Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Japanese fraud and risk scoring service that collects browser fingerprints and behavioural signals to compute a transaction risk score for ecommerce and payment flows.
Qualva is a Japanese fraud and risk management service used by ecommerce, payments and account creation flows. It collects device and behavioural signals from the browser and computes a transaction level risk score that the operator can use to allow, challenge or block an operation.
The SDK reads canvas and font metrics, screen and platform attributes, plugins, language, mouse and keyboard timings and writes a first party device cookie (qlv_device) plus a session token (qlv_session). The scoring API receives the IP, user agent, transaction context and the operator session identifier.
Browser fingerprinting reads information from the visitor device. Article 5(3) ePrivacy applies, so consent is required before the SDK fingerprint signals are collected. The risk score may amount to automated decision making with significant effects under Article 22 GDPR if a payment is blocked, requiring meaningful information and a right to human review.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Japan benefits from a partial GDPR adequacy decision since 2019, but only for data subject to the Japanese supplementary rules. Confirm with Qualva K.K. which scope applies, sign Standard Contractual Clauses where adequacy does not cover the dataset, and document the Transfer Impact Assessment.
Gate the SDK behind your CMP, document the fingerprinting in the cookie register, complete a DPIA, build a human review path for blocked transactions, sign the DPA and SCCs, and provide a privacy notice that explains the logic of the risk score in plain language.
Websites using Qualva must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is required because Qualva combines automated decision making (fraud risk score), browser fingerprinting, behavioural data and a transfer to Japan. Document the categories, retention, the meaningful information about the logic and the safeguards under Article 22 GDPR.
Sample consent text
We use Qualva to detect fraudulent activity. With your consent, the Qualva SDK collects device and behavioural signals on this page and transmits them to servers in Japan to compute a risk score.
Third-party domains contacted
qualva.comapi.qualva.comcdn.qualva.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| qlv_device | first_party | 1 year | Long lived device identifier used to recognise the same browser across sessions for fraud risk scoring. |
| qlv_session | first_party | Session | Session identifier used to link the events of a single visit to the risk score request. |
| qlv_probe | third_party | Session | Probe cookie used by the Qualva SDK to detect proxies and inconsistent network configurations. |
Qualva collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The Qualva SDK writes qlv_device (long lived device identifier) and qlv_session (session). Some integrations use a third party probe cookie to detect proxies.
Yes. Browser fingerprinting and the SDK cookies trigger Article 5(3) ePrivacy. Consent must be obtained before the SDK loads the device signals.
Consent (Art. 6(1)(a) GDPR) for the front end fingerprinting and cookies. Legitimate interest (Art. 6(1)(f)) for fraud prevention scoring of completed transactions, weighed in a Legitimate Interest Assessment.
Yes, to Japan. Japan has a partial adequacy decision since 2019. Confirm the scope of adequacy with Qualva K.K. and sign SCCs for any data outside that scope.
Yes. The combination of automated decision making, fingerprinting, behavioural data and a transfer to Japan is a textbook DPIA trigger under Article 35 GDPR.
Gate the SDK behind the CMP, document the fingerprinting, sign the DPA and SCCs, configure retention to the minimum, build a human review path for blocked transactions and explain the logic of the score in a plain language privacy notice.
EU friendly alternatives include Sift, Riskified, Forter, Ravelin (UK), SEON (Hungary) and Fraugster. Each has its own posture on fingerprinting and data residency.
List qlv_device and qlv_session with name, purpose, retention and processor (Qualva K.K., Japan). Mention the Japan transfer and the SCCs. Disclose the use of the score under Article 22 in your privacy notice.