Who we are
Dylan Ralston, doing business as ShopGrowth ("ShopGrowth", "we", "us") builds apps for Shopify merchants, including Interceptor, a fraud and reseller screening app. This policy explains what personal data we handle when a merchant installs one of our apps, when we screen that merchant's orders, and when anyone visits https://shopgrowth.ai.
For data about a merchant's customers, the merchant is the controller and we act as their processor: we handle that data only to provide the app, on the merchant's instructions, under the data processing terms in our terms of service. For data about merchants themselves and visitors to our website, we are the controller.
What we collect
From merchants
- Your store's Shopify domain, the app's access token for your store (encrypted with AES-256-GCM), and the scopes you approved.
- Your plan and billing status, as Shopify reports it. Shopify bills you; we never see your payment details.
- Your app settings, such as your blocklist, your flag action and tag, and your repeat-order threshold.
- Your decisions on flagged orders (fraud or not fraud) and your onboarding progress.
- Your store's profile from Shopify: store name, store email, Shopify plan, country, currency, time zone and domain. We use it for support, to show times in your time zone, and to send you the app's emails.
- Your email preferences for each app, and whether you joined the ShopGrowth news list. Each app's emails can be turned off on their own, from the link in every email; the news list is opt-in.
- Anything you send us when you contact support.
About your customers, from your store's orders
To screen an order, Interceptor reads it from Shopify and keeps a slim copy with only the fields its checks use:
- order number, date, total and currency, sales channel, and whether it was a test order;
- the customer's name, email, phone, Shopify customer ID and order count;
- shipping and billing addresses;
- payment details as Shopify provides them: card brand, the first six digits, the masked number with the last four digits, cardholder name, and the address and CVV check results (never the full card number);
- the browser IP address on the order and Shopify's own fraud-risk assessment.
If you use Shopify Payments, Interceptor also records each payment dispute (chargeback or inquiry) on your orders: the order, the amount, the bank's reason, the status and deadlines, and the customer's name, email and shipping address, so it can flag that customer's future orders and let you block them.
For checks that look back over time, such as several people shipping to one address, Interceptor also stores fingerprints: keyed one-way hashes (HMAC-SHA256) of the shipping address, recipient name, email and card. The key differs per store, so a fingerprint cannot be turned back into the original text and cannot be matched across stores.
From website visitors
Our website sets no tracking or advertising cookies and runs no analytics. Our hosting provider keeps standard server logs (such as IP address, browser and the page requested) for security and reliability.
How we use it
- To screen your orders and flag the suspicious ones, tag them and hold their fulfillment as you configured, and show you why.
- To run history scans you start or buy, which report on past orders without changing them.
- To show you which customers filed chargebacks, flag their future orders, and hold or block them when you choose.
- To bill you through Shopify, provide support, and keep the apps secure and working.
We do not sell personal data, use it for advertising, or combine one store's data with another's. A customer you block, or an order you mark fraud, only affects your own store.
AI look-alike checks
When an order's email, name or address is close to, but not the same as, one on your blocklist or on an order you marked fraud, Interceptor asks an AI model (Anthropic's Claude) whether they belong to the same person. The request contains only the two values being compared, for example two email addresses. It contains no order totals, payment details or other customer data. Anthropic does not use this data to train its models.
How long we keep it
| Data | Kept for |
|---|---|
| Slim copies of orders that were not flagged | 30 days |
| Flagged orders, the reasons, and your decisions | While the app is installed, so past fraud keeps protecting you |
| Payment disputes (chargebacks and inquiries) | While the app is installed, so past chargebacks keep protecting you |
| Address, name, email and card fingerprints | Up to 12 months |
| History scan reports and the suspicious orders they list | Up to 12 months |
| Your settings and blocklist | While the app is installed |
| Records of privacy requests from Shopify | As long as needed to show we handled them |
Deletion
- When you uninstall, we stop screening and delete your store's fingerprints straight away. Shopify then sends a request to erase your store's data (about 48 hours later), and we delete everything we hold for your store in that app.
- When a customer asks to be erased, Shopify passes the request to us and we delete that customer's orders, flags, scan findings and fingerprints automatically. Entries you typed into your own blocklist stay as you wrote them; you can remove them in the app's settings.
- When a customer asks for their data, Shopify passes the request to us; we log it and send you what we hold within 30 days so you can answer them.
Who processes it for us
We use these service providers. Each is bound by a contract that protects the data and limits its use to providing their service.
| Provider | What for | What data | Where |
|---|---|---|---|
| Shopify | The platform the apps run on: install, billing, order data, and the tag and hold actions | Store and order data, under the merchant's own Shopify agreement | Global |
| Vercel | Hosting the app and website | Requests passing through, including order data in transit | United States |
| Supabase | Our database | Everything we store, as described in this policy | United States |
| Inngest | Background job queue (screening runs after Shopify's webhook) | Shop domains and order IDs only, no customer details | United States |
| Resend | Sending our emails to merchants (reminders and alerts about their store) | The store's email address, the store name and the email itself (order numbers, never customer details) | United States |
| Anthropic | AI look-alike check | Only the two values being compared (two emails, two names or two addresses), with no other order or customer data. Not used to train models | United States |
We will update this list before adding a provider that handles your store's data.
International transfers
Our providers store and process data in the United States. Where the law requires it, such as for data from the EU, UK or Switzerland, transfers rely on the providers' Standard Contractual Clauses or an equivalent safeguard.
Security
Data is encrypted in transit and at rest, store access tokens are encrypted separately, and access to production data is limited to the people who need it. See security and incident response for details, including how we tell you about a breach.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to or restrict how we use it. Merchants can contact us at privacy@shopgrowth.ai. If you are a customer of a store that uses our apps, please contact that store first: they control your data and can ask us to act on it. You may also complain to your local data protection authority.
Children
Our apps are for businesses. We do not knowingly collect data about children beyond what appears on a store's orders.
Changes
If we change this policy in a way that matters, we will update the date at the top and tell installed merchants in the app or by email before the change takes effect.
Contact
Dylan Ralston, doing business as ShopGrowth. Privacy questions: privacy@shopgrowth.ai. Everything else: support@shopgrowth.ai.