Perks AI connector: privacy and data
The short version
Perks MCP lets a merchant's person connect an AI app of their choice to their business data. Connecting is the merchant's own decision. The data the app receives goes to that AI provider under the merchant's agreement with them. Portus is responsible for the data being exact and limited to what the person may see. The merchant and their AI app are responsible for what is built on it.
Figures are exact. Analysis by your AI app is not guaranteed by Portus.
Who can connect
- Only a merchant's own person, signed in for themselves, with the "Connect AI apps" permission.
- Never a Portus operator, an impersonation session, a shared till PIN or a Terminal token.
- Only when Portus has switched the connector on for that merchant. It is off by default, and turning it off stops every connection at once.
- The person approves each app on a consent screen, within minutes of proving who they are. The consent version is recorded with the connection.
What the AI app can see
The app gets read-only answers from a fixed set of tools. There is no free-form query and no file export. Each request follows the person's current plan, role and branches.
| Data | What the app gets |
|---|---|
| Business | Name, plan, modules, branches, time zone, currency, week start |
| Member groups | Counts of members, new, returning, absent and at risk, by segment, tier and monthly cohort |
One member (needs members.read) |
Member id, masked phone, status, tier, balance, last visit, rewards available |
Member lists (needs members.read) |
Up to 50 rows: member id, masked phone, visits in the period, last visit |
| Points | Issued, used, owed, monthly movement |
| Rewards and campaigns | Reward and campaign names, redemptions, points, end dates |
| Programme results | Points and members by programme part, with control totals |
| Visits and ratings | Visits by weekday and hour, scores by branch |
| Attention | Counts of unread alerts, open reviews, held earns and flags |
| Data table | Up to 1,000 rows a call, by day, branch, tier, reward or programme part, within a daily allowance for each connection |
What it never gets:
- full phone numbers, email addresses, member names, addresses or birth dates;
- written rating comments, member notes or order notes;
- staff personal data;
- full order records;
- another merchant's data.
Masking
Masking runs on the Portus side for every role, owners included. A phone number appears as the dial code and the last four digits, such as +965 •••• 7788. A number too short to mask safely is hidden. An app can look up one member by an exact phone number or member id. There is no search and no near match.
Text inside the data
Names that merchants type, such as a business, branch, tier, reward or campaign name, reach the app as quoted JSON values. Each is cut at 200 characters, with the answer naming what was cut, and invisible characters are removed. Customer free text doesn't reach it at all. Tests plant hostile text in these fields and confirm it stays in those values, never reaches the reply text or a tool description, and adds no tool. An AI app may still be influenced by text it reads. Because the connection is read-only and masked, such text can't change data or reveal contact details.
What Portus stores
| Record | Content | Kept |
|---|---|---|
| Connection | Person, app name and address, scope, consent version, dates, last used, gap-report choice | After revocation, for audit |
| Tokens | SHA-256 hashes only. Access tokens last 15 minutes; refresh tokens rotate on every use | A connection expires after 30 days without use, and after 90 days at most |
| Audit record of each tool call | Person, app, tool, a keyed hash of the arguments, rows returned, time taken, result | In the audit log, with no deletion period set yet. When a period is chosen, it will be stated here |
| Row allowance | Rows used per connection per day | Operational |
| Gap report (opt-in) | One line of up to 300 characters, with email addresses, web addresses and any number of four or more digits removed. Names can stay, so the tool asks the app to leave them out | 180 days, then deleted by the worker |
Portus stores no copy of tool answers and never sees the merchant's chat. The argument hash is keyed, so a phone number can't be recovered from it.
Control
- Anyone can disconnect their own app in Helm, under Settings, Connected AI apps. It stops at once.
- People with "Manage connected AI apps" can see and revoke every connection in the business.
- If a refresh token is reused, the connection ends automatically.
- A role or plan change applies to the next request.
What the AI provider does
Once data reaches the AI app, the provider's own terms apply, including storage, training use and location. Portus doesn't control this. Merchants should check their plan's settings with the provider.
Contact
Questions about this statement or about your data: support@tryperks.online.