1. Who we are
CheckoutGuard (“we”, “us”, “the App”) is a Shopify application that helps merchants monitor checkout-related order patterns and optionally apply configurable checkout validation rules. The App is operated under the Shopify Partner account associated with Formhouseai.
For buyer personal data on a merchant’s store, the merchant is the data controller. CheckoutGuard acts as a processor / service provider when processing limited order and security signals on the merchant’s instructions through the App.
2. Information we process
2.1 Merchant and shop account
- Shop domain and installation metadata
- Shopify session / authentication tokens and staff identifiers needed to operate the embedded Admin app
- Billing plan and subscription status via Shopify App Pricing
- Merchant configuration (protection rules, alert settings, retention, sensitivity)
- Support correspondence you send to us
2.2 Order and security analytics
When monitoring is enabled, we process minimized order signals derived from Shopify webhooks (for example orders/create), including:
- Order timestamps, totals, and currency
- Line item variant identifiers and quantities
- Optional country / delivery context when available
- Optional customer order-count signals when provided by Shopify
- Pseudonymous buyer identifiers produced with HMAC (we do not retain raw buyer email or phone for analytics)
- Security events, incidents, scores, and audit logs scoped to the installing shop
2.3 What we do not store
- Payment card numbers, CVV, or payment credentials
- Raw customer emails or phone numbers for long-term analytics (hashed at ingest)
- Full webhook bodies indefinitely
Checkout validation runs on Shopify infrastructure via Shopify Functions. Cart data used at checkout time is not sent to CheckoutGuard servers during checkout.
3. How we use information
- Provide monitoring, explainable detection signals, incidents, and alerts
- Sync merchant-configured validation settings to Shopify
- Operate billing and plan entitlements
- Secure, debug, and improve the service
- Comply with Shopify mandatory privacy webhooks and applicable law
We do not sell personal data. We do not use buyer data to build independent advertising profiles.
4. Legal bases (where GDPR / UK GDPR applies)
Merchants determine the lawful basis for processing buyer data on their storefronts. We process that data as a processor on merchant instructions to deliver the App. For merchant account and operational data, we rely on performance of a contract and legitimate interests in operating, securing, and improving CheckoutGuard.
5. Retention
Default security-event retention is up to 30 days, subject to plan visibility windows and merchant retention settings (within product limits, typically 1–90 days). After uninstall, shop-scoped data is deleted or anonymized according to Shopify’s shop/redact compliance lifecycle and our retention schedule.
6. Sharing and subprocessors
We share data only as needed to operate the App:
- Shopify — platform authentication, webhooks, billing, and checkout validation
- Vercel — application hosting
- Neon — managed Postgres database
- Email delivery provider (when configured, e.g. Resend) — merchant alert emails
A current subprocessor list is available on request via support.
7. International transfers
Infrastructure may process data in regions outside the merchant’s country. Where required, we rely on appropriate safeguards (such as standard contractual clauses) and provider agreements.
8. Your rights
Merchants: You may request access, correction, or deletion of merchant account data related to CheckoutGuard by contacting Mikkelbeier@hotmail.com. You may also uninstall the App at any time.
Buyers / end customers: Contact the merchant first. Merchants can use Shopify’s customer privacy tools. We respond to Shopify compliance webhooks (customers/data_request, customers/redact). Because buyer identifiers are pseudonymized, exports describe hashed signals rather than raw contact details.
9. Security
We use industry-standard practices including HTTPS, access controls, secret management, shop-scoped data isolation, and HMAC pseudonymization. No method of transmission or storage is completely secure.
10. Children
CheckoutGuard is a B2B merchant tool and is not directed at children.
11. Changes
We may update this Privacy Policy. Material changes will be posted on this page with an updated “Last updated” date. Continued use of the App after changes constitutes acceptance of the updated policy where permitted by law.
12. Contact
Privacy and support: Mikkelbeier@hotmail.com
Product: CheckoutGuard · Operator: Formhouseai (Shopify Partner)