> ## Documentation Index
> Fetch the complete documentation index at: https://developers.perkstar.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Zapier data and security
> Understand OAuth access, customer-data flow, consent, retention, deletion, and operational safeguards for Perkstar Zaps.
Connecting Zapier creates a new data flow chosen by the Perkstar business. The
business decides which Zap runs, which fields are mapped, which destination
apps receive them, and how long those destinations retain them.
This page explains product behaviour and implementation responsibilities. It
is not legal advice and does not replace the Perkstar [Privacy
Notice](https://dashboard.perkstar.co.uk/privacy), [Data Processing
Agreement](https://dashboard.perkstar.co.uk/dpa), [Terms of
Service](https://dashboard.perkstar.co.uk/terms), Zapier's terms, or the
business's own privacy review.
## Connection security
Users approve Perkstar's hosted OAuth flow. The official connection never
asks them to paste a Perkstar API key into a Zap field.
Every credential resolves to one Perkstar organisation, and API resources
are checked against that tenant boundary.
The consent screen describes the access used by the configured triggers,
actions, searches, and card selector. Perkstar still enforces every scope.
The connection can be revoked. Revocation stops future API access but does
not erase Zap history or copies already sent to another app.
The prepared OAuth grant uses Authorization Code flow with required S256
PKCE, one-hour access tokens, and single-use rotating refresh tokens. Perkstar
revokes the grant if an already-rotated refresh token is replayed. Each instant
trigger also receives a per-subscription signing secret; the official app verifies the
exact callback bytes and a five-minute HMAC timestamp before returning a Zap
record.
## Requested access
| OAuth scope | Used for |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------- |
| `CUSTOMERS_READ` | Find customers and resolve customer state needed by supported steps. |
| `CUSTOMERS_WRITE` | Create or update a customer. |
| `ENROLLMENTS_READ` | Find an enrolment, balance, status, or available Wallet links. |
| `CARDS_READ` | Load active cards into selectors and validate card-aware steps. |
| `EVENTS_READ` | Read the bounded recent event feed used to provide real trigger samples. |
| `WEBHOOKS_WRITE` | Create, configure, and delete app-owned event subscriptions as Zaps are enabled or disabled. |
| `MARKETPLACE` | Enrol a customer, record loyalty activity, and reverse an eligible transaction through the marketplace-safe endpoints. |
| `PUSHES_WRITE` | Send a Wallet push through the explicit action. |
The Zapier OAuth application cannot use these permissions to inspect or mutate
webhook endpoints created by a different OAuth application or user. Perkstar
also enforces tenant, plan, account-state, consent, card-type, and rate-limit
checks after the scope check.
## Data the app can process
| Feature | Potential Perkstar data | Why it is used |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Instant triggers | Event ID/type/time, organisation ID, and the event-specific customer, card, enrolment, loyalty, purchase, membership, engagement, or booking fields | Start the selected Zap and provide its mapping fields. |
| Find Customer | Customer ID/number, contact and profile fields, consent flags, external reference, and lifecycle timestamps | Match the intended customer and return current state. |
| Find Enrolment or Pass | Customer/card IDs, status, balance/activity values, and available Wallet install URLs | Find the current programme relationship or pass link. |
| Customer actions | The identity, profile, consent, and external-reference fields mapped by the user | Create or update the intended customer. |
| Loyalty actions | Customer identifiers, card, amount/delta, stable transaction reference, note, and selected metadata | Enrol, record one compatible activity, or reverse the original transaction. |
| Wallet push | Enrolment ID, message, resolved merge fields, and delivery result | Send a business-authored message to eligible Wallet passes. |
The exact fields for each event are in the [webhook event catalogue](/reference/webhook-events).
Perkstar does not add customer email, name, or phone to every trigger merely to
make mapping convenient. Use a search only when the workflow needs current
profile data and is authorised to copy it.
## Responsibility model
```mermaid theme={null}
flowchart LR
Customer["Cardholder"] --> Business["Business using Perkstar\nNormally the controller"]
Business --> Perkstar["Perkstar\nNormally a processor"]
Business --> Zapier["Zapier and enabled Zap apps\nChosen by the business"]
Perkstar --> Zapier
Zapier --> Destination["Destination app"]
```
The business is responsible for determining its role and lawful purpose for
each destination, configuring access, giving required notices, and honouring
access, correction, deletion, objection, and consent rights across all copies.
Perkstar cannot govern a later Zap step after the data leaves Perkstar.
## Consent and messaging
* A loyalty enrolment does not automatically grant email, SMS, advertising, or
push-marketing consent.
* Treat Perkstar consent fields as purpose-specific state, not blanket
permission for every Zap destination.
* Keep the source, wording, time, and lawful basis needed to support any consent
assertion written from another app.
* **Send Wallet Push** enforces push-marketing consent. A `403` is a safety
outcome, not an error to route around.
* Never place payment-card data, passwords, health data, or other sensitive
free text in a loyalty note, push message, Zap field, or support request.
## Minimise and retain deliberately
1. Map only fields the next step needs.
2. Use opaque Perkstar IDs instead of copying a full profile where possible.
3. Limit who can edit the Zap and view Zap history.
4. Configure destination retention and logs; do not assume turning off the Zap
deletes historical tasks.
5. Avoid broad chat-channel messages containing contact details or feedback
text.
6. Redact customer payloads, OAuth tokens, unique hook target URLs, and Wallet
URLs from screenshots and support messages.
## Disconnect, deletion, and rights requests
Turning off a Zap stops future runs and deletes its corresponding app-managed
Perkstar instant-trigger subscription. Re-enabling the trigger creates a fresh
subscription and secret. Revoking the connected account stops future authorised
API calls and pauses its remaining owned subscriptions.
None of those actions automatically delete:
* completed Zap runs in Zap history;
* records created in a CRM, spreadsheet, chat tool, or other destination;
* source records that another app still controls; or
* Perkstar records the business is otherwise entitled or required to retain.
For a rights request, locate data by Perkstar ID and any stable external
reference, then apply the required export, correction, suppression, or deletion
in Perkstar, Zapier, and each destination. Test this process before a live Zap
copies customer data.
## Operational review
* [ ] The Zap owner, every connected app, and every person who can edit the Zap
are documented.
* [ ] The Zap uses the correct tenant and minimum necessary fields.
* [ ] Consent and suppression behavior is tested.
* [ ] Zap editors and Zap history viewers are restricted.
* [ ] Stable references make customer and transaction writes retry-safe.
* [ ] Revocation, trigger removal, and destination deletion are tested.
* [ ] Rights requests and incidents have named owners.
Report suspected credential exposure, unauthorised access, or a personal-data
incident to [privacy@perkstar.co.uk](mailto:privacy@perkstar.co.uk). For an
operational failure, follow [Zapier troubleshooting](/integrations/zapier/troubleshooting).
## Related topics
- [Security, privacy, and data handling](/fundamentals/security-privacy.md)
- [Send push notifications](/guides/wallet-pushes.md)
- [Make data and security](/integrations/make/data-security.md)
- [Zapier](/integrations/zapier/index.md)
- [Connect Perkstar to Zapier](/integrations/zapier/setup.md)