FlexifyGuard Privacy Policy

Last updated: July 9, 2026

FlexifyGuard ("we," "us," or "our") is a fraud prevention application built by Flexify Ltd for merchants using the Shopify platform. This Privacy Policy explains what personal data FlexifyGuard processes on behalf of merchants who install the app, why we process it, and the rights available to the customers and visitors of those merchants' stores.

This policy applies to data processed through the FlexifyGuard app. Each merchant using FlexifyGuard remains the data controller for their own store's customer data; FlexifyGuard acts as a data processor, handling that data solely to provide fraud detection and prevention services to the merchant.

1. What Personal Data We Process

FlexifyGuard processes the minimum personal data required to detect and prevent fraudulent activity on a merchant's store. This includes:

• Name — first and last name, used to display order and customer information to the merchant and to match against merchant-configured customer blocklists.
• Email address — used as a primary fraud signal: checked against disposable-email patterns, matched against email/domain blocklists and customer blocklists, and factored into automated order risk scoring.
• Phone number — matched against merchant-configured customer blocklists and allowlists.
• Billing and shipping address (country-level) — used to detect billing/shipping country mismatches, a recognized fraud indicator, and to support country-level blocking configured by the merchant.
• Order data — order total, payment gateway, and order status, used to calculate risk scores and to identify patterns associated with fraud and chargebacks.
• IP address — used for geolocation, VPN/proxy/Tor detection, and velocity-based fraud checks.
• Device and browser information — a device fingerprint derived from browser and device characteristics (not a persistent tracking cookie), used to detect bots, automated scripts, and repeat-offender devices.
• Browsing behavior on the storefront — page visited and referrer, used only to evaluate checkout risk in real time.

We do not collect payment card numbers, passwords, government identification numbers, or any data beyond what is described above.

2. Why We Process This Data

All personal data processed by FlexifyGuard is used exclusively for one purpose: detecting, scoring, and preventing fraudulent orders, fraudulent accounts, and fraudulent storefront activity on behalf of the merchant. We do not use this data for marketing, advertising, personalization, or any purpose unrelated to fraud prevention. We do not sell personal data, and we do not share it with any third party.

3. Legal Basis for Processing

Where applicable data protection law requires a legal basis, FlexifyGuard and the merchant rely on legitimate interest — specifically, the prevention of fraud, chargebacks, and abuse, which is explicitly recognized as a legitimate interest under data protection frameworks including the GDPR. Where a merchant's storefront displays a cookie or tracking consent banner, FlexifyGuard checks the visitor's actual consent decision (via Shopify's Customer Privacy API) before collecting browsing or device data, and respects a decision to decline.

4. Automated Decision-Making

FlexifyGuard uses automated risk scoring to evaluate new orders, and can automatically cancel an order that matches a merchant-configured blocklist or exceeds a merchant-configured risk threshold. This is an automated decision that can have a real effect on a customer — specifically, the cancellation of their order. Customers who believe an order was cancelled in error should contact the merchant directly; the merchant can review the order and, where appropriate, reverse the decision or replace the order manually.

5. Data Sharing

We do not sell personal data. We do not share personal data with third-party advertising, analytics, or marketing platforms. Personal data is only accessible to Flexify Ltd personnel and stored on our infrastructure provider (Railway), which is used solely to host and operate the FlexifyGuard application.

6. Data Retention

Merchants can configure how long FlexifyGuard retains raw traffic and browsing data — visitor records, session records, checkout attempt records, and device fingerprint records — with a default retention period of 12 months. Data older than the configured period is automatically and permanently deleted on a daily basis.

Records that reflect a merchant's enforcement decisions — such as blocked customers, flagged products, and order risk assessments — are retained for longer, as merchants rely on this history for ongoing fraud prevention and audit purposes.

7. Data Security

Data in transit between FlexifyGuard, Shopify, and merchant storefronts is encrypted using HTTPS/TLS. Data at rest is encrypted at the storage level by our infrastructure provider, Railway, including automatic database backups.

8. Your Rights

Depending on your location, you may have the right to request access to, correction of, or deletion of your personal data. Because FlexifyGuard processes data on behalf of merchants, requests should generally be directed to the merchant whose store you interacted with. FlexifyGuard supports these requests through dedicated, automated processes:

• Data access requests are logged and the relevant merchant is notified so they can provide you with the data on file within 30 days.
• Data deletion requests result in your personal data being permanently anonymized or removed from our systems.

If you are a merchant and need to submit a request on behalf of a customer, or if you have any question about this policy, contact us using the details below.

9. Changes to This Policy

We may update this policy as FlexifyGuard's features change. Material changes will be reflected in the "Last updated" date above.

10. Contact Us

If you have questions about this Privacy Policy or how FlexifyGuard processes personal data, contact us at:

Flexify Ltd
Email: info@flexify.ltd