Consumer experience and account linking

Status: Proposed UX and consent flows. Final language requires privacy, legal and payment-provider review.

First-time consumer journey

1. Receive merchant-branded invitation with an expiring, single-use link that contains no sensitive customer details.
2. See who Sparelane is, which merchant is requesting a payment relationship, what will happen and where to obtain help.
3. Create an account or securely sign in. Verify email; verify mobile if required by risk policy.
4. Confirm linkage to the merchant using a secure challenge or merchant-provided signed identity assertion. Never link solely by matching an email address.
5. Review merchant-specific collection mandate, amount/schedule scope, permitted payment methods and fallback behaviour.
6. Add a method through the payment provider's hosted/tokenised interface; never enter card data into Sparelane servers.
7. Select primary and optional backup methods for that merchant, then explicitly authorise the mandate and store evidence.
8. Review the next expected bill, notification preferences and a confirmation of authorisation.

Returning consumer

A consumer signs in to one account to see linked merchants, upcoming bills, method status, collection history and outstanding actions. Each merchant has independent mandate scope and primary/backup ordering. A global method can be reused only when the consumer expressly authorises its use for that merchant.

Account linking and duplication

Merchant customer IDs are authoritative only within their merchant. Never merge two consumer accounts based solely on email, mobile or fuzzy name match. Define verified account recovery and dispute resolution. If a merchant changes its external customer ID, require a controlled relinking process.

Accessibility and trust

Design for WCAG 2.2 AA where practicable, mobile-first flows, plain-language consent, clear amounts and dates, accessible error states and non-coercive fallback choices. Do not imply Sparelane guarantees payment or replaces the merchant's underlying contract.

Core screens

Welcome/invitation; sign-up/sign-in; verify contact; link merchant; mandate review; add method; payment preferences; upcoming bills; bill detail and attempt timeline; payment methods; notification settings; revoke mandate; account recovery; help and complaints.

Acceptance criteria

• A consumer cannot accidentally authorise an unrelated merchant.
• A revoked mandate prevents new attempts after its effective time.
• An expired invitation cannot be reused.
• A method added for Merchant A is not automatically usable by Merchant B.
• The consumer can distinguish scheduled, processing, settled, failed and merchant-paid-out states.
• No sensitive method details are visible to other merchants.