Last updated 25 October 2026
Spambuster is a form-spam prevention service operated by JOLA
(jola.com.au). It checks form submissions on your
website with Google reCAPTCHA and its own checks, so bots and unwanted sales pitches
can be stopped before they reach you. This policy describes what the Spambuster
service (prod.spambuster.app) receives from sites that install our
Shopify app or WordPress/WooCommerce plugin.
/pages/contact, never the part after a ?)To catch spam that a person or a real browser sends (sales pitches, scams, link drops, throwaway inboxes), your form also sends the message (its first 2,048 characters), the name, the email address and the page's language with its check.
Our server reads them in memory, at that moment, and does not store them
(unless the message was stopped and your store keeps stopped messages, below).
They are never written to our logs. We keep only the results with the
submission's verdict: which checks matched, how many links there were, the language,
the email's domain (for example gmail.com) and the address's one-way
fingerprint.
If you'd rather your forms didn't send these, email us at contact@jola.com.au and we'll turn the message check off for your store. Then the message, name and email are not sent for it. If you set blocked words or languages, or put email addresses or domains on your lists, the message or address is still sent for that one rule, checked the same way, and not stored.
On blog comments, older versions of our storefront script send the comment's name, email and text. We use them only at that moment, the same way, and don't store or log them.
If we turn on the second read for your store, a message our own checks already find pitch-like is also read by Anthropic's Claude, to tell whether it is a template sales message. Only the message text is sent, never the name, email address or IP address, and Anthropic does not train on it. We keep its answer with a one-way fingerprint of the text for up to 30 days, so the same message isn't sent twice. If it doesn't answer within 0.8 seconds, the submission is judged without it.
With smart signals on, your form also tells us how it was filled in: how many keys were pressed, how many taps, clicks and pastes there were (each up to 999), the time from the first click to sending, how long the page was open, whether the hidden trap field was filled in, and on Premium the names of any automation signs the browser showed (for example "webdriver"). These are counts and timings only, never which keys were pressed, and we keep them with the verdict so you can see why it was judged that way.
On Premium, if a visitor's browser shows enough automation signs, it also sends a short note for your log: the signs' names, the score and the page's path. It never changes what the visitor sees.
When a form is stopped (its security check scored under your threshold, Spambuster was sure it was spam with blocking on, your block list named the sender, or the hidden trap field was filled in), the sender sees "Sorry, this couldn't be sent. Please email us instead:" and your store's email address, in their language. What they typed stays in the form, and the email link opens their own email app with their message already in it, so a real customer caught by mistake can still reach you. That link is put together in the visitor's browser: what they typed is not sent to Spambuster or kept by us. The submission is not passed on to Shopify, but it is listed with its reasons in the app, where you can let the sender through from then on. If your store keeps stopped messages, the copy of the message the check already received is kept encrypted for 30 days, so we can tell the store what was stopped and it can reply.
Your store's email address is the one Shopify gives your theme (shop.email).
It is written into the page in an encoded form, so programs that collect addresses
from web pages don't pick it up, and shown only to a sender whose form was stopped.
A message we stop is kept so a real customer stopped by mistake isn't lost: email us and we can tell you what was stopped, so you can reply to them. We keep the name, email address and message (its first 2,048 characters) that your form already sent for the message check, in the same request we judged: nothing extra is sent. They are encrypted (AES-256-GCM) before they are written, with a key made for your store alone and stored apart from the messages, read only by Spambuster support when you ask us what was stopped or when helping you (see Who can see it), and deleted after 30 days, sooner if you ask us to, straight away for a sender who asks your store to erase their data, and all at once when your store's data is deleted after you remove Spambuster (its key goes with it). Messages that are not stopped are never kept. We never write to anyone for you: you reply from your own email. Email us at contact@jola.com.au to turn keeping off at any time; then we keep why a message was stopped, never what it said.
If you turn on message previews in the app, your storefront also sends us the name and email address entered on each protected form and the first 280 characters of the message, so you can see what each spam verdict is about. Previews are shown to you, inside your Shopify admin (and to Spambuster support when helping you), and are deleted after 30 days. Turning previews off stops new ones straight away. When Shopify tells us a customer asked your store to erase their data, we delete the previews from their email address.
Spambuster protects many stores. So that a spammer stopped on several of them this morning doesn't start fresh on yours, each check is linked to three locked fingerprints that the other stores' checks can also see:
We use them only to count how often a sender was recently stopped or let through across the service, never to build a profile of anyone. No store is ever named to another, and no names, addresses or messages are shared. A fingerprint nothing has used for 30 days is deleted; the checks it was linked to are deleted after 365 days like any other check.
To turn this off ("Use what other stores have seen"), email us at contact@jola.com.au and we'll do it for you. Then your store neither uses the other stores' history nor adds the email and network fingerprints of your visitors to it; the hashed IP address is still kept with each check for your own store's repeat-offender checks and the service-wide IP reputation described below. When Shopify tells us a customer asked your store to erase their data, we delete their email fingerprint everywhere, with every link to it.
You, inside your Shopify admin, and through us: ask, and we can tell you what was stopped. And Spambuster support (us, at JOLA), when you ask for help or we are looking into a problem with your store: we open the app as your store, and can then see what you see, as well as your stopped messages and message previews. Every time support opens them, it is written to your store's log with who looked and what they opened. Nobody else can see them, and other stores never can.
Email addresses, domains, IP addresses, countries and words you add to your store's allow or block lists are stored with your store's settings until you remove them or uninstall. An IP address added from a submission lapses after 30 days, because they are shared and change hands. Your lists stay on our server: your storefront is only told whether you have word, language or email rules, so it knows what to send for the check. When you set a country rule, we look up the country of each submission's IP address at that moment, in a copy of DB-IP's free country table that we keep on our own server (no address is sent anywhere), and keep only the country code with the verdict. When Shopify tells us a customer asked your store to erase their data, we also remove their email address from your lists.
Submission data is used solely to score the submission for spam, to show you why, and to maintain the reputation signals described above (hashed IP addresses, networks, user-agents and email fingerprints) that improve detection across the service. We do not sell personal data, and we do not use it for advertising or profiling.
When Shopify tells us a customer asked your store to erase their data, we delete their message previews and stopped messages, the IP address and email fingerprints on their checks, their shared email fingerprint, your "real customer" marks on them, and their email address and IP addresses on your lists. When a customer asks your store for a copy of their data, we put together what we hold about them for your store (their checks, any preview or stopped message, and list entries) and send it to you, within 30 days. You can also ask us for either at any time.
When you uninstall the plugin/app, your site is deregistered from the service and its configuration (including your stored reCAPTCHA keys) is removed.
Protected pages load Google reCAPTCHA, which is subject to Google's own Privacy Policy and Terms of Service.
Country rules use IP Geolocation by DB-IP (licensed under CC BY 4.0). Language rules use trigram profiles from franc (MIT licence). The throwaway-inbox check uses copies of the disposable/disposable-email-domains (MIT licence) and disposable-email-domains (public domain) lists, kept on our server and refreshed daily. All of these run on our side or in the visitor's browser: we download their data, and none of them receives any of yours.
The optional AI second read uses Anthropic's API, subject to Anthropic's own Privacy Policy.
Questions or data requests: contact@jola.com.au.
© 2026 JOLA · Spambuster