Privacy Policy

Deadbolt (“the App”), operated by Lucency (“we”, “us”), is a Shopify app that blocks card-testing fraud before checkout. This policy explains what data the App processes, why, and how it’s protected. Questions: support@lucency.dev.

What we process and why

To detect and block card-testing fraud, the App processes a small amount of order and checkout data:

• Customer email address — the email pattern is the primary signal of card-testing attacks.
• Order country (billing/shipping) — used for optional geography-based rules.
• Cart/order value and contents — tiny order values are a fraud signal.

We process this data only to identify and block fraudulent orders on behalf of the merchant who installed the App. We do not sell, rent, or share it with third parties, and we do not use it for advertising or profiling.

What we store

When the App flags an order, it records a block event so the merchant can see what the firewall caught: the email, country, matched rule, outcome, order value, and timestamp. This is shown to the merchant inside the App’s activity log. The App also stores the standard Shopify session/installation data needed to run.

Where it’s processed

Data is processed on our hosting infrastructure and within Shopify’s own checkout pipeline (the validation function runs inside Shopify and cannot transmit data externally). We access Shopify’s Protected Customer Data (email, address) only as approved by Shopify and only for the fraud-detection purposes described above.

Retention and deletion

• Customer deletion — when a merchant or Shopify sends a customer redaction request, we delete the stored block events associated with that customer’s email.
• Shop deletion — when a merchant uninstalls the App, all of that shop’s stored data is deleted (Shopify sends this request 48 hours after uninstall).
• Data requests — we respond to customer data-access requests forwarded by Shopify.

These are handled automatically via Shopify’s mandatory compliance (GDPR) webhooks.

Merchant responsibilities

The merchant who installs the App is the data controller for their customers’ data. The App acts as a data processor on the merchant’s behalf, processing only what’s needed to provide fraud protection.

Changes

We may update this policy; material changes will be reflected by the “last updated” date above.

Contact

Lucency — support@lucency.dev

Deadbolt is a Shopify app operated by Lucency.