What to send
A single merchant descriptor and optional non-sensitive context such as amount, currency, country, date, MCC, and existing merchant name.
What not to send
Never submit card numbers, account numbers, full statements, bank credentials, emails, phone numbers, addresses, customer names, or pasted transaction tables.
Audit samples
The free before/after cleanup audit is for 100 anonymized descriptors. Audit samples should have an owner, purpose, creation date, and retention date. Samples should be deleted within the agreed retention window.
Analytics
Cloudflare Web Analytics is installed for public website page views. Product analytics should use status classes, confidence bands, warning counts, and CTA events. Raw descriptors and full API payloads should not be sent to Cloudflare or stored in analytics, URLs, browser storage, logs, or error reports.