Developer API Terms
Terms for organisations using the Lemma Verification API.
Version 1.0 · In effect from 15 October 2026 · Permanent link to this version
1. Who these Terms bind
1.1 The Company
The Verification API is operated by SkillSwap Ltd, trading as Lemma, a Cyprus private company limited by shares, registration number HE 475899, registered office Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus, not registered for VAT ("Company", "we", "us").
1.2 Business use only
These Terms apply only to organisations acting in the course of a trade, business, craft or profession. They are not offered to Consumers, whose use is governed by the Terms of Service.
1.3 Where these Terms sit
These Terms govern technical use of the API. The commercial relationship — volumes, fees, service description, warranties — is governed by the Verification Services Agreement, which prevails on conflict. Data protection is governed by the Data Sharing Agreement (Verification disclosures, where each party is an independent controller) and the Data Processing Agreement (employer-initiated assessment invites, where we act as your processor). Capitalised terms not defined here carry the meanings given in those documents and in the SCI Methodology & Rights Notice.
2. Eligibility and registration
2.1 You must be a legally constituted organisation, and the individual accepting these Terms must be authorised to bind it.
2.2 Give us accurate registration information — legal name, registered address, company and VAT registration numbers, a technical contact and a data protection contact — and keep it current.
2.3 We may verify your identity and use case before granting production access, and may refuse or withdraw access where the use case is inconsistent with clause 6. You may not use an intermediary to conceal who will actually use the data.
3. API keys and account security
3.1 We issue API keys and, where applicable, client credentials. Keys identify you and are confidential.
3.2 You are responsible for all activity under your keys, whether or not you authorised it, except where it results from our own failure. Store keys in a secrets manager — never in client-side code, a public repository, a browser, a mobile binary or a support ticket.
3.3 Tell us at security@getlemma.io without undue delay if a key may have been exposed; we will revoke and reissue, and may revoke immediately where we reasonably believe a key is compromised. Rotate production keys annually and whenever someone with access leaves.
3.4 Report vulnerabilities to security@getlemma.io. We will not pursue good-faith research confined to a sandbox test account that does not touch another party's data, degrade the service, or publish Candidate data.
4. Sandbox and production
4.1 The sandbox returns synthetic data only — no real Candidate data, no real SCI values. It is representative but not identical to production; latency, limits and error distributions differ. Sandbox keys are limited to 20 requests per minute.
4.2 Production returns real personal data about real people, and only about Candidates who have consented to disclosure to your organisation (Data Sharing Agreement, clause 3.1) and confirmed they are 18 or older. Production keys belong to your organisation; a key stops returning data as soon as its holder is no longer a member of it. We issue production keys ourselves, after signature of the Verification Services Agreement and the applicable data protection instrument, and our review of your use case; they cannot be created self-service. Do not use production keys for load testing, demonstrations, screenshots, training data or sales material.
5. Rate limits, quotas and fair use
5.1 Requests are subject to the Verification volume in your order form and to rate limits: by default 60 requests per minute per production key, and a batch lookup may contain at most 25 Candidates. Exceeding a limit returns HTTP 429 with a Retry-After header; use exponential backoff with jitter. Repeatedly disregarding 429s is a breach.
5.2 Fair use. Automated traffic must be proportionate to a genuine hiring or assessment need. A request pattern resembling enumeration, mirroring or dataset construction rather than case-by-case assessment is a breach, whether or not it stays inside your rate limit. We may apply temporary limits to protect service stability, and will tell you unless it is an emergency.
6. Licence and restrictions
6.1 What we grant
Subject to these Terms and to payment, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable licence for the term to call the API and use the data returned solely for the Permitted Purpose: assessing a named Candidate's skills for a specific, stated role, engagement or programme for which that Candidate has applied or is being considered. No rights in the Platform, the SCI methodology, our models, documentation or trade marks are granted beyond that licence.
