This page describes how payment and gift card data are protected on sales.bukkii.ai.
1. Payments
- Card payments are processed by Stripe. Full card numbers and CVC are entered in Stripe-hosted fields and are not stored on Bukkii servers.
- Checkout uses HTTPS. The site is served only over encrypted connections.
- The participating salon is the merchant of record through Stripe Connect (direct charge).
2. Gift card codes
- Each card has one numeric code used for lookup and payment at the salon.
- Codes are protected in our systems (hashed/encrypted at rest; access limited to authorized salon staff and platform operations).
- Treat the code like cash. Do not share it publicly.
3. Fraud controls
- Daily purchase limit (currently $501) per buyer email and per payment card fingerprint
- Stripe Radar and related fraud tools may be enabled where available
- Suspicious cards may be disabled by the salon Owner
4. PCI
Stripe is a PCI DSS Level 1 certified service provider. Because card data is handled by Stripe, Bukkii does not store primary account numbers for gift card checkout.
5. Report a security concern
Report a security concern to [email protected] with "Security" in the subject line.