FLINT Sentry Privacy Policy

FLINT Sentry is a Shopify app that helps merchants tell whether a checkout was placed by a person or by an AI shopping agent. It receives order data from Shopify through order webhooks when an order is created or paid.

The order data we process is metadata about the order and the checkout environment: the order id and name, financial status, order total and currency, note attributes, payment gateway names, source name, landing and referring pages, checkout token, and device signals such as the browser IP address and user agent. We store this in Google Cloud Firestore.

FLINT Sentry never receives or stores payment card numbers. We do not process or retain full card numbers (PANs), card verification values, or any cardholder data. Shopify handles payment card data inside its PCI compliant checkout and does not send it to us.

We record the result of each classification: whether the checkout was human, agent, or unrecognized automation, the detected agent platform, a confidence score, and the advisory verdict. Every AI classification call is logged with the model used, a hash of the input, the decision, and token counts, as operational evidence.

We use order metadata to classify each checkout and produce an advisory verdict of ALLOW, STEP-UP, REVIEW, or BLOCK. On paid plans, the verdict is written back to the order as a tag and a metafield so the merchant can see it.

FLINT Sentry is advisory. It tags orders and can alert the merchant. It never cancels or blocks an order on its own. The merchant decides what to do.

We use the data to operate the service and to improve our own agent detection and fraud models. We do not sell this data, and we do not use it to train third party or general purpose AI models.

Classification runs on Google Gemini models through the Google Cloud project that operates FLINT Sentry, hosted in a United States region. To classify a checkout, we send the order metadata described above to the Gemini API and receive a structured result.

Order metadata sent to the Gemini API is not used by Google to train its general models, per the Google Cloud and Gemini API terms. We store order records and decisions in Google Cloud Firestore, and we keep aggregate, non-identifying analytics in Google BigQuery to monitor accuracy and volume.

When a checkout is classified as an AI agent, FLINT Sentry asks the FLINT verification service at flint.network to check the agent's authority and issue a signed verification record. For this we send the shop domain, the order id, the transaction amount, and the agent's presented FLINT passport reference.

The signed verification record and its verdict are retained by FLINT as fraud evidence and to operate and improve FLINT's trust models. Agent passports are signed and publicly resolvable by design. FLINT Sentry stores a link to the verification record alongside the order verdict.

FLINT Sentry implements the mandatory Shopify privacy webhooks and honors them. When Shopify or a merchant sends a customer data request, we return the order data we hold that is associated with that customer. When Shopify or a merchant sends a customer redaction request, we delete the associated order records. When a shop is uninstalled or a shop redaction request is received, we delete the shop's data.

If you are a shopper and want to exercise a data right, please contact the merchant you purchased from, since they control the store. You can also contact us directly at the address below and we will assist.

Order metadata, classification results, and verdicts are retained while the app is installed on a store, and for a limited period afterward. We delete a store's data within 30 days of an app uninstall or a shop redaction request, and we delete customer specific order records on a customer redaction request.

FLINT verification records are retained by FLINT as fraud evidence under FLINT's own retention practices. To request deletion of data we hold, email us at the address below. We will confirm within 30 days.

If you are located in the European Economic Area, the United Kingdom, or California, you have the right to access, correct, or delete the personal data we hold about you. You may also object to or restrict certain processing, and in some cases request portability of your data.

To exercise any of these rights, contact us at contact@flint.network. We do not require you to create an account or pay a fee to make a data request.

FLINT is a fraud intelligence company and we take data security seriously as a matter of professional principle, not just compliance. Order data is stored in access controlled Google Cloud systems and encrypted in transit. We do not store payment card data, and we do not log sensitive credentials.

No system is perfectly secure. If you believe your data has been involved in a security incident, contact us immediately at contact@flint.network.

We may update this policy as FLINT Sentry evolves. The effective date at the top of this page reflects the most recent revision. Material changes will be reflected here and, where appropriate, communicated to merchants.

FLINT Sentry is operated by KillChain, Inc. d/b/a FLINT Network. For privacy questions or data requests, email contact@flint.network.