Privacy Policy
This Privacy Policy explains what data IP & Fake Order Blocker (“the App”, “we”, “us”) collects when a merchant installs it on their Shopify store, why we collect it, and how it is stored, used, and deleted. The App is built and operated to provide fraud-prevention and storefront security services to merchants using the Shopify platform.
Information We Collect
We collect two categories of data, both limited to what fraud prevention requires:
- Order and fraud-risk data: for each order placed on a merchant’s store, we read the order’s IP address, customer locale, financial/fulfillment status, total price, and Shopify’s own order and customer identifiers. Email address, phone number, and shipping/billing address are never stored in raw form — each is normalized and converted into a one-way cryptographic hash before anything is written to our database, and the original value is discarded immediately. These hashes let us detect the same customer or address across multiple orders without ever retaining the customer’s actual contact details.
- Storefront visitor data: when a merchant enables the App’s storefront protection, each storefront visit is checked against the merchant’s block/redirect rules. We record the visitor’s IP address, resolved country, and the resulting decision (allowed, blocked, or redirected) so the merchant can review their traffic and enforce their own IP/country blocklist.
How We Use This Information
- To score incoming orders for fraud risk and flag or, if the merchant opts in, automatically cancel high-risk orders.
- To enforce a merchant’s own IP address, country, and bot blocking rules on their storefront.
- To show the merchant analytics about blocked, redirected, and allowed traffic and orders.
- To detect the same customer or address recurring across orders, using irreversible hashes rather than raw contact data.
We do not use this data for advertising, marketing, profiling unrelated to fraud prevention, or any purpose other than operating the App’s fraud-prevention and storefront-security features for the merchant who installed it.
What We Do Not Do
- We do not sell, rent, or trade any data we process to any third party.
- We do not store raw customer email addresses, phone numbers, or full shipping/billing addresses — only one-way hashes.
- We do not share merchant or customer data with anyone outside of operating the App itself, other than Shopify, Inc., which hosts the App and provides the order/webhook data we process.
Data Retention and Deletion
Data is retained only for as long as the App is installed and needed to provide fraud-prevention services. When a merchant uninstalls the App, Shopify notifies us via a mandatory webhook, and we erase that merchant’s stored data, including every order and visitor record tied to their store. When a merchant’s customer submits a data-erasure request through Shopify, we remove the hashed identifiers (email, phone, customer ID, and address hashes) tied to that customer’s orders. Order-level fraud-risk records (such as the IP address and risk score already computed for a given order) may be retained as part of the merchant’s fraud-prevention and security records for the life of the installation, consistent with our legitimate interest in preventing fraud, and are erased on uninstall as described above.
Your Rights
The App implements Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact, andshop/redact), which let a merchant’s customers request a copy of or the deletion of the data described above, and ensure a merchant’s data is deleted when they uninstall the App. Requests are made through the merchant’s Shopify store in the usual way; merchants and their customers do not need to contact us directly to exercise these rights, though we are happy to help — see Contact Us below.
Data Security
Email addresses, phone numbers, and addresses are hashed with a keyed HMAC before storage, so the original values are never present in our database. All data is transmitted over encrypted (HTTPS/TLS) connections, and access to stored data is limited to what the App needs to operate.
Children’s Privacy
The App is a business tool for Shopify merchants and is not directed at children. We do not knowingly collect data from children.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the App’s functionality or applicable law. The “Last updated” date above reflects the most recent revision.
Contact Us
Questions about this Privacy Policy or how IP & Fake Order Blocker handles data can be sent to devmind.pk@gmail.com.