Data handling

This page describes, in modest and factual terms, what data the API handles and what you should do with it. It is not a legal statement, and it does not make claims about certifications. For contractual or compliance questions, ask Spendstream.

Data you send

• Users. Only a UID is required. Name, email and telephone number are optional, so send only what you need.
• Orders. The user, the promotion and the amount.

Data Spendstream returns

• Catalogue data such as brands, categories and promotions.
• Transaction records for your own users.
• Single sign-on tokens for white-label publishers.

Every request is scoped to your publisher, so one publisher does not see another publisher’s users or transactions.

Card payments

Card details are entered on a hosted payment page provided by our payment provider, so they do not pass through your servers when you use the hosted model.

Your responsibilities

• Send the minimum personal data you need.
• Keep credentials and single sign-on links out of logs.
• Handle any personal data you hold about your customers under your own privacy notice.
• Delete or restrict data according to your own retention rules and applicable law.

💡 Tip: If you need to know where data is stored, how long it is kept or how to handle a deletion request, ask your Spendstream contact. Do not assume an answer.

Related pages

• Credential security
• Support responsibilities