Privacy Policy

• FraudGuard checks each new order in your Shopify store against the fraud rules you set, and cancels orders that reach your risk threshold.
• To do that, we process order and customer details such as names, email addresses, IP addresses and countries, and we keep records of the orders FraudGuard checks, flags and cancels.
• When FraudGuard cancels an order, we email the customer to let them know.
• For your customers’ personal information, you are the controller and Invizo processes it on your instructions.
• We don’t sell personal information or use it for advertising.

To get a copy of your data, or to have it corrected or deleted, email privacy@invizo.io.

FraudGuard is a product of Invizo. In this policy, “we”, “us” and “our” mean Invizo, and “you” means the merchant who installs and uses FraudGuard.

This policy explains how we collect, use, share and protect information when you install FraudGuard on your Shopify store, use the app and its dashboard, or contact us. It also covers information about your store’s customers that FraudGuard processes for you.

It does not cover Shopify or any other service you connect to FraudGuard; those services have their own privacy policies. Your use of FraudGuard is also subject to our Terms of Service.

When you install FraudGuard, Shopify asks you to approve the access it needs to your store. FraudGuard uses that access as follows:

read_orders

Receive new and cancelled orders so FraudGuard can check them for fraud risk, and show your recent orders in the app.

write_orders

Cancel orders that reach your risk threshold, refund and restock them, and add a note to the orders FraudGuard cancels or flags. On flagged orders, FraudGuard’s note replaces the order’s existing note.

read_customers

Read the customer details on your orders, such as name and email address, to check orders for risk and show who placed them.

read_metaobjects, write_metaobjects, write_metaobject_definitions

Record fraud cancellations in your store’s custom data: the order ID, customer email address, IP address, reason and action. These records are saved only if your store has a custom data definition for them, which FraudGuard doesn’t create.

write_products

Requested, but not currently used. FraudGuard doesn’t change your products.

You can withdraw this access at any time by uninstalling FraudGuard from your Shopify admin.

The information we collect depends on the features you use. It comes from your Shopify store through the Shopify API, from details you enter in FraudGuard, and from messages you send us.

Store details

Your shop domain, store name, contact email, Shopify plan, billing country and time zone, which Shopify shares when you install the app.

Your IP address

The IP address you connect from when you open FraudGuard or sign in to it.

Shopify access token

The token Shopify issues so FraudGuard can read and cancel orders in your store. We delete it when you uninstall the app.

Orders FraudGuard checks

For each new order: the order ID, number, date, total and currency, item quantities, shipping and billing countries, and the customer’s name, email address, IP address and customer ID. We keep a record of each order checked and count the orders checked each month.

Flagged and cancelled orders

For orders with a risk score above zero: the order details above, the risk score, the rules that matched and whether the order was flagged or cancelled.

Your fraud rules

The email addresses and domains you block, the countries you add rules for, your first-order rules and your risk settings.

Notification settings

The email addresses that receive alerts.

Support conversations

Messages you send us by email or through the in-app chat, and anything you include in them.

We use the information we collect to:

• Check each new order in your store against your fraud rules and give it a risk score.
• Cancel, refund and restock orders that reach your risk threshold, and flag orders that match your rules.
• Email your customers when FraudGuard cancels their order, and email the addresses in your notification settings about cancelled and flagged orders, if you turn alerts on.
• Show your recent, flagged and cancelled orders and your settings in the app.
• Count the orders FraudGuard checks each month, and avoid checking the same order twice.
• Answer your support requests.
• Keep a record of the stores that install and uninstall FraudGuard, including the IP address used, so we can support merchants and run our business.
• Keep FraudGuard secure and working, for example by verifying requests from Shopify and investigating errors.

We don’t sell personal information or use it for advertising.

If you are in the European Economic Area (EEA) or the United Kingdom, data protection law requires a legal basis for each way we use personal information. We rely on the following bases:

Contract

To provide FraudGuard under our Terms of Service, including checking your orders against your fraud rules and sending the emails described in this policy.

Legitimate interests

To keep FraudGuard secure and reliable, answer support requests and keep records of the stores that use our apps. We rely on these interests only where your rights don’t override them.

Legal obligation

To keep the records that tax and accounting law require, and to respond to lawful requests from public authorities.

For your customers’ information, you decide the legal basis, as explained under Controller and processor roles.

When FraudGuard processes personal information about your store’s customers, you are the controller of that information and Invizo is your processor. We process it only to provide FraudGuard, on your instructions.

