Customers are the people who pay you through OwnPay. You rarely need to create customer profiles manually - the system creates them automatically from completed payments, invoices, and payment link checkouts.
How customer profiles are created
When a customer completes a payment for the first time, OwnPay registers their email address (and phone number if provided) as a customer profile under the brand that received the payment. The same email address used across different brands creates separate customer records per brand.
Customer fields
PII encryption
OwnPay encrypts customer email addresses and phone numbers at rest using AES-256-GCM. This means:
- The raw values are never stored in plaintext in the database.
- Only the application can decrypt them using the server-side encryption key.
- Database dumps or backups contain only ciphertext for these fields.
Staff members with the View Customers permission can see the decrypted values in the admin UI, but the data stays encrypted in storage.
GDPR considerations
- Right of access - you can export a customer’s profile and transaction history from the admin UI.
- Right to erasure - use the Delete action on the customer profile. This removes the customer record but preserves transaction records for financial compliance.
- Data minimization - only collect the fields you need. Avoid asking for phone numbers unless required by a payment method.
View and search customers
- Go to People → Customers.
- Use the search bar to find customers by name, email, or phone number.
- Click a customer row to open their detail view, which shows:
- Contact information.
- Transaction history with amounts, statuses, and dates.
- Lifetime spending summary.
Customer data in the API
You can also manage customers programmatically through the Merchant API. Customer records support create, read, and list operations. See the Merchant API reference for endpoint details.
Do not delete customer profiles that have active invoices or pending transactions. The system preserves transaction records for financial compliance even after you delete the profile.
Related Pages
