Defense Window — methodology

We do not publish cross-merchant sums

Hail Pilot's standing policy forbids any public 'X dollars recovered across N merchants' scalar. Every figure on the Defense Window page belongs to one named merchant, with a signed consent record. The cohort_size number is metadata about Hail Pilot's own customer count — it is not a sum of any merchant transactional data.

What counts as 'recovered'

A case_outcomes row with a positive resolution_amount, where the case status is 'resolved'. We further filter to:

• Disputes the merchant defended (DisputeStatus.WON or CLOSED with merchant retention).
• Refund requests where the merchant's evidence led to a denial of the buyer's claim.
• Cases the merchant explicitly marks as 'won' or 'partial_win' via the outcome flow.

The k-anonymity floor

Until at least 5 merchants have published, on-record testimonials with consent signed, the public page renders the early-access state. We do not show a partial list with 1 or 2 names while waiting — the cohort framing is intentional.

How consent works

Every testimonial requires the merchant's explicit submission via a form they sign in the dashboard. The consent text version is stored alongside the testimonial; if we change the consent language, older testimonials retain the version they signed under. Merchants can revoke at any time via dpo@hailpilot.com.

Cache freshness

The public endpoint is cached for 5 minutes in Redis. A publication or revocation invalidates the cache immediately, but globally-edge-cached pages may take a few minutes to refresh.

Data subject rights

Hail Pilot's Data Protection Officer is reachable at dpo@hailpilot.com. Access, correction, and deletion requests for testimonial records are handled on the same channel.