Security policy

Last updated October 1, 2026

This policy describes how Mint Labs protects the data Mint Cookie Consent handles, including the anonymous consent log kept on behalf of merchants on the Pro plan. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible: the merchant's settings, plan and publish status, and — only with the Pro consent log — one record per shopper choice: a random consent ID, region, choices, banner version, language and time. No IP addresses, names, email addresses, customer IDs or browser details.
• The app reads no customer data from Shopify. Shoppers' choices are stored by Shopify through its Customer Privacy API.
• Consent log entries are deleted automatically after 12 months; everything for a store is deleted 48 hours after uninstall.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or shopper data.
• Webhooks are verified with Shopify HMAC signatures and admin pages with Shopify session tokens. The only public endpoint, the consent log, is reached through Shopify's app proxy and accepts only requests signed by Shopify; it validates every field against strict formats, caps the request size, and is rate-limited per store and per visitor (the visitor key is a keyed hash, never the IP itself) with a daily cap per store.
• CSV exports neutralise spreadsheet formulas in every cell.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• Merchants see only their own store's consent log, after Shopify authenticates them in the admin.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app is logged with a timestamp by our hosting provider's request logs. Our own logs never contain consent log contents or shoppers' data.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com