Skyfense is built so that merchants using our service can meet their obligations under the EU General Data Protection Regulation (GDPR) and the UK GDPR. This page explains our roles, the safeguards in place today, and how requests are handled. It describes commitments and current practice; it is not legal advice.
1. Controller and processor roles
For storefront and order data collected through a merchant's store, the merchant is the controller and Skyfense is a processor acting on the merchant's documented instructions. For our website, merchant accounts, authentication, and billing, Skyfense is the controller.
2. Legal bases
3. Data minimization and purpose limitation
We collect only what the detection and fraud-prevention features need, and we minimize sensitive fields by design. For Shopify orders in particular, Skyfense stores a one-way hash of the customer email and the email domain, and does not store customer names, physical or billing addresses, phone numbers, raw email addresses, or payment-card data. Signals are used to assess risk and are not repurposed for unrelated advertising.
4. Device fingerprinting and automated security decisions
Skyfense uses device and browser fingerprinting, behavioral signals, and IP reputation to produce automated risk scores that inform allow, challenge, or block outcomes. Because fingerprinting and IP-based assessment involve personal data, the merchant (as controller) is responsible for determining the appropriate legal basis, providing any required notice or consent, and — where an automated decision could have a legal or similarly significant effect — offering appropriate safeguards such as human review. Skyfense provides the configurability (policies, thresholds, and review workflows) to support this.
5. Data-subject rights
Individuals in the EEA and UK have rights to access, rectify, erase, restrict, or object to processing, and to data portability. Storefront visitors should contact the merchant whose store they used, because that merchant is the controller. For Shopify stores, Skyfense processes the mandatory Shopify privacy requests on the merchant's behalf: a customer data-request produces an export of the minimized data we hold, and a customer redaction deletes the matching order records and their linked visit data. Account holders can exercise their rights directly at hello@skyfense.com.
6. Retention and deletion
Visit records, session events, devices, fingerprints, and order records are deleted automatically once they pass the merchant's configured retention period (30, 90, 180, 365, or 730 days; default 365). IP records expire on their own schedule. When a store is uninstalled or a shop-redaction request is received, Skyfense deletes that merchant's data, including account users and the stored Shopify access token.
7. International transfers
Where we process personal data outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary technical and organizational measures.
8. Sub-processors and data processing agreement
Skyfense uses a limited set of infrastructure and service providers, each bound by data-protection terms. Merchants who require a Data Processing Agreement, or the current list of sub-processors, can request them at hello@skyfense.com. We provide reasonable notice of material sub-processor changes.
9. Security and breach notification
We apply the measures described on our security page, including TLS in transit, salted password hashing, workspace isolation, and signed-webhook verification. If we become aware of a personal data breach affecting merchant data, we will notify the affected merchant without undue delay so it can meet its own notification obligations.
10. Contact and complaints
GDPR questions, DPA and sub-processor requests, and data-subject requests can be sent to hello@skyfense.com. If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority.