Security policy

Last updated October 4, 2026

This policy describes how Mint Labs protects the data Mint Team Order handles, including personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible: what organisers and members type on the team pages (team name, first names, the merchant's personalisation fields, chosen options), deleted 60 days after the team order closes, and an organiser's optional email address for reminders, deleted when the team order closes. The app never reads or stores Shopify customer records. From paid orders it keeps only the order ID and number, matched by line item properties.
• Private links (the organiser's manage link, each member's change-my-entry link) are random 144–192-bit tokens. We store only a one-way SHA-256 hash; they travel in the URL fragment (which browsers don't send to servers or in referrers) and in request bodies, and guessing is rate-limited. Links in organiser emails are signed (HMAC-SHA256) and expire.
• Public endpoints accept JSON only (no cross-site form posts), limit request sizes, have a honeypot field and are rate-limited per visitor (keyed one-way hash of the IP address, kept for at most an hour), per team order and per store. Everything typed is cleaned, length-limited and checked by a word filter; pages escape it so it can never become HTML or Liquid.
• Team discount lines carry a value signed with a per-store secret key that only the app and its discount Function know, so a shopper can't give themselves a team discount by editing their cart.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or customer data.
• Webhooks and storefront requests are verified with Shopify HMAC signatures; unsigned or stale requests are rejected.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse team orders or people's personal data.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app, including requests that process personal data, is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain names, personalisation, email addresses or anything else people type.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com