Security policy

Last updated September 30, 2026

This policy describes how Mint Labs protects the data Mint Blocker handles, including personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible. Visitor IP addresses are used only to answer the visitor check; for blocked visits we keep the shortened network address (/24 or /48) and a keyed hash, never the full address, for 30 days. Order checks ask Shopify's webhook for only the order ID, number, email, browser IP address and timestamps, compare them with the store's lists and keep neither the email nor the IP address.
• The checkout rule runs inside Shopify's checkout (a Shopify Function without network access), so cart and checkout data never reaches our servers.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window. Published storefront rules live in Cloudflare Workers KV, encrypted at rest.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or customer data.
• Webhooks are verified with Shopify HMAC signatures; unsigned or forged requests are rejected. The public visitor check validates every request, is rate limited, and returns only "allowed" or "blocked" — never rules or other stores' data.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse customers' personal data.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every processing of order data (each order webhook) and every download of a customer data export is logged with a timestamp, the store and the outcome — without the personal data itself — in Cloudflare Workers Logs (kept 7 days). Individual visitor checks are not logged, so visitor IP addresses don't end up in logs.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com