Privacy Policy

Fraud Rules Guard, a Shopify app by McStan Apps. Effective August 2026.

Who we are

Fraud Rules Guard is operated by McStan Apps. If you have any question about this policy or your data, email us at mcstan.apps@gmail.com.

What data we collect

• Your shop's myshopify domain and the OAuth access tokens Shopify issues so the app can act on your store.
• The alert email address you choose in the app settings.
• Order data Shopify sends us by webhook when a new order is created: order id and number, customer email, customer IP address, billing and shipping country, and order total. We use it solely to evaluate the fraud rules you set up. We do not use it for anything else.
• The fraud rules you define (name, type, value, action).
• Rule match history: which order matched which rule and what action the app took, so the dashboard can show you what was caught.

Where and how long we store it

All data lives in a PostgreSQL database hosted on Fly.io in the EU (Amsterdam region). Incoming order data waits in a processing queue only until your rules have been evaluated; the order payload is deleted from the queue as soon as processing finishes. After that, the app keeps only the rule match record (order id and number, the matched rule, and the action taken).

We do not sell your data or share it with third parties. Email alerts are sent over SMTP to the alert address you configured, and to no one else.

GDPR and data deletion

The app implements Shopify's mandatory privacy webhooks:

• customers/data_request: we locate the data held for the customer. The app stores no customer profiles; the only customer-related data is the rule match history keyed by order id and any order payload still waiting in the processing queue.
• customers/redact: we delete the rule match records and any queued order data for the orders named in the request.
• shop/redact: sent by Shopify about 48 hours after you uninstall the app. We then delete everything stored for your shop: the shop record, tokens, alert email, rules, rule match history, and any remaining queued jobs.

When you uninstall the app, your access tokens are cleared right away and queued jobs are dropped. Your rules and match history are kept for the roughly 48 hours until shop/redact arrives, so they can be restored if you reinstall in that window.

Your rights

You can ask us at any time what data we hold about your shop, ask us to correct it, or ask us to delete it. Uninstalling the app triggers deletion automatically as described above. For anything else, email mcstan.apps@gmail.com and we will respond as quickly as we can.