Privacy Policy
1. Information We Collect
SpamShield collects the following information to provide spam protection for your contact forms:
- Form submission data: Name, email, phone number, and message content submitted through protected contact forms.
- Technical data: IP addresses, user agents, and browser capabilities for spam detection.
- Account data: Email address and authentication credentials for dashboard access.
- Usage data: Feature usage, spam detection statistics, and dashboard interactions.
2. How We Use Your Data
- Analyzing form submissions to detect and block spam.
- Providing real-time spam detection dashboards and analytics.
- Sending notification emails for quarantined messages and weekly digests.
- Improving our spam detection algorithms (using anonymized, hashed data only).
3. Data Retention
You control how long we keep your data. Retention periods are configurable from 30 to 365 days in your Settings. After the retention period:
- Allowed messages are permanently deleted.
- Blocked/spam messages are anonymized (personal data removed, aggregate stats retained).
- Quarantined messages are auto-released after 30 days.
4. Global Spam Network
Spam campaigns target many stores at once, so SpamShield operates a Global Spam Network: when one store blocks a spammer, the signature helps protect every other store. When a submission is blocked as spam, SpamShield contributes an anonymized fingerprint of it — SHA-256 hashes of the sender's email address and IP address — to this network. No personal data, message content, or store identity is ever transmitted; only cryptographic hashes that cannot be reversed. The processing basis is our legitimate interest (and yours) in preventing spam and abuse across the network.
Contribution is on by default for new stores. You can turn it off at any time from the Global Spam Network section of your Settings; opting out stops all future contributions from your store.
5. Third-Party Services
- Anthropic (Claude AI): Message content may be sent to Claude AI for spam classification. Only the message text is sent, cached for 24 hours, then discarded.
- MaxMind GeoIP: IP addresses are resolved to countries for geographic spam detection. No personal data is shared with MaxMind.
- Brevo: Used for sending notification and digest emails.
- Stripe: Payment processing for web subscriptions. We do not store credit card numbers.
- Google and Meta: On SpamShield's own public website, Google tags may send cookieless measurement pings while optional storage is denied. Meta, advertising storage and personalisation remain blocked until you accept optional tracking. You can reject, accept, change or withdraw this choice using the persistent Cookie settings control. This does not change the no-CAPTCHA behaviour of the form-protection product installed on a merchant's site.
6. GDPR Compliance
SpamShield supports the following GDPR data subject requests:
- Data export: A customer data request (via Shopify or directly) assembles all data associated with that customer's email and delivers it to the store owner to forward on.
- Data deletion: All customer-specific data is anonymized with random identifiers.
- Shop deletion: Complete deletion of all shop data in a single atomic transaction.
7. Security
We protect your data with: HMAC-verified webhooks, bcrypt password hashing, encrypted connections (TLS), CSRF protection, rate limiting, and regular security audits. All secrets are stored as environment variables, never in code.
8. Behavioral metrics & bot protection
To distinguish humans from automated bots without using CAPTCHAs, SpamShield's form-protection script collects aggregate interaction metrics only — such as counts of mouse movements, key presses, scrolls, and focus changes, and the statistical variance of typing rhythm. It never records the content you type, your keystrokes, or your cursor coordinates. SpamShield also runs a privacy-preserving proof-of-work check in your browser to deter automated abuse; it sets no cookies and does not track you across websites.
9. Contact
For privacy inquiries, contact us at support@spamshield.dev.