CardFence

Privacy and data

CardFence processes personal data, IP addresses and email addresses, for one purpose: protecting the store's checkout from fraud. Under GDPR that generally rests on the store's legitimate interest in preventing fraud (Recital 47). Your own privacy policy should say so. Suggested text is added under Settings → Privacy → Policy guide.

What is stored

Data Why Kept for
IP address (IPv6 per /64) and email used for each checkout attempt and failed payment Rate limits, failure limits, the activity log 30 days on the free plan (configurable up to 365 days in Pro). Deleted daily after that.
Blocked IPs and emails Temporary blocks Until the block expires, then cleared daily
An order flag (_cksh_suspect) and order note Marks card-testing orders As long as the order exists
Cookie cksh_sid on cart and checkout pages Confirms that orders come from a real browser The browser session

The cksh_sid cookie is strictly necessary for security, so it doesn't need consent under the ePrivacy rules. It is HttpOnly, contains only a random ID and is never used for tracking.

External services

CardFence only talks to an outside service if you set one up:

Service When What is sent
Cloudflare Turnstile Only once you enter Turnstile keys. By default only during attack mode. The visitor's browser loads Cloudflare's script on checkout, order-pay and add-payment-method pages. Your server sends the challenge response, your secret key and the buyer's IP to Cloudflare to verify it. Terms · Privacy · Turnstile privacy addendum
Your webhook (Pro) Only if you enter a URL Alert messages: site name, site URL, event and (for block alerts) the blocked IP or email.
Freemius Licensing and updates of the premium version, opt-in usage data, checkout See Freemius terms and privacy. If you skip the opt-in, nothing is sent until you activate a license or upgrade.

The country rule (Pro) never calls a geolocation service. It uses Cloudflare's header or WooCommerce's local MaxMind database.

Data-subject requests

The activity log and blocks are included in WordPress's privacy tools:

  • Tools → Export Personal Data: exports every logged event for that email address.
  • Tools → Erase Personal Data: deletes those events and any block on that email.

Uninstalling

Deleting the plugin removes:

  • its tables
  • its settings
  • its scheduled tasks
  • the order flags it added

Orders themselves are never deleted.