SETSimple Easy Transactions
SET DocsAPI reference and complianceUpdated 2026-11-10
Browse: SET API (Platforms)

Data-subject requests

SET API (Platforms) and SET Merchant API · Live since 2026-11-10

The problem

A person whose payments ran through your SET account asks to see, or to erase, what is held about them. You hold your own records. SET holds some, and SET's provider holds others. You need to pass the request on and tell the person what can and cannot be erased.

The answer

Record the request for the customer it concerns:

POST /v1/data_requests
{ "customer": "cus_…", "kind": "export" }
  • kind is export (send the person what is held) or delete (erase what can be erased).
  • The answer (201) is the request, state: "received", with whatSetHolds. You get data_request.received.
  • SET's operator answers the request. GET /v1/data_requests lists yours, newest first, up to 100.

What can and cannot be erased

whatSetHolds says it in words, so you can pass it on:

  • SET holds the customer's ids, states, amounts and dates for each payment, which payment and tax records require it to keep, and any metadata you set.
  • Identity details (names, documents, bank details) are held by SET's provider, under the provider's own retention. SET does not store them.

So a delete request cannot erase payment records SET must keep. The answer says so.

Rules

  • The customer must be yours, in the key's mode (404 customer_unknown).
  • The call records the request; it does not export or erase anything itself.
  • Never put the person's name or email in metadata or a reference to track the request: use the request's id.