Skyfense provides bot detection, fraud prevention, and ad-spend protection for online storefronts. This policy explains what personal data we handle, why we handle it, how long we keep it, and the choices available to you. It reflects how the service actually works.
1. Our role: controller and processor
When a merchant embeds the Skyfense probe or connects its store, the merchant is the data controller: it decides why storefront and order data is collected and is responsible for providing notices and obtaining any consent required by law. In that context Skyfense is a data processor acting on the merchant's instructions. For our own website, merchant accounts, authentication, and billing, Skyfense is the controller. Storefront visitors with questions should contact the merchant whose site they visited first, because that merchant controls the processing. See our GDPR page for how these roles map to specific activities.
2. Personal data we collect
Merchant account data
When you create or manage a workspace we store your email address, name, a securely hashed password, workspace name and identifiers, status, and — where you connect Shopify — the shop domain and the OAuth access token needed to call Shopify on your behalf. We record administrative actions in an audit log (the acting user, a summary, and the request IP address); audit details do not contain passwords or payment data.
Storefront and session telemetry
When the probe runs on a merchant storefront, Skyfense may collect: browser and device characteristics (for example user-agent and client hints, platform and architecture, screen and color attributes, language and timezone, and signals derived from canvas, audio, WebGL, fonts, and connected-device enumeration); automation and tampering indicators (for example headless-browser and remote-debugging artifacts); interaction events (for example clicks, movement velocity, and challenge outcomes); a device identifier stored in browser storage; and a computed device fingerprint. We use these signals to return an allow, challenge, or block verdict and to give the merchant session-level forensics.
IP addresses and approximate location
We collect and store IP addresses observed on protected traffic, along with derived reputation signals and a risk assessment for each address. IP addresses are also used to derive an approximate (city/region/country-level) geolocation using an offline geolocation database. We do not use IP addresses to determine precise location.
Automated risk scoring
Skyfense computes a risk score and verdict for sessions and, where enabled, for orders. We retain an append-only decision history — the verdict, score, and the specific rules that contributed — so risk can be traced and rules can be reviewed. This is automated processing; the merchant configures its policies and decides how to act on Skyfense outputs.
Order data (Shopify)
When a merchant enables order protection, Skyfense receives order webhooks and stores a minimized record for fraud review: the Shopify order and checkout identifiers, order number, financial and fulfillment status, currency and total, a computed risk level and score, and limited order metadata (order tags, source, test flag, cancellation reason, and risk facts). For the customer email address we store only a one-way hash of the email plus its domain (for example, to link related orders and assess velocity). We do not store customer names, physical or billing addresses, phone numbers, raw email addresses, or payment-card data.
Ad attribution data
When configured by a merchant, Skyfense may associate advertising click identifiers and campaign parameters (for example from Google, Meta, Microsoft, or TikTok links) with a session to assess invalid clicks and report aggregate results.
Website and support data
Our marketing website loads the tools below only after you click Accept on the cookie banner (see our cookie policy). If you decline, none of them load.
- Google Analytics receives the pages you view, how you reached our site, and basic device and browser details, so we can see how the site is used.
- Google Ads receives whether a visit that came from one of our ads led to an install. Google's advertising cookies stay turned off, even after you accept.
- Apollo receives your IP address, the pages you view, and basic browser details. Apollo uses this to work out which company a visit came from. Our team may use that to reach out to businesses that showed interest in Skyfense. We do this for sales, not for running the service.
If you email us, we receive the message and your contact details.
3. Why we process each category
4. Automated decisions and profiling
Skyfense uses device fingerprinting, behavioral signals, and IP reputation to produce automated risk scores that inform allow, challenge, or block outcomes. The merchant sets the policies and remains responsible for actions taken. Where these decisions could have legal or similarly significant effects on an individual, the merchant is responsible for providing any required safeguards, such as a route to human review. See the GDPR page.
5. How long we keep data
Stored visit records, session events, devices, device fingerprints, and order records are deleted automatically once they pass the retention period configured by the merchant. The available settings are 30, 90, 180, 365, or 730 days, and the default is 365 days. Stored IP records expire on their own schedule. Account records are kept while the workspace is active. Records that we are required to keep to demonstrate that we honored a privacy request are retained separately for that purpose.
6. Sharing and disclosures
We share personal data with infrastructure and service providers that process it on our behalf (on our website, with your consent, this includes Google for analytics and ad measurement and Apollo for identifying visiting companies), with the merchant who configured the storefront or store, when required by law, and in connection with a corporate transaction. We do not sell personal data, and we do not use storefront telemetry to build advertising profiles for unrelated parties. A merchant-controlled feature can suppress configured ad-network events for sessions assessed as fraudulent; that is a product function, not advertising by Skyfense.
7. International transfers
Skyfense may process information in countries other than where you live. Where required, we rely on appropriate safeguards for international transfers, such as Standard Contractual Clauses together with supplementary measures.
8. Security
We protect data in transit with TLS, store passwords only as salted PBKDF2 hashes, isolate each merchant's data by workspace, verify the authenticity of Shopify webhooks, and restrict production network access. See our security page for the current technical and organizational measures, including areas we are still strengthening.
9. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict, or export personal data, or to object to certain processing. Storefront customers should contact the merchant whose store they used, as that merchant is the controller; for Shopify stores, Skyfense honors data-request and deletion (redaction) instructions received from Shopify on the merchant's behalf. Account holders can exercise their rights by contacting hello@skyfense.com. You can accept or decline our website tools on the cookie banner. To change your choice later, clear this site's cookies and storage in your browser and the banner will show again. If our team contacts you after a visit and you don't want to hear from us, reply or email hello@skyfense.com and we will stop.
10. Changes and contact
We may update this policy as the service changes and will post the updated version here with a new effective date. Questions about privacy can be sent to hello@skyfense.com.