Heatrail

Fraud prevention disclosure

Version 8 — published 21 September 2026

What this page is

A shop you are buying from uses Heatrail, a fraud-prevention service shared by multiple online shops. This page explains what data is processed for that purpose and why. For the checks run at your checkout, Heatrail acts as a processor on behalf of the shop, which remains the controller of your data.

What is processed at checkout

Connection details kept as evidence

Alongside your IP address, the shop’s own server — where its Heatrail integration supports this — records the source port of your connection, its exact time (UTC, to the millisecond) and the address of the shop server that received it, and passes these to Heatrail with the check. Where an internet provider shares one IPv4 address among many subscribers, the address alone is often not enough for the provider to find a connection in its records, but the three values together are. They exist for one purpose: if a formal proceeding is opened about an order, the shop can hand that triple to the internet service provider, which identifies the subscription, not the person, within that proceeding.

The source port and connection timestamp are stored only as evidence and are never used to score or rate a purchase. They are deleted after 90 days unless the order is bound to a recorded fraud incident, and they leave Heatrail only inside an evidentiary report that a human operator has approved and sends by hand. This is server-side logging of a connection your browser makes anyway, and nothing is stored on or read from your device for it.

What is never sent

Heatrail never receives your name, postal address, payment details, the contents of your order, or your raw contact data — your e-mail address and phone number themselves stay with the shop.

Purpose and legal basis

This data is processed for fraud prevention only. The legal basis is legitimate interest in preventing fraud (GDPR Article 6(1)(f), and Recital 47 expressly recognises fraud prevention as a legitimate interest).

A shared fraud-prevention network

Heatrail is operated as a shared fraud-prevention network: the hashed identifiers and IP address from your checkout are checked against fraud signals contributed by other participating shops, and a shop that later confirms fraud on an order contributes that hashed trace back to the network. A pattern of confirmed fraud at one participating shop can therefore raise the advisory risk score another participating shop sees. The only output of this profiling is that advisory score and its reasons, shown to the shop’s staff — never an automatic decision (see below).

If a formal proceeding is opened

Merchants record incidents on their own orders only: a shop that was defrauded marks the order it processed itself, and nothing else. Confirmed traces are then linked in the network through the values they have in common — a hashed identifier, an IP address, a device characteristic. We state the consequence here rather than leave it implied: a trace recorded at one shop can meet a trace recorded at another shop inside a formal proceeding.

What that produces is a report, approved by hand by a Heatrail operator and sent by a person, which may state that other participating shops have recorded a confirmed fraud incident of their own on the same trace. Those shops appear in the report under a pseudonym that is regenerated for every incident, so two reports cannot be lined up against each other. Heatrail can resolve such a pseudonym back to the shop behind it, but only within a formal proceeding, only against a recorded case reference, and only where asking and approving are two separate, recorded steps. The resolution is itself written permanently into a log that cannot be altered afterwards.

We state the limit of that safeguard rather than let it be read as more than it is: the approving step is either a second operator in our console, or a single-use link sent to the account owner’s mailbox. Where Heatrail is run by one person, the second step is therefore that person’s mailbox, not a second person.

This does not identify anybody. Heatrail has no raw identity to hand over: e-mail addresses and phone numbers reach it only as irreversible two-stage hashes, and your name, postal address and payment details never reach it at all. The most such a report can do is show an investigator which other shop holds records of its own, and is therefore worth asking. What those records contain, and whether they may lawfully be requested, is decided inside the proceeding — not by Heatrail.

The report is also required to say what it cannot support. A connection observation that cannot be cross-checked is printed under an “UNCORROBORATED” heading with no address and no port. Where nothing corroborates a source port, the report says so in those words instead of leaving the gap silent.

No automated decisions by Heatrail

Heatrail returns an advisory risk score to the shop. Heatrail itself cannot block, delay, or cancel a purchase: the integration is fail-open, so checkout completes regardless of what Heatrail reports — or whether it responds at all. Any decision about your order — for example to hold or verify it — is made by the shop and its staff, not by Heatrail.

Merchant rules

A shop on Heatrail’s paid plan can set its own rules, for example about how many digital orders come from one address in a short time. When one of its rules matches, the shop can hold the delivery of a digital order, such as a gift card or a download, after you have paid. The shop then either asks you to confirm your e-mail address through a link it sends you itself, or has a member of its staff review the order. A review lasts at most 72 hours. If nobody has decided by then, the shop releases the order to you.

Heatrail records that a rule matched and how the hold ended (held, verified, released, cancelled, or registered by the shop as an incident) and deletes that record after 90 days. Heatrail never contacts you and never receives your e-mail address in clear. When you confirm an address, the shop tells Heatrail only that the address was confirmed, and Heatrail notes that against the hash it already holds. A purchase is never blocked. The rule, the hold and the decision about your order belong to the shop.

Retention

The checkout signals used for scoring — the hashes, your IP address, and the device and order characteristics — are deleted 90 days after the check, by an automatic daily job. Evidence of confirmed fraud may be retained longer where the law allows it (GDPR Article 17(3)(e)).

Three categories are kept longer than that, and we state it here rather than round it down:

Two further limits, for completeness: an entry in the fast in-memory risk cache counts towards a score for up to 400 days, at its full weight for the first 90 and then falling to a third of that weight by day 365, and it may remain physically stored beyond that until a sweep is added. And because encrypted database backups are kept for 7 days, a deleted record can persist in a backup for up to a week after deletion.

Your rights

You can exercise your GDPR rights — access, rectification, erasure, restriction, and objection — with the shop you bought from, which is the controller of your data and your single point of contact. The shop forwards any request that concerns Heatrail, and Heatrail assists the shop under a data-processing agreement.

If your question is about Heatrail itself rather than about your order, you can also write to privacy@heatrail.eu. We cannot action a rights request that reaches us directly — only the shop can identify you as its customer — but we will tell you where to send it. To report a security problem, write to security@heatrail.eu.

Sub-processors

Heatrail runs on Laravel Cloud on Amazon Web Services (EU-Central, Frankfurt), which provides the infrastructure and database. All data stays in the EU.

Change log