Data Processing Agreement

Last updated: October 15, 2026

1. Introduction

This Data Processing Agreement ("DPA") is between you, the merchant customer ("Customer"), and Fraud Pulse Ltd("FraudPulse", "Processor", "we", "us", or "our"). It forms part of the Terms of Service and applies when FraudPulse processes Personal Data on Customer's behalf in connection with the Service.

By creating an account, connecting a data source, or otherwise using the Service, Customer agrees to this DPA. If Customer has a separately signed DPA with Fraud Pulse Ltd, that signed DPA controls to the extent of any conflict.

2. Roles

For Personal Data of Customer's personnel and account users, and for website visitors, FraudPulse acts as an independent controller as described in the Privacy Policy.

For Personal Data of Customer's end customers and other individuals that appears in transaction, order, dispute, or chargeback records Customer sends to FraudPulse ("Customer Personal Data"), Customer is the controller (or a processor for its own merchant customers) and FraudPulse is the processor (or sub-processor). Under the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), FraudPulse is a service provider / contractor for that Customer Personal Data.

3. Subject matter and purpose

FraudPulse processes Customer Personal Data solely to provide, maintain, secure, and improve the Service: connecting Shopify, Stripe, or Adyen (or CSV uploads), analysing transactions and disputes, and ranking recommended changes in Customer's existing tools (including Stripe Radar, Shopify Flow, Blockify, and Adyen RevenueProtect). FraudPulse does not replace those tools, does not take over checkout, and does not sell Customer Personal Data.

Processing lasts for the term of Customer's subscription or usage, plus the export window described in the Terms, except where law requires longer retention.

4. Categories of data

Customer Personal Data typically includes:

  • Identifiers that payment or commerce platforms include with orders and disputes (for example email, IP address, order or customer IDs)
  • Transaction and dispute records (amounts, timestamps, status, reason codes, and related metadata)
  • Technical and device metadata if supplied by the connected platform

Data subjects are primarily Customer's buyers and other individuals whose details appear in those records, and Customer's authorised users of the Service.

FraudPulse does not process or store full payment card numbers (PAN). Card acceptance remains on Shopify, Stripe, Adyen, and Customer's own checkout and fraud tools.

5. Customer instructions

FraudPulse will process Customer Personal Data only on documented instructions from Customer, including this DPA, the Terms, product settings, and API or integration configuration, unless required to do otherwise by applicable law. Customer warrants that it has a lawful basis to send Customer Personal Data to FraudPulse and to instruct this processing.

6. Confidentiality and security

Personnel who process Customer Personal Data are bound by confidentiality. We implement industry-standard technical and organisational measures, including encryption in transit and at rest, access controls, and regular security reviews, as described in the Privacy Policy. Customer is responsible for the security of its own accounts, credentials, and connected platform permissions.

7. Sub-processors

Customer authorises FraudPulse to use sub-processors to host, operate, bill, and support the Service. Current sub-processors that may process Customer Personal Data or related account data include:

  • Google Cloud / Firebase — application hosting and infrastructure (including Cloud Run in us-central1)
  • Paddle — Merchant of Record and payment processing for FraudPulse subscriptions
  • PostHog — product and website analytics

We will keep this list updated on this page. For a material addition that will process Customer Personal Data, we will provide notice (including by email to the account contact where we have one). Customer may object on reasonable data-protection grounds; if we cannot accommodate the objection, Customer may terminate the affected Service as set out in the Terms.

8. International transfers

Customer Personal Data may be processed in the United States and other countries where FraudPulse or its sub-processors operate. Where a transfer from the EEA, UK, or Switzerland requires a transfer mechanism, FraudPulse will use appropriate safeguards, including the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable.

9. Assistance, breaches, and deletion

Taking into account the nature of processing, FraudPulse will assist Customer with data subject requests, DPIAs, and consultations with supervisory authorities, at Customer's reasonable request. Extensive assistance beyond the self-serve product may be charged at a reasonable rate.

FraudPulse will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help Customer meet its own notification duties.

On termination, Customer may export data during the window in the Terms (90 days). After that window, FraudPulse will delete or anonymise Customer Personal Data in its production systems, except copies retained as required by law or in encrypted backups until they cycle out.

10. Audits

Upon written request no more than once in any 12-month period (unless a competent authority or a confirmed personal data breach reasonably requires more), FraudPulse will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation. On-site audits, if required and not replaceable by that documentation, are at Customer's cost unless they reveal a material breach of this DPA by FraudPulse.

11. CCPA / CPRA

FraudPulse will not sell Customer Personal Data, share it for cross-context behavioural advertising, or retain, use, or disclose it except as needed to provide the Service, as permitted by the CCPA for service providers, or as otherwise permitted by this DPA and applicable law. FraudPulse will not combine Customer Personal Data with personal information from other sources except as permitted for a service provider.

12. Liability

Liability arising under this DPA is subject to the limitations and exclusions in the Terms of Service, including the cap on liability, except where applicable law does not allow those limits.

13. Contact

For questions about this DPA or to request a signed copy for Enterprise, contact support@fraud-pulse.com.