6.2 Prohibited uses
These restrictions are material. They are also the basis on which the SCI stays outside the social-scoring prohibition in Art. 5(1)(c) of the EU AI Act, Reg. (EU) 2024/1689, which bites where a score is used against a person in a context unrelated to the one in which the underlying data was generated. You must not:
6.2.1 use a Verification for any purpose other than the Permitted Purpose, or for a role or programme you did not state;
6.2.2 reuse a Verification obtained for one role, engagement or programme in any unrelated context — including tenancy, lending, credit, insurance, immigration, benefits, membership, policing, or any general assessment of a person's trustworthiness or social standing;
6.2.3 combine or correlate Verification data with a Candidate's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation (GDPR Art. 9), or with age, sex, disability or nationality, in order to score, rank or filter Candidates;
6.2.4 sell, licence, sublicense, redistribute, syndicate, publish or otherwise pass Verification data to a third party — including a group company, your own client or an ATS vendor — except to a processor on your documented instructions under GDPR Art. 28, bound to these restrictions;
6.2.5 enumerate, crawl, scrape or bulk-extract profiles, iterate identifiers, or keep a local copy beyond the retention period in the Data Sharing Agreement;
6.2.6 use Verification data to train, fine-tune, evaluate or benchmark any model, or to build or improve any score, index, ranking or product competing with the SCI or the Platform;
6.2.7 make a decision producing legal effects concerning a Candidate, or similarly significantly affecting them, based solely on automated processing including a Verification — human review by someone competent and authorised to reach a different outcome is required (GDPR Art. 22; C-634/21 SCHUFA, 7 December 2023);
6.2.8 query in respect of anyone under 18, or anyone you know or suspect to be under 18 — we exclude under-18 Users from the Verification API entirely;
6.2.9 use a Verification to discriminate on any protected ground, or in a way producing an unjustified disparate impact;
6.2.10 misrepresent to a Candidate, a regulator or the public what an SCI is, what it measures, or what weight you gave it;
6.2.11 reverse-engineer the SCI, probe it through crafted queries, or circumvent rate limits, authentication or access controls;
6.2.12 query where the Candidate's consent has been withdrawn or expired, or cache data in a way that survives a withdrawal notice from us.
6.3 Compliance evidence
Record the Permitted Purpose for each Verification and the human review applied to any adverse decision, and be able to produce both on request (clause 15).
7. Availability and support
7.1 We aim to keep the production API continuously available and publish planned maintenance in advance. While the API is in early access we make no availability commitment and offer no service credits; any target agreed later sits in the order form, not here. Sandbox carries no target. Support is by email to support@getlemma.io during Cyprus business hours.
8. Versioning, deprecation and changes
8.1 The API is versioned. Breaking changes ship in a new version, never into an existing one. Additive changes — new endpoints, new optional request fields, new response fields — are not breaking; write clients that tolerate unknown fields.
8.2 On deprecating a major version we give at least 6 months' written notice and keep it running for that period, except where security or legal compliance requires less, in which case we give at least 30 days' notice where we can, and explain why.
8.3 We may change these Terms on written notice before a materially adverse change takes effect. If you object you may terminate before then, without penalty, and receive a pro-rata refund of prepaid fees.
9. Fees, invoicing and VAT
9.1 Fees are per Verification or per subscription tier, as set out in your order form.
9.2 VAT. The Company is not registered for VAT and does not currently charge it. If it registers, VAT will be added as the law requires; for a business established in another EU Member State with a valid VAT identification number, the reverse charge applies (Council Directive 2006/112/EC, Arts. 44 and 196).
9.3 Invoices are in EUR, payable within the period stated in the order form. Late payment bears interest at the Cyprus statutory rate for commercial transactions, plus reasonable recovery costs (Directive 2011/7/EU). You may withhold only a genuinely disputed amount, notified in writing before the due date.
9.4 Fees for the next term may change on written notice given before renewal; you may decline by not renewing.
10. Suspension
10.1 We may suspend access, in whole or in part, where: (a) you are in material breach of clause 6; (b) an invoice is overdue after written reminder; (c) your use threatens the security, integrity or availability of the Platform; or (d) the law or a regulator requires it. Except under (c) or (d), we give notice and a reasonable chance to cure first.
