Mint LabsMint FAQ Pageby Mint Labs

Security policy

Last updated October 6, 2026

This policy describes how Mint Labs protects the data Mint FAQ Page handles. The app stores merchants' FAQ content, settings and store details, plus anonymous search counts on Pro — no personal data of the store's customers. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

  • We keep as little as possible: the merchant's FAQ (pages, categories, questions, translations, product FAQ settings), style and plan, the store's name, domain, languages and Shopify IDs, and the access token. On Pro the storefront sends anonymous search events through Shopify's signed app proxy; terms that look like an email address, a long number or a web address are discarded before storage, and no IP address, customer or cookie is stored. Report data is deleted after 90 days.
  • Data lives in Cloudflare D1 (encrypted at rest, with point-in-time recovery).
  • All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or customer data.
  • Webhooks and app proxy requests are verified with Shopify's HMAC signatures and unsigned requests are rejected; storefront events are rate limited. Answers are sanitized on our server to an allow-list (paragraphs, lists, small headings, bold, italic, underline, safe links) before they are published, so no script or style can reach the storefront.

Access control

  • Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
  • The merchant's settings are shown only inside the merchant's authenticated Shopify admin (session tokens, checked on every request).
  • Access is removed immediately when it is no longer needed.

Passwords and authentication

  • Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
  • Two-factor authentication is required on all of those accounts.
  • API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

  • Every request to the app is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain access tokens or FAQ content or search terms.
  • Logs are reviewed when investigating errors or suspected incidents.

Security incident response

  1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
  2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
  3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
  4. Notify. If merchant data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
  5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
  6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com