Data & privacy

What the API shares

The business's orders, loyalty cards and events, and menu, within the key's permissions.
Never a full card number (only a masked one such as •••• 4821 7730), and never staff or device ids.
Personal data: customer.name and customer.phone appear only with the customers:contact permission.
Customers are identified per business by their card's id (card_id on orders and events, id on a card): a customer has one card at each business. The API never returns a ServeU-wide customer id, so a system connected to two businesses can't link the same person across them.
Car plates, car descriptions and table labels are always included with orders:read: staff need them to serve the order.

Use customers' contact details only for the purpose the business agreed with its customers.
When a customer deletes their data from ServeU, delete it from your system too. Subscribe to customer.data_deleted (see Webhooks): it carries the deleted card's card_id. You can also tell from what the API answers:
- Their orders change: customer becomes null, and the car details and notes are cleared. The order's updated_at moves, so an updated_since sync picks it up (see Pagination, filtering & sync).
- Their loyalty events keep their history but card_id becomes null.
- Their card no longer exists: GET /api/v1/cards/{id} answers 404 not_found, and a void's answer has card: null.
- ServeU also forgets its stored answers that mention that card, so don't retry an earlier request for it with the same Idempotency-Key — it would run again (a retried join creates a new card).
Keep keys secret, give each system its own key, and ask the owner to revoke keys you no longer use.

For every call ServeU logs the key id, request id, route and status: never request bodies, phone numbers or keys.
For requests sent with an Idempotency-Key, the answer is kept so a retry within 24 hours gets the same one; a daily clean-up deletes it after that.
Keys themselves are stored only as a hash. Webhook signing secrets are stored encrypted.
Webhook events and their delivery log are kept for 30 days, without phone numbers or names: for endpoints that include contact details, those are looked up when each request is sent. When a customer deletes their data, the stored events about their card are deleted, and stored orders lose their customer details. The log also keeps the first 1 KB of each answer from your system as it is, so don't put personal data in those answers.

Questions about a specific request? Quote its request_id, never the key.