example with a captcha; • telling guests on your booking page who you are, what details you collect, why, and that they are passed to Quackzo to handle the request, and having any consent and lawful basis the DPDP Act requires; • how your website and server handle, log or store guest details before they reach us; • what your website shows guests, including prices, your cancellation and advance-payment terms, and a way to book by phone when online booking is unavailable.

A developer you hire acts for you. What they do with the API key is your responsibility.

We issue the API key. Every call made with your key is your responsibility. If a key may have leaked, tell us at once; we will replace it and the old key stops working straight away.

Each key has monthly and hourly limits. Calls over a limit are refused until it resets, so your website must offer guests another way to book.

We may suspend or replace a key at once if it is misused, leaked or puts the service at risk.

For each request we receive the guest's name, phone number, number of people, the dates, the places asked for and any note, and the website visitor's IP address. We use them only to pass the request to your desk and to stop abuse, as your Data Processor under section 9 of our Terms & Conditions.

We keep a request for 1 year after you accept or decline it, or after it expires unanswered; an accepted request's guest is kept with the booking it made. The visitor's IP address and the guest's phone number are kept for 15 minutes to limit repeated requests, and are not stored with the request.

Only if you ask us to check the captcha on your booking page, we send Cloudflare the captcha token and the visitor's IP address.

We will not make a change that breaks a working website without at least 30 days' notice, unless security or the law requires it sooner.

Any fee for the API is set out in your quotation or plan.

You may stop using the API at any time; ask us and we will switch your key off. We may change or withdraw the API on 30 days' notice. When it ends, requests already received stay in Quackzo under the retention above, and your Quackzo plan continues.