Last updated: 8 Jul 2026

These API & Webhook Data Terms ("Data Terms") apply whenever you connect, enable, or configure webhooks from the Purple Dot Service ("Webhooks"), or access the Purple Dot Public or Private APIs described at docs.getpurpledot.com (the "APIs"). They supplement your Merchant Agreement with Purple Dot Technologies Limited and our Platform Privacy Policy. Capitalised terms not defined here have the meanings given in your Merchant Agreement.

By connecting a Webhook, generating or using API credentials, or making a request to the APIs — whether directly, through the Portal, through a third party acting for you, or with the help of our team — you accept these Data Terms.

1. What Webhooks and the APIs do

Webhooks push Merchant Data from the Purple Dot Service to endpoints that you choose and control. The APIs let you (or systems acting on your behalf) retrieve Merchant Data from the Purple Dot Service — for example pre-orders, waitlists, inventory, and fulfillment orders — and send us instructions such as triggering fulfillment or issuing refunds.

Depending on the events you subscribe to and the endpoints you call, the data delivered may include personal data about your Consumers, such as names, email addresses, phone numbers, shipping and billing addresses, and order and payment details ("Delivered Data").

You decide where Delivered Data goes. That may be your own systems or a third-party service you use (for example a 3PL, ERP, marketing, analytics, or customer-service platform).

2. You are the data owner and controller

As set out in Clause 6 of your Merchant Agreement, you own the Merchant Data, and that includes Delivered Data. For the purposes of the UK GDPR, EU GDPR, the CCPA/CPRA, and other applicable data protection laws ("Data Protection Laws"), you are the data controller (or "business") for Delivered Data. Purple Dot acts as your processor (or "service provider") only up to the point we deliver data to your Webhook endpoint or respond to your API request.

Once Delivered Data leaves the Purple Dot Service — whether pushed by Webhook or pulled through the APIs — it is in your hands. Purple Dot has no control over, and accepts no responsibility for, how it is stored, used, shared, or secured after delivery.

3. Your responsibilities

By connecting a Webhook or using the APIs, you confirm and agree that you will:

a. Have a lawful basis. You have all rights, permissions, consents, and lawful bases required under Data Protection Laws to receive Delivered Data and process it for your purposes.

b. Tell your customers. Your privacy notice accurately discloses your collection and use of Consumer data, including data received through Webhooks or the APIs and any third parties you share it with.

c. Choose endpoints and integrators carefully. Any Webhook endpoint you connect, and any third party that calls the APIs with your credentials or receives Delivered Data — acts on your behalf and at your instruction. They are your vendors or processors, not Purple Dot's, and you are responsible for having appropriate contracts (including data processing agreements) in place with them.

d. Keep credentials and data secure. You will maintain appropriate technical and organisational measures to protect Delivered Data, including using HTTPS endpoints, verifying webhook signatures where provided, and restricting access to the data. You will keep API keys, signing secrets, and other credentials confidential, use them only for your own store, and rotate them if you believe they are compromised. If you believe a credential or endpoint has been compromised, you will disconnect the affected Webhook or stop using the affected credential and notify us promptly at support@getpurpledot.com.

e. Own your API instructions. Requests made with your credentials are treated as authorised instructions from you. You are responsible for the accuracy and consequences of write operations — for example fulfillment triggers and refund instructions — submitted through the APIs by you or anyone using your credentials.

f. Handle data rights and inquiries. You are responsible for responding to Consumer requests to access, correct, delete, or opt out of the sale or sharing of their data, and for any regulatory inquiries, in each case to the extent they concern Delivered Data after delivery.

g. Set your own retention. You are responsible for retaining and deleting Delivered Data in line with your own policies and Data Protection Laws. Deleting data from Purple Dot does not delete copies already delivered to your systems or vendors.

h. Comply with the law and these limits. Your receipt and use of Delivered Data will comply with all Data Protection Laws that apply to you, including any rules on international data transfers out of the UK or EEA. You will use the APIs within any published rate limits and only as documented.

4. Purple Dot's responsibilities

We will transmit Delivered Data over encrypted connections, deliver only the data associated with the webhook events you subscribe to or the API requests you make, and continue to process Merchant Data within the Purple Dot Service in accordance with Clause 6 of your Merchant Agreement and our Platform Privacy Policy. We are not responsible for determining whether your use of Webhooks or the APIs satisfies your legal and regulatory obligations — that assessment is yours alone.

5. Responsibility for downstream use

You are solely responsible for all processing of Delivered Data after delivery, and for the acts and omissions of any third party you direct us to send it to or that accesses it with your credentials. You will indemnify Purple Dot against losses, claims, and regulatory penalties arising from your (or your vendors') use of Delivered Data after delivery, or from instructions submitted with your credentials, except to the extent caused by Purple Dot's breach of these Data Terms.

6. Suspension and changes

We may suspend or disable a Webhook, API credential, or API access if we reasonably believe it poses a security or legal risk, and we may update these Data Terms from time to time by posting the updated version at this URL. Continued use of Webhooks or the APIs after an update constitutes acceptance. These Data Terms are governed by the governing-law and dispute-resolution provisions of your Merchant Agreement.

Questions

Contact us at support@getpurpledot.com.

‍