Data protection

The Data Reselling API needs very little personal data to work: the phone number a bundle is for. Keep it that way.

What Aura receives from you

Data	Why
Phone numbers	To find the number’s network and credit the bundle.
Your reference	To make purchases safe to retry and easy to find.
Your metadata	Returned to you on the purchase and in webhooks. Aura does not use it.

What not to send

• Do not put names, account numbers, identity numbers, email addresses or any other personal data in reference or metadata. Use your own opaque IDs, such as an order ID or customer ID.
• Never use real customer numbers in the sandbox. Use the test numbers.

How data is protected in transit

• The API and webhooks are HTTPS only.
• Every request is authenticated with a secret key, and can be limited to your own IP addresses. See Authentication and security.
• Every webhook is signed, so your systems can reject anything that did not come from Aura.

Where the rules are set

How long Aura keeps purchase records, and each party’s responsibilities for the data, are set out in your agreement with Aura and in Aura’s privacy notice. Ask your technical contact for anything your own data protection review needs.