10.2 Suspension does not relieve accrued payment obligations, and we restore access promptly once the cause is resolved. On suspension or termination for a clause 6 breach you must delete Verification data in accordance with the Data Sharing Agreement.
11. Confidentiality
11.1 Each party will keep the other's confidential information confidential, use it only for these Terms, and protect it with at least reasonable care. Our API keys, non-public documentation, security information and pricing are confidential.
11.2 This does not cover information that is public through no breach, independently developed or lawfully received from a third party, nor prevent a disclosure required by law — in which case, where lawful, the disclosing party tells the other first. It survives termination for five years, and indefinitely for trade secrets.
12. Intellectual property and warranties
12.1 We own the Platform, the API, the SCI methodology and all related intellectual property. You own your systems and your data. We may use any feedback you give us without restriction or payment.
12.2 Each party warrants that it has authority to enter into these Terms and will comply with applicable law, including data protection, employment and anti-discrimination law.
12.3 We warrant that the API will perform materially in accordance with the documentation. Beyond that, so far as the law permits, we give no other warranty — in particular we do not warrant that an SCI accurately measures a Candidate's competence, that it is fit for your hiring decision, or that the API will be uninterrupted or error-free.
13. Liability
13.1 Neither party limits liability for death or personal injury caused by negligence, fraud, wilful misconduct or gross negligence, or anything that cannot be limited under Cyprus law.
13.2 Subject to 13.1, neither party is liable for indirect or consequential loss, loss of profit or revenue, anticipated savings, business opportunity or goodwill; and each party's aggregate liability in any twelve-month period is capped at the fees paid or payable by you in that period. The cap does not apply to your breach of clause 6, either party's breach of clause 11, or your payment obligations.
14. Term and termination
14.1 These Terms run from first API access until terminated. Either party may terminate for convenience on the notice stated in the order form or, if none, on 30 days' written notice.
14.2 Either party may terminate immediately if the other commits a material breach not cured within 30 days of notice, or becomes insolvent or subject to a winding-up or analogous procedure. We may terminate immediately for breach of clause 6.2.2, 6.2.3, 6.2.4, 6.2.6, 6.2.8 or 6.2.9, which we treat as incurable.
14.3 On termination your licence ends, keys are revoked, accrued fees fall due, you must delete Verification data under the Data Sharing Agreement, and clauses 6.2, 9, 11, 12, 13, 15, 16 and 17 survive.
15. Audit
15.1 Once in any twelve-month period, on 30 days' written notice, we may ask you to certify compliance with clause 6 and to produce the clause 6.3 records for a sample of Verifications.
15.2 Where we reasonably believe clause 6 has been breached we may audit more often and require a targeted inspection during business hours, without unreasonable disruption and subject to your confidentiality and security requirements. Each party bears its own costs unless the audit reveals a material breach, in which case you bear ours.
15.3 Audit rights over processing we perform as your processor sit in the Data Processing Agreement.
16. Governing law and disputes
16.1 These Terms are governed by the laws of the Republic of Cyprus, and the courts of Cyprus have exclusive jurisdiction — where a district must be named, the Larnaca District Court. Either party may still seek urgent injunctive relief in any competent court.
17. General
17.1 Assignment and publicity. You may not assign without our written consent; we may assign to a group company or a buyer of our business. Neither party may use the other's name or marks publicly without prior written consent (see the Verification Services Agreement).
17.2 Notices. Contractual notices go to legal@getlemma.io and the address in your order form; operational notices to your technical contact or the developer dashboard.
17.3 Severability, waiver, entire agreement. An unenforceable provision is modified to the minimum extent needed, or removed; the rest continues. Delay in enforcing a right does not waive it. These Terms, the Verification Services Agreement, the applicable data protection instrument and your order form are the whole agreement about the API, without limiting any remedy for fraud.
17.4 Contact. SkillSwap Ltd, trading as Lemma, Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus. Support support@getlemma.io; legal legal@getlemma.io; privacy privacy@getlemma.io; security security@getlemma.io.