Last updated: March 22, 2026
TrialShield ("we", "us", "our") is committed to protecting the privacy of our customers and the end-users whose data is processed through our API. This Privacy Policy explains what data we collect, how we use it, and your rights.
When you create an account, we collect your email address and password (hashed). This data is stored in our authentication provider (Supabase) and is used solely for account access.
When you send requests to the TrialShield API, we process the following data about your end-users:
If you enable the Stripe integration, TrialShield receives webhook events from Stripe containing card metadata. We store:
We never store full card numbers, CVCs, or expiration dates. All card fingerprints are hashed before storage.
All data processed through the API is used exclusively for:
We do not sell, share, or transfer end-user data to any third parties. Data is only used within the context of your TrialShield account.
TrialShield follows a strict data minimization policy. All personally identifiable information (PII) — including email addresses, IP addresses, phone numbers, device fingerprints, and card data — is hashed using SHA-256 before being stored in our database. We do not store raw PII. This means that even in the event of a data breach, the stored data cannot be used to identify individuals.
TrialShield is designed to be fully compliant with the General Data Protection Regulation (GDPR). We act as a Data Processor on behalf of our customers (the Data Controllers).
We provide a dedicated DELETE endpoint for GDPR-compliant user data deletion. Customers can programmatically delete all data associated with a specific end-user from our database by calling:
This endpoint permanently removes all risk events, identity anchors, payment fingerprints, device data, and any other records associated with the specified user. The deletion is irreversible and takes effect immediately.
End-users can request access to the data TrialShield holds about them through their service provider (our customer). Customers can retrieve user data via the API and provide it to the requesting individual.
Customers can export their data at any time through the TrialShield API. All data is available in standard JSON format.
TrialShield processes data under the "legitimate interest" legal basis (Article 6(1)(f) GDPR) — specifically, the legitimate interest of preventing fraud and abuse. Our customers are responsible for ensuring they have the appropriate legal basis to share end-user data with TrialShield.
For California residents: TrialShield does not sell personal information. We process data solely for the purpose of fraud detection on behalf of our customers. California residents may exercise their rights under the CCPA by contacting us or their service provider.
Risk evaluation data is retained for 90 days by default, after which it is automatically purged. Customers can request immediate deletion at any time using the DELETE endpoint described above. Account data is retained for the duration of the account and deleted within 30 days of account closure.
We implement the following security measures:
TrialShield uses the following third-party services:
We do not share end-user evaluation data with any of these providers. They only process customer account and billing data as needed for their services.
TrialShield uses only essential cookies required for authentication and session management. We do not use tracking cookies, analytics cookies, or advertising cookies.
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top reflects the most recent revision.
For privacy-related questions, data deletion requests, or to exercise your rights, contact us at tomas@trialshield.dev.