This page explains product behaviour; it is not legal advice and does not
replace your own privacy, security, or regulatory review.
Responsibility model
For cardholder loyalty data, the business normally decides why data is processed, what is collected, which messages are sent, and which integrations are enabled. Perkstar normally processes that data for the business. Perkstar acts as controller for limited platform purposes such as account administration, billing, support, security, fraud prevention, and legal compliance. Your organisation is responsible for determining its role for data copied to or from its integration, documenting a lawful purpose, and honouring deletion, access, correction, consent, and objection requests.Data an integration can handle
Security boundaries
Tenant isolation
Credentials resolve to one organisation. Resource queries and mutations are
checked against that organisation at the API boundary.
Least privilege
API keys and OAuth grants carry explicit scopes. Create a separate
credential for each integration and environment.
Secrets at rest
API keys, client secrets, authorization codes, and OAuth tokens are stored
as non-reversible hashes where they only need comparison. Provider
credentials that must be reused are encrypted.
Transport and callbacks
Production traffic uses HTTPS. OAuth redirect URIs match exactly; webhooks
are HMAC signed and outbound URLs are checked against private-network and
DNS-rebinding targets.
Retry safety
POST requests use idempotency keys, POS transactions support permanent
external-reference deduplication, and OAuth refresh tokens rotate once.
Auditability
API responses include
X-Request-Id; authenticated API activity is kept in
a bounded audit trail for investigation and support.Credential handling
- Create separate test and live credentials.
- Grant only the scopes required by the job.
- Store plaintext secrets immediately; Perkstar cannot reveal them again.
- Never place a key or client secret in browser JavaScript, a mobile bundle, source control, analytics, screenshots, or support messages.
- Rotate on suspected exposure and revoke credentials when an integration is disconnected.
- Treat webhook bodies and OAuth tokens as personal or confidential data when they can be linked to a customer or business.
Consent and communications
Customer profile fields and consent flags can be written by an authorised integration. A flag records the state supplied to Perkstar; it does not prove that your external system collected valid consent. Keep the source, wording, time, and lawful basis needed for your own audit. Marketing wallet pushes require push-marketing consent. Transactional wallet updates needed to keep a pass accurate are separate from promotional communications. Do not infer email or SMS permission from a wallet install.Retention and deletion
Customer erasure is implemented as anonymisation when financial or audit facts
must remain. Direct identifiers are removed while the minimum pseudonymised
ledger can be retained.
DELETE /customers/{id} exposes that workflow to a
properly scoped integration.
Webhook and OAuth data
- Verify webhook signatures against the exact raw body before parsing.
- Deduplicate with the stable webhook event ID and restrict access to stored delivery payloads.
- OAuth access tokens expire after one hour. Refresh tokens rotate and must be replaced atomically; replay revokes the grant.
- Revoking either an access or refresh token revokes the paired grant.
- A marketplace uninstall should stop jobs, revoke tokens, remove unnecessary cached personal data, and retain only the audit facts your policy requires.
Rights requests and incidents
Businesses can export and anonymise customer data in the dashboard, and customers can use the privacy controls linked from their pass. Integration teams should be able to locate records by Perkstar ID and external reference, export a readable copy, correct a mismatch, and erase or suppress downstream copies. Report suspected credential exposure, unauthorised access, or a personal-data incident immediately to privacy@perkstar.co.uk. For API implementation support, contact support@perkstar.co.uk with the relevantX-Request-Id, never a secret.
Production review
- Data flow, role, purpose, and lawful basis are documented.
- Test data is separated from live credentials and jobs.
- Secrets are stored server-side and rotation is tested.
- Webhook verification, deduplication, and retention are tested.
- OAuth disconnect and refresh-token replay are handled.
- Customer export, correction, deletion, and suppression propagate.
- Logs redact secrets and unnecessary personal data.
- The DPA and sub-processor list have been reviewed.