Security policy

Last updated October 6, 2026

This policy describes how Mint Labs protects the data Mint Sold Out to Bottom handles. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible: store settings, collection and product IDs, each collection's original order and sort setting, and an activity log. The app reads no personal data about shoppers or customers.
• Changes to a store are made so they can be undone: a collection's original order and sort setting are saved before the first change, and the app only ever puts back products it took off the online store itself.
• Background work is resumable: every step is saved in the database, so an interrupted run continues where it stopped instead of leaving a collection half-sorted.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant data.
• Webhooks are verified with Shopify HMAC signatures; unsigned requests are rejected. The admin is only reachable with a Shopify session token.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Requests to the app are logged with a timestamp by our hosting provider's request logs. Logs contain store domains and IDs, never personal data.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: pause background work, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which stores were affected, and when.
4. Notify. We notify affected merchants without undue delay and within 72 hours of confirming an incident, and tell Shopify where required.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery and restore affected collections.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com