Engine API Service Terms

1.The service

The Engine API gives your software the CutOptim cutting engine over HTTPS: panels (2D), bars (1D), timber and true-shape nesting, with the options and outputs described in the API reference (cutoptim.com/engine/reference; the OpenAPI document is at cutoptim.com/engine/openapi.json). We provide the API as described there and keep that description accurate. There are two plans, Studio and Scale; they differ only in the monthly quota and the trial.

2.Account and keys

• You create and revoke keys in your dashboard. A key is shown once; we store only a hash of it, so we cannot show it again.
• Keep keys secret and out of client-side code. Everything done with your keys is done by you. If a key may have been exposed, revoke it at once and tell us if you see use you do not recognise.
• You can hold several keys (for example staging and production); they share one quota. Revoking a key does not cancel the subscription and does not refund anything. Test keys for building the integration are free and have their own small allowance.

3.Plans, quota and fair use

• The quota is per account and per calendar month (UTC), shared by all keys: Studio 3,000, Scale 10,000 requests. Each successful optimise request counts as one request, whatever its mode or size.
• Not counted: validation requests (/v1/validate/*), polling a job, reading your usage, and any request we refuse (invalid input, not enough capacity) or cannot complete because of a timeout on our side.
• When the quota is used up, requests are answered with 402 until it resets on the first day of the next month or you switch to the larger plan. We never bill overage. We email the account at 90% of the quota and again when it is used up.
• The technical limits in the API reference (request size, number of parts, concurrency, rate) apply to everyone; a burst beyond our capacity is answered with 429 and is never charged. We do not lower a documented limit during the term except as set out in section 6.
• You can switch between Studio and Scale in the dashboard. The new quota applies at once; an upgrade is charged at once for the rest of the billing period; a downgrade is not refunded and the lower price applies from the next renewal.

4.Fees and payment

• Prices are those shown on cutoptim.com/engine when you subscribe: monthly, in euro, excluding VAT, charged in advance. Payment, invoicing and VAT (including the reverse charge for EU businesses that enter a valid VAT number at checkout) are handled by Lemon Squeezy as merchant of record; its terms apply to the payment.
• The price you subscribed at stays the same until we change it. A price change takes effect only after at least 30 days’ written notice, from the next renewal; you may cancel before it takes effect.
• If a payment fails it is retried; if it stays unpaid, access stops after a short grace period and returns as soon as payment succeeds.
• Fees for a period that has begun are not refunded, except where the law requires it, or where we end the service without cause (then the unused remainder of the paid period is refunded).

5.Term, cancellation and suspension

• The agreement starts when you subscribe and renews monthly. You can end it with 30 days’ notice by e-mail to [email protected]. You can also cancel at any time yourself in your account: access then continues to the end of the period you have paid for, and the keys stop working afterwards.
• We can end it with 30 days’ notice; if we do so without cause, section 4 applies to the unused remainder.
• We suspend access immediately only if a payment stays unpaid after the grace period, or if use threatens the security of the service or of other customers or breaches section 10. We tell you by e-mail at once and restore access as soon as the cause is gone.

6.Changes to the API, and continuity

• The API is backward compatible, always. We do not remove, rename or change the meaning of an existing endpoint, field, option, enum value or error code. New abilities arrive as new, optional fields, options or endpoints that integrations written today can ignore. The version in the path (/v1/) changes only if a response shape had to change, which we do not plan.
• The only exception is a change we must make to fix a security flaw or to comply with the law; we make the smallest change that does the job and tell you at once.
• If we ever had to retire an endpoint, or the API itself, we would tell you in writing at least 12 months ahead and keep it running until then.
• The engine improves over time. The same input can later return a different plan, which we aim to be a better one. Every response carries engineVersion and, on request, a planHash fingerprint; if your process needs a stable plan, store the response you used instead of running the request again.
• Changes and new abilities are published in the documentation and in our what’s-new log; anything that affects how your integration behaves is also e-mailed to your account address.
• Your requests for new features are welcome. Depending on their size we carry them out free of charge; larger work we quote first and start only after you approve. We decide what is built and when, and a request creates no obligation unless we confirm it in writing. What we build becomes part of the product, on the same backward-compatible terms, for all customers.

7.Availability and support

• The API runs on our own servers at Hetzner in Nuremberg, Germany. We aim for 99.9% availability per month. This is a target, not a guarantee, and gives no service credits. If a planned interruption is expected we announce it by e-mail in advance.
• GET /v1/health reports the state of the service without a key; you can poll it from your own monitoring.
• Support: [email protected], in English, on business days. We aim to reply within 2 business days, and sooner when production is affected.