For information about you as a merchant, such as your store details and the messages you send us, Invizo is the controller.

FraudGuard decides automatically, using the rules and risk threshold you set, whether to flag or cancel each new order. It cancels orders that reach your threshold without waiting for anyone to review them, and refunds and restocks them.

Because you choose the rules, you are responsible for how they affect your customers, and for telling customers that their orders may be checked and cancelled automatically, for example in your store’s privacy policy. If a customer disputes a cancellation, review the order yourself in Shopify.

When FraudGuard cancels an order, it emails the customer to say that the order was cancelled after a fraud check and that any payment has been refunded. The email comes from no_reply@invizo.io, includes the order number and is signed with your store’s name or its Shopify handle.

FraudGuard sends this email whenever an order is cancelled with fraud as the reason, including orders you cancel yourself, so a customer whose order FraudGuard cancels can receive it twice. Shopify’s own cancellation email is turned off for orders FraudGuard cancels.

We share personal information only with the sub-processors listed below, who help us run FraudGuard, and with services you connect to FraudGuard on your instructions. Those services’ own terms and privacy policies apply to them.

We may also disclose information when the law requires it, to protect the rights, property or safety of Invizo, our merchants or others, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply to your information.

FraudGuard’s servers are in Germany. Invizo is based in Bangladesh, and the team that runs and supports FraudGuard may access data from there. Your information may therefore be processed in countries whose data protection laws differ from those where you live.

Our sub-processors and their locations are listed under Sharing and sub-processors.

We keep your store’s data while FraudGuard is installed: records of the orders it checks, flags and cancels, your fraud rules and your settings. Our server logs can also contain details from your orders, such as customers’ email addresses and IP addresses. We keep basic records of your account, such as your store name, contact email, plan and install and uninstall dates, for as long as we need them for accounting, tax and legal purposes.

For what happens when you remove the app, see Deletion when you uninstall.

When you uninstall FraudGuard, it stops checking orders and we delete the access token Shopify gave us. The rest of your store’s data, including records of checked, flagged and cancelled orders, your blocked emails, domains and countries, and your settings, stays stored until you ask us to delete it. We delete it from our database within 30 days of your request.

To ask us to delete your information, email privacy@invizo.io.

We protect the information FraudGuard handles with these measures:

• Every webhook from Shopify is verified with Shopify’s signature before FraudGuard acts on it.
• The app’s settings and order screens open only after Shopify confirms who is signed in.
• Traffic between your browser, Shopify and FraudGuard is encrypted with HTTPS.

No way of storing or sending data is completely secure, so we can’t guarantee absolute security. If a security incident affects your data, we will tell you without undue delay and notify the authorities where the law requires.

If you think your account or data has been compromised, email privacy@invizo.io.

FraudGuard doesn’t set its own cookies, and it doesn’t use analytics, advertising cookies or tracking pixels.

The app runs inside your Shopify admin, which uses Shopify’s own cookies. Shopify’s privacy policy explains them.

The in-app support chat is provided by Crisp, which stores an identifier in your browser so your conversation carries over between pages. Crisp’s privacy policy explains how it handles this.

Depending on where you live and the laws that apply, you may have the following rights over your personal information.

European Economic Area and United Kingdom

If you are in the EEA or the UK, the GDPR and the UK GDPR give you the right to:

• Access the personal information we hold about you.
• Have inaccurate or incomplete information corrected (rectification).
• Ask us to erase your information (erasure).
• Ask us to restrict how we process your information.
• Object to processing based on our legitimate interests.
• Receive the information you gave us in a structured, machine-readable format, or have it sent to another provider (portability).
• Withdraw your consent at any time, where we rely on consent.
• Complain to a data protection supervisory authority, such as the one where you live or work.

California

If you are a California resident, the CCPA, as amended by the CPRA, gives you the right to:

• Know what personal information we collect, use and disclose, and get a copy of it.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information.
• Not be discriminated against for exercising these rights.

How to exercise your rights

To make a request, email privacy@invizo.io. We reply within one month. Before we act on a request, we may ask you to confirm it comes from you, for example by writing from your store’s contact email address.

If you shop at a store that uses FraudGuard

Please contact that store first. Stores can pass access and erasure requests on to us.

FraudGuard is a tool for businesses and isn’t meant for children. We don’t knowingly collect personal information from children for our own purposes. If you think we have, email privacy@invizo.io and we will delete it.

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If we make significant changes, we will also tell you by email or in the app before they take effect.

If you have questions about this policy or how we handle your information, contact Invizo: