Privacy Policy

Different roles apply to different activities.

Where we act as your processor, this policy and our Data Processing Addendum (available on request from [email protected]) set the terms. For California law, we act as your service provider for visitor and customer data.

4.1  Merchants and store staff

• Store details from Shopify: store name, store email, customer-facing email, store domain and myshopify.com address, currency and money formats, Shopify plan name.
• App account: your Kedra Shield plan and subscription status (from Shopify Billing), trial, introductory-offer and promotion history, whether you've unsubscribed from marketing emails, and your app language.
• Your settings and rules: IP addresses and ranges, network (ASN) numbers, countries and cities, referring domains, user-agent patterns, Product Blocker rules, checkout rules (these can contain customer email addresses or postcodes you enter), private notes on rules, and block-page design. You can add rules by hand, by CSV import, or by approving Shield Assistant suggestions.
• Block-page logo: uploaded to your own Shopify Files.
• Shield Assistant messages: what you type and a summary of your Shield setup, which can include up to three IP addresses from your IP block rules. These are sent to our AI provider (Section 17); we don't store the conversation.
• Support chat: your store ID, store domain, Kedra Shield plan and support tier. When chat identity verification is on, also your store name and store email. Plus the messages and files you send.
• Email records: the domain part of the address we emailed (e.g. example.com), the email type, and whether sending worked. If an email bounces or you unsubscribe, the domain and the reason.
• Admin session: a Shopify session identifier used to sign you in to the app.

We do not collect store staff names or emails, the store owner's phone number or postal address, or payment card details.

4.2  Storefront visitors

When the Kedra Shield app embed is on, it runs on store pages for every visitor (some recognised crawlers are skipped, see 4.4). With each visit we receive:

• IP address.
• Information about the IP address from ProxyCheck.io (and Cloudflare for country): approximate location (country, city); network (ASN, internet provider, network type); whether it is a VPN, proxy, Tor exit, hosting provider or compromised; risk and confidence scores; recent attack history; VPN operator name; and when it was first and last seen as risky.
• Browser and device type. We work out device type, browser and operating system from the browser's user-agent string. The full string is sent but not stored.
• Referring website. The full referrer is sent; only the domain is stored.
• Page visited: page address, page type and page handle.
• A random session ID from the __kedra_session cookie (Section 13). It is stored with each visit record but not currently used for blocking or shown in the dashboard.
• The decision: allowed or blocked, and the rule that matched.

Pro stores only:

• Automation signals: a 0-100 "bot score" from signs of browser automation, such as the navigator.webdriver flag, automation-tool markers, or a headless browser.
• Behavioral Insights (off by default; the merchant turns it on): a 0/60/90 "interaction" score based on whether the mouse or keyboard was used, whether clicks land exactly at an element's centre, and how quickly address, card or phone fields are filled. For those fields we check only whether a value is present and at least 3 characters long. We never read, store or send what is typed. This score is for analytics only and never blocks anyone.
• Velocity limits (off by default): the number of page loads from the same IP address on the store in a 10-second window.
• Shared reputation signal (on with Pro threat protection): when a Pro store blocks a visit because the IP address is compromised or linked to attacks, we record a "bad actor" count against a hashed (salted SHA-256) version of that IP address. Other Pro stores' threat protection uses this count as a score for up to 14 days. Other stores receive only the score, never the IP address or which store reported it.

Store Health (all stores): on allowed visits, the app embed checks the page for the domains of third-party scripts and for fields that look like card-number fields (by field attributes such as name or label, never by value). It sends these with the page path, so we can warn the merchant about unexpected scripts or fake payment forms. No visitor identifier is stored with these reports.

In the browser only: the visitor's time zone helps location rules when the country is unknown. It is not sent to us.

4.3  Customers who place orders

• Risky orders. When Shopify assesses an order's risk as anything other than "none", we fetch and store the order number and ID, the customer's email address and browser IP address, the order total, payment status and order date, and Shopify's risk recommendation. We use these to show the merchant a fraud-review list. We don't fetch customer names, phone numbers, addresses or order items.
• Auto-block (Pro, off by default): if the merchant turns this on and the order's risk score meets their threshold, the order's IP address becomes an IP block rule, labelled with the order number and risk score.
• Checkout validation: at checkout, Shopify passes our checkout function the buyer's email, delivery and billing first and last names, and country and postcode, so it can apply the merchant's checkout rules. The function runs inside Shopify: this data is not sent to us or stored by us.
• Checkout verification token: when the merchant uses the Fake Checkout Blocker, the app embed adds a cart attribute _kedra_ct. It holds a timestamp and a signature, with no personal data, and appears on the order.

4.4  Bots and automated traffic

Automated traffic is handled like any other visit (4.2). Recognised search-engine and social-media crawlers are always allowed, identified by user-agent:

• Google's crawlers, Bingbot, Facebook's link preview, Lighthouse and Pingdom are skipped entirely: no IP lookup, cookie or visit record.
• Other recognised crawlers (for example Meta's other crawlers, Applebot, DuckDuckBot, YandexBot, Baiduspider, LinkedInBot, Twitterbot, AhrefsBot and SemrushBot) are allowed without a ProxyCheck lookup. If they run JavaScript, they get the session cookie and a visit record like other visits.

You can object to processing based on legitimate interest (Section 11).

Shield's checks run automatically in the visitor's browser on every page load, using the merchant's rules and IP information from our API. They run in a fixed order and the first rule that matches decides. The checks are rule-based: there are no machine-learning models.

What can trigger a block

Each item is configured by the merchant unless noted.

• IP address or range rules, including IP addresses auto-blocked from risky orders
• Country and city rules
• Product Blocker rules (country × product or collection)
• Network (ASN), user-agent and referrer rules, including optionally blocking visits with no referrer
• Tor
• Threat protection (Pro). It blocks when the IP is flagged as compromised, has 5+ recent attacks, or its combined risk reaches the chosen level (Conservative, Balanced or Strict). The combined risk is ProxyCheck's risk score plus up to 20 points from the bot score and up to 20 from the shared reputation signal. Mobile networks and Apple iCloud Private Relay are exempt, and business VPNs are exempt by default.
• Automation detection and velocity limits (optional)

Defaults

• On the Free plan, nothing is blocked until the merchant adds rules.
• On Pro plans, threat protection is on at "Balanced" by default. The merchant can change the level or turn it off.
• Recognised search and social crawlers are always allowed.
• If our API is unreachable or slow (over 5 seconds), the visitor is let through.

What a blocked visitor sees

• The merchant's block page. Default text: "Oops! Restricted Area - It seems like you don't have the necessary permissions to access this content."
• Or a redirect to a page the merchant chose.
• At checkout, a message such as "We're unable to ship to this address." or "Your session couldn't be verified. Please return to the store, refresh the page, and try checking out again."
• The block page does not show the reason for the block.

8.1  Service providers (sub-processors)

8.2  Other recipients

• The merchant whose store you visited. Merchants can view their store's visitor log (last 60 days), including IP addresses, and export up to 50,000 rows as CSV or JSON. They can also see the email and IP address of risky orders.
• Visitors' browsers. So that blocking can run in the browser, the store's Shield configuration, including the merchant's IP block rules, is included in the store's pages. For IP rules created automatically from risky orders, this currently includes the order number and risk score in the rule's description. Private rule notes are not included.
• Other Pro stores receive only the shared reputation score (Section 4.2).
• Authorities or advisers when the law requires it or to protect our rights.
• A successor business if Kedra is sold or merged, under terms at least as protective as this policy.

We do not sell personal data or share it for cross-context behavioural advertising, and we don't work with data brokers or advertising networks.

We are based in Lithuania (EU). Some providers process data outside the EEA: Cloudflare's global network, ProxyCheck's servers in Canada and Singapore, Anthropic in the United States, Gadget (Canada and the United States), and Telegram. Email (AWS) and our support system (Google Cloud) are hosted in the EU.

Where data leaves the EEA, we rely on the European Commission's adequacy decisions where they exist (for example for the UK and Canada). Otherwise, we rely on the Standard Contractual Clauses included in our providers' data processing terms where they offer them. Cloudflare's Data Processing Addendum includes the EU Standard Contractual Clauses and the UK Addendum. Telegram is used only for our internal support notifications and does not offer a data processing agreement.

You can request more information about transfer safeguards at [email protected].

When you uninstall

• We immediately delete your IP, network and referrer rules, checkout rules, risky-order records, order-action audit records, Store Health findings and email logs, and we reset your settings.
• A copy of your Shield configuration that we saved in your Shopify store's own data (settings and enabled rules, including IP block rules) may remain there. Uninstalling removes our access, so we can't delete it.
• The other items above follow the periods in the table.

11.1  GDPR / UK GDPR (EU, EEA, UK)

11.2  California (CCPA / CPRA)

You have the right to know what personal information we collect and why, to have it deleted or corrected, and not to be discriminated against for using your rights. You can use an authorised agent. We do not sell or share personal information and have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics.

11.3  Other US states and other countries

Residents of other US states with privacy laws have similar rights, and in several states the right to appeal: reply to our response with "Appeal" in the subject line. Laws elsewhere (Canada, Brazil, Australia, Singapore and others) give similar rights.

11.4  How to use your rights

This is what our handlers do today for Shopify's three mandatory privacy webhooks:

Shopify signs these webhooks. Our app platform (Gadget) receives them and runs the handlers above as soon as each one arrives.

13.1  On the storefront (set by the Kedra Shield app embed)

13.2  In the Shopify admin (the app)

• Local storage: cw_token_kedrashield (support chat conversation), and small preference keys that remember dismissed notices and open panels: kedra-intro-offer-dismissed, kedra-tracking-notice, kedra-app-tracking-notice-acknowledged, kedra_health_how_open, kedra_health_resolved_open.
• Session storage: kedra_review_attempted_<store> and kedraShield.setupStep.<store>.
• The support chat widget (Chatwoot) may set its own cookies, and Shopify's App Bridge sets Shopify's.
• The app uses no analytics or advertising trackers.

These are the protections we have in place:

Payments are handled by Shopify; we never receive card details. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

Kedra Shield is a business tool for Shopify merchants and is not directed at children. Our merchant customers must be adults acting for a business.

On a merchant's storefront, Shield screens every visitor on the merchant's behalf, whatever their age, and does not try to identify children. We don't knowingly collect personal data from children under 16 for our own purposes. If you believe a child's data has been provided to us, email [email protected].

• Tell your visitors. Mention Kedra Shield in your store's privacy policy (suggested text below).
• List our cookie and storage (Section 13.1) in your cookie notice. Shield doesn't read your consent banner today, so they are set for every visitor while the app embed is on.
• Use lawful rules. Make sure your blocking rules follow the laws that apply to you, for example the EU Geo-blocking Regulation if you block countries inside the EU.
• Only upload data you're allowed to use, such as IP lists and customer emails in checkout rules.
• Remember that IP block rules are visible in your storefront's page source. IP rules created from risky orders currently include the order number and risk score. Don't put information you want to keep private in a rule; private rule notes are not published.
• Handle visitor requests, and forward to us any you need help with.
• Request our Data Processing Addendum from [email protected] if you need one.

Suggested text for your privacy policy

• Shield Assistant uses Anthropic's Claude models to turn your requests into suggested settings. We send Anthropic your message, the options you pick, whether you're on a Free or Pro plan, and a summary of your setup:
  • setting switches and counts;
  • 7-day traffic totals, top countries, network names and referring domains;
  • fraud-order counts and the top countries of risky orders;
  • app-embed status;
  • for some requests, up to three IP addresses from your IP block rules.
  We do not store your conversation. Anthropic processes this data for us and, by default, deletes it within 30 days (longer only if flagged for a policy violation). It does not use it to train its models. The Assistant can only suggest changes; nothing changes until you approve it.
• Support chat: our support bot uses Anthropic to draft replies and to describe images you attach.
• Blocking decisions don't use AI or machine learning. They are rule-based and use third-party risk scores (Section 7).
• We don't use any merchant, visitor or customer data to train AI models.

When we change this policy, we update the "Updated" date at the top. If a change materially affects how we use personal data, we'll tell merchants by email or in the app before it takes effect. Version 2.0 replaces the earlier Kedra Shield policy published on our previous website.

This policy is governed by the laws of the Republic of Lithuania, without regard to conflict-of-laws rules. Nothing in it limits rights you have under mandatory law where you live, including the right to complain to your local supervisory authority.

You can complain to the State Data Protection Inspectorate of Lithuania (VDAI, vdai.lrv.lt) or to your local authority: EEA edpb.europa.eu, UK ico.org.uk, California cppa.ca.gov. We'd appreciate the chance to resolve your concern first.