8.Your data

• The parts, stock, options, references (meta) and plans you send and receive are your data and are confidential. We use them only to compute your result and run the service — never to train models, for marketing, or to share with third parties.
• For the synchronous endpoints nothing is kept once the answer has been written: no copy on disk, in a database or in a log. We keep only counters per key and day (calls and refusals), and our access log records the time, endpoint and status with the IP address masked, never the request content. Asynchronous max jobs are stored, request and result, so that you can poll them, and deleted after at most 7 days.
• Account and billing data are handled as described in our privacy policy (cutoptim.com/privacy). Where your requests contain personal data, for example a customer’s name in meta, you are the controller and we are your processor under Annex A; we recommend sending order numbers instead of names. Our security measures are summarised at cutoptim.com/security.

9.Ownership and permitted use

• You own your inputs and the plans and files the API returns, and may use them freely, including for your own customers’ orders.
• We own the API, the engine, the software and the documentation. During the term you may use the API for your business, including inside your own software; the right is non-exclusive and not transferable.
• You may not resell or sublicense access to the API itself, build a competing optimisation service from it, or reverse engineer it. Feedback you give us may be used to improve the product without payment.

10.Acceptable use and security

• Use the API lawfully and within its documented limits: no circumventing the quota or rate limits, no overloading the service, no probing for weaknesses. Report a vulnerability you find to [email protected].

11.Results and liability

• Cutting plans are computed by an algorithm. Check a plan against your material and machine before you cut. We do not promise that a plan is the best possible or that it suits every machine; each response states whether a layout can be cut edge to edge on a panel saw (guillotineValid).
• Our liability under this agreement is limited to the fees you paid in the 3 months before the event. We are not liable for indirect or consequential loss, lost profit, wasted material or production downtime. Nothing limits liability that cannot be limited by law, such as for intent, gross negligence or harm to life or health. Neither party is liable for events beyond its reasonable control.

12.General

• We may change these terms with 30 days’ notice by e-mail; you may cancel before the change takes effect. Notices go to [email protected] and to the e-mail address of your account.
• These terms, the plan you subscribed to and the general Terms of Service are the whole agreement. Hungarian law applies, and the courts of Budapest, Hungary have jurisdiction. If a clause is invalid the rest stays in force. The language is English.

Annex A — Data processing terms (GDPR Article 28)

A1 Roles and scope. For personal data in your requests you are the controller and we are the processor. Subject matter: computing cutting plans through the API. Duration: the term of the agreement plus the deletion periods in A6. Nature and purpose: automated processing of your requests to return results; there is no manual review. Data: names, references, meta content and sizes you send, and the contact data of the people who use your account. Data subjects: your staff who use the account and, only if you put them in names or meta, your customers or staff. We do not need any special categories of data; please do not send any.

A2 Our obligations. We process the data only on your documented instructions, which are these terms and your API calls, and tell you if an instruction would infringe the law. Only the operator has access to the production systems, under a duty of confidentiality. Our security measures, summarised at cutoptim.com/security, include: hosting in Germany; TLS for all traffic; access control at database level; two-factor protection of the admin area; encrypted off-site backups (daily copies kept 14 days, weekly copies 90 days) with restores that are tested; a tamper-evident audit log of administrative changes; and monitoring with alerts. We keep these measures up to date.

A3 Sub-processors. Hetzner Online GmbH (hosting of our server, Germany). Cloudflare (storage of our encrypted off-site backups; the API itself is not routed through Cloudflare). Resend (service e-mails to your account address). Lemon Squeezy acts as merchant of record for payments on its own account. Request content is handled only on our server at Hetzner; the only other place it can exist is inside the encrypted backups. We give 30 days’ notice by e-mail before adding or replacing a sub-processor; you may object on reasonable grounds and cancel.

A4 Assistance. We help you, within reason, to answer data-subject requests and to meet your obligations on security, impact assessments and breach notification.

A5 Breach. We tell you without undue delay, and in any case within 48 hours after we become aware of a personal data breach affecting your data, with the information we have, and keep you updated.

A6 Deletion. For the synchronous endpoints there is nothing to return or delete. Asynchronous max jobs are deleted after at most 7 days. When you delete your account, the account and its data are removed immediately; copies in backups age out within 90 days. At the end of the agreement we delete your account data on request within 30 days.

A7 Audit. We provide the information needed to show that we comply with this annex. You or an auditor you appoint may audit us once a year, with 30 days’ notice, in business hours, at your cost, and without access to other customers’ data; an audit may be repeated if a breach or an authority requires it.

A8 Transfers. Request content is processed in Germany. We use a sub-processor outside the European Economic Area only under the EU–US Data Privacy Framework or standard contractual clauses.

A9 Precedence. For personal data this annex prevails over the rest of these terms.