Security

We use access controls, secure connections and monitoring to help protect the Perkstar service and the information entrusted to it. No online service can promise complete protection against every threat.

Hosting and service providers

Our marketing website is hosted on Framer. The Perkstar platform uses Supabase for its database and authentication, and Vercel for application hosting. Application functions are currently deployed in Dublin and London; static assets may be served through a global network.

Some providers and business-selected integrations process information outside the UK and EEA. Processing arrangements depend on the service involved; we do not promise that all information stays in a customer’s home country.

Read our Data Processing Agreement and sub-processor register for the applicable processing terms, service providers and transfer arrangements.

Account access

Business accounts use role-based permissions and organisation-scoped access checks. Two-factor authentication using an authenticator app is available for account sign-in. We recommend enabling it and giving each team member only the access they need.

Use a strong, unique password, keep account recovery details secure and remove access when a team member no longer needs it. Do not share passwords or verification codes.

Secure connections and payments

The website and platform use HTTPS. Provider integration credentials are encrypted before they are stored. These safeguards reduce risk but are not a guarantee against every possible incident.

Stripe processes Perkstar subscription payments and supported customer checkouts. Perkstar receives the payment, transaction and billing information needed to operate the service; payment-card collection is handled through Stripe’s payment interfaces.

Monitoring and data controls

We use error and availability monitoring to help identify service problems. Error-reporting code includes redaction of personal information and secrets. Monitoring does not replace access controls or the need to investigate a reported problem.

The platform includes customer-data export, communication-preference and erasure or anonymisation tools. Retention and deletion arrangements are described in our Privacy Policy and Data Processing Agreement. Some records must be retained for legal or accounting purposes; deletion is not always immediate or absolute.

Who is responsible for customer data?

For loyalty information processed on a business’s instructions, that business is normally the controller and Perkstar acts as its processor. Perkstar acts as a controller for its own website enquiries, account administration, billing and business operations. Businesses remain responsible for their programme rules, lawful use of customer information and marketing permissions.

Personal data breaches

If a personal data breach occurs, we assess it and notify the relevant regulator where required, without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected individuals without undue delay where the breach is likely to create a high risk to their rights and freedoms. Where we act as a processor, we notify the relevant business controller without undue delay in accordance with our Data Processing Agreement.

Security questions and reporting

Contact us privately if you suspect a security issue or need information for your business’s due diligence. Include enough detail to help us investigate, but do not send passwords, verification codes or full payment-card details.

Email: legal@perkstar.co.uk

Perkstar Ltd, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.