Applying for review of User-scopes
For developers of apps that use ReceiptRoller's User-scopes (
user.receipts.read, etc.). It explains the review application flow, required documents, review criteria, and common reasons for rejection.
Among ReceiptRoller's scopes, the ones that begin with user.* are scopes for accessing a general consumer's personal data. These can only be used after both the consumer's own consent and ReceiptRoller's review — not just the store's consent.
Why User-scopes are subject to review
- Receipt line items and purchase history constitute sensitive personal information
- The consumer has a direct trust relationship with "ReceiptRoller", not with the store
- If the data goes to an inappropriate app, the trust of consumers, stores, and ReceiptRoller as a whole is damaged
- Compliance checks such as third-party provision and cross-border transfer are required
For this reason, we set a stricter review process than for store-scopes.
Scopes subject to review
| Scope | Accessible data |
|---|---|
user.profile |
Display name, email address, registered region |
user.receipts.read |
The user's own receipt list and line items |
user.receipts.write |
Adding tags and memos to receipts |
user.purchases.aggregate |
The user's own purchase summary (aggregation by category) |
user.coupons.read |
The coupons the user holds |
user.notifications.send |
Sending push notifications to the user |
All User-scopes are subject to review. You must apply for each scope individually; you cannot apply for scopes you will not use "just in case".
The application flow
[App registration complete]
│
▼
[Prepare required documents] ← publish a privacy policy, set up a deletion contact, etc.
│
▼
[Apply from the developer portal] ← select scopes + fill in the application form
│
▼
[First review] (1-3 business days) ← check for missing documents
│
├─→ Sent back → fix and re-apply
│
▼
[Second review] (5-10 business days) ← review of implementation and operational structure
│
├─→ Follow-up questions → submit answers → re-review
│
▼
[Approved]
│
▼
[User-scopes usable in production]
In a typical case, allow 2-3 weeks from application to approval. If there are multiple round-trips of send-backs, it can take 1-2 months.
Required documents and information
1. Privacy policy (required)
- A public URL must exist
- State the data items retrieved from ReceiptRoller
- State the purpose of use, retention period, deletion procedure, and whether there is third-party provision
- State a contact point
- Prepare a Japanese version if you target Japanese users
2. Terms of service (recommended)
Recommended for consumer-facing apps. Even for B2B, stating that you handle consumer data makes the review go smoothly.
3. Deletion-request contact (required)
- An email address or an inquiry-form URL
- A structure to complete data deletion within 30 days of receipt
- How you operate deletion-completion notifications
4. Data-handling sheet (required)
Fill in the following items within the application form.
| Item | What to fill in |
|---|---|
| Retrieved data | Specific item names per scope |
| Storage location | Cloud provider, region |
| Retention period | How many months after the last retrieval you delete |
| Third-party provision | Yes / no; if yes, the recipient |
| Cross-border transfer | Yes / no; if yes, the destination country |
| Encryption | Encryption method at rest and in transit |
| Access control | Who can view it, under what conditions |
5. A test account for verification (required in some cases)
If your app's implementation is complete, we may ask you to provide a test account so the reviewer can verify the actual OAuth authorization flow, data retrieval, and display.
6. Screenshots and a video (recommended)
- The explanation shown to the user on the OAuth authorization screen
- The screen showing how the retrieved data is used within the app
- The path to the deletion request
A video of about 1-2 minutes is enough. Conveying the implementation shortens the review time.
Application procedure
- Developer portal → App → the "Scopes" tab
- Check the User-scopes you want to apply for
- Click the "Apply for review" button
- Fill in the required items in the application form (privacy policy URL, data-handling sheet, etc.)
- Upload attachments (test account info, screenshots, etc.)
- "Submit application"
After applying, the status becomes "Under review", and you can check progress on the same screen. Communication arrives at the email address given at application time.
Review criteria
The main review perspectives are as follows.
The principle of least privilege
We check whether the applied scopes are truly necessary to achieve the stated purpose. Applications that grab broadly are sent back.
A clear purpose of use
From the consumer's perspective, it should be readily clear "why this app needs the data". Abstract descriptions such as "to improve the service" are not acceptable.
Data protection structure
Encryption, access control, a configured retention period, and a deletion flow in place. It must meet at least the industry-standard bar.
Legal compliance
Compliance with the Personal Information Protection Act, the Act on Specified Commercial Transactions, the Premiums and Representations Act, and each country's privacy laws (GDPR, etc., where applicable).
Transparency of the operating entity
The operating company's address, representative, and contact must be public. Entities with no real presence or that cannot be contacted are not approved.
UX-level accountability
The scope explanation on the OAuth authorization screen, the data-use explanation at first launch, and the path to deletion must be presented to the consumer in an easy-to-understand way.
Common reasons for send-back
| Reason for send-back | What to do |
|---|---|
| The privacy policy is not published / the URL is 404 | Publish it and re-apply |
| No mention of receipt data in the privacy policy | Add the data items you retrieve |
| Abstract purpose of use (e.g. only "to improve the service") | Describe a concrete use case |
| Scope excessive for the purpose | Narrow to the necessary scopes |
| No deletion contact stated | Set up an email address or form URL |
| Whether third-party provision applies is unclear | State "yes / no"; if yes, the recipient too |
| The authorization flow does not work with the test account | Complete the implementation and re-apply |
| Operating company information is not public | State it on the app's site / support page |
Operation after approval
Once approved, the authorization flow using User-scopes becomes available in production. Note the following, however.
- Periodic review: once a year, there is a check of the usage status and data-handling structure
- Minor changes: minor changes such as changing the storage region are allowed with prior notice only
- Substantive changes: changing the purpose of use, the retrieved scopes, or whether there is third-party provision requires re-review
- Measures for violations: in cases of terms-of-service violations or frequent complaints, there may be stages of warning → suspension → revocation of approval
Pre-application self-check list
Checking the following before applying greatly reduces send-backs.
- ☐ The privacy policy URL is published, and the data retrieved from ReceiptRoller is stated
- ☐ The deletion-request contact (email or form) is functioning
- ☐ The purpose of use states "for whom", "what it does", and "where it is sent"
- ☐ The scopes you apply for are the minimum necessary for the purpose
- ☐ Whether there is third-party provision / cross-border transfer is stated
- ☐ The data retention period and encryption method are decided
- ☐ The authorization flow works in the test environment
- ☐ The operating company information is published on the site
Application statuses and guideline times
| Status | Meaning | Standard time |
|---|---|---|
| Not applied | Before selecting scopes | — |
| Application received | Submission complete | Immediate |
| In first review | Checking documents | 1-3 business days |
| Sent back | Has deficiencies, fix needed | — |
| In second review | Reviewing implementation / operations | 5-10 business days |
| Awaiting additional info | Question from the reviewer | Resumes within 3 business days of your answer |
| Approved | Usable in production | — |
| Rejected | A serious problem in the application | Notified with a reason |
Frequently asked questions
Q. Can I try User-scopes during development?
A. Only for a development app (a test app), you can use the "sandbox slot" that can be authorized only by test users inside the operating company (your own members). You cannot open the authorization flow to general consumers.
Q. Once approved, how do I add a new User-scope?
A. It becomes an application to add only the additional scope. The review results for existing scopes carry over as-is, and you only need to submit the required documents for the addition.
Q. How do I withdraw an application?
A. You can "withdraw" from the relevant application screen in the developer portal. You can re-apply later.
Q. If the review is taking a long time, can I inquire?
A. If there is no progress even 10 business days after applying, contact the developer community or the support desk. Including the application ID speeds up the check.