Hubz API acceptable use policy

Effective: 6 November 2026 · Version 1.0

The Hubz API connects your Zalo conversations to your CRM, ERP and other business software, such as Odoo. Hubz is where your team talks to real customers, so the API is built for syncing and customer care, not for mass marketing.

By creating an integration key or calling the Hubz API, you agree to this policy and to the Hubz Terms of Use.

1. What the API is for

• Syncing customers, conversations and message history between Hubz and your CRM or ERP.
• Receiving webhooks on new messages to create leads, tickets or tasks in your systems.
• Embedding the Hubz chat in internal tools so staff can reply from the customer record.
• Sending messages written or approved by your staff to customers who contacted you or agreed to hear from you.
• Sending transactional messages to a specific customer who is already talking to you on Zalo, such as order or appointment confirmations.

2. What you must not do

Do not use the Hubz API, directly or through third-party software, to:

1. Send bulk messages or promotions to people who have not talked to you or opted in.
2. Auto-add friends, auto-invite to groups, or look up Zalo accounts from phone lists.
3. Scrape Zalo user data (profiles, contacts, group members) beyond your own business conversations.
4. Run fake or farmed accounts, or use many accounts to get around Zalo's limits.
5. Send fraudulent, deceptive, harassing or unlawful content.
6. Impersonate Hubz, BMS or Zalo, or resell or rent API access without a written agreement with BMS.
7. Try to get around rate limits, authentication or the separation between companies' data.

3. Risk to your Zalo numbers

Hubz connects personal Zalo accounts without using Zalo's official API. Hubz is not affiliated with Zalo or VNG. Zalo may restrict or block numbers that behave unusually, for example by sending in bursts, repeating content or drawing many reports.

• Messages sent through the API count as messages sent by that Zalo number.
• Hubz applies rate limits to reduce the risk but cannot guarantee a number will not be restricted.
• You are responsible for the content and pace of messages your systems send.

4. Keys and security

• Only the business owner can create integration keys. Creating and revoking keys, and every API call that changes data (sending messages, linking customers, registering webhooks), are logged.
• Send the key as Authorization: Bearer hbz_live_…. To act as a specific staff member, add the X-Hubz-User header with that person's email.
• Treat keys like passwords: never commit them to public code or paste them in chats.
• Always verify the X-Hubz-Signature header before processing a webhook.
• If a key may have leaked, revoke it under Integrations and create a new one.

5. Personal data

Data passing through the API is your customers' personal data. You are responsible for having a lawful basis to process it, using it only for customer care and transactions, and complying with Vietnam's personal data protection law.

6. Limits and changes

• The API is rate limited per key, currently about 300 requests per minute. Over the limit it returns 429 with Retry-After. Limits may change, especially during the beta.
• Breaking changes are announced in advance in the Changelog of the API documentation.

7. Enforcement

Depending on severity, Hubz may warn you, lower your rate limits, suspend or revoke integration keys, or suspend your Hubz account. For serious abuse such as spam, fraud or scraping, Hubz revokes keys immediately without notice.

Report abuse or ask about this policy: cs@bmstech.com.vn.