Security policy

Last updated October 6, 2026

This policy describes how Mint Labs protects the data Mint AI Image Enhancer handles: merchants' product images, product titles and settings. The app handles no customer or order data. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little as possible: the product image list (IDs, product titles, file names, alt text, sizes), settings, 90 days of job history, exact copies of original images the app replaced and fingerprints of the files it uploaded. AI upscaling runs in the merchant's browser; background removal results are returned to the browser and not stored. The app requests only read_products and write_files access.
• Merchant images are never lost: before an image is replaced, its exact original is written to private Cloudflare R2 storage and read back to check it. A replacement is uploaded only after that succeeded, and only if it was made from the image the product still shows (checked by SHA-256). Restore puts the same bytes back.
• Kept originals are never public. They can be downloaded only from the merchant's authenticated Shopify admin (session token checked on every request, and only for that store's own images).
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery. R2 storage is encrypted at rest.
• All traffic uses HTTPS (TLS). Production and development use separate databases and storage; development never uses real merchant data.
• Webhooks are verified with Shopify HMAC signatures; unsigned requests are rejected.
• Uploads from the admin are size-limited (20 MB), their real format is read from the bytes, and their dimensions are checked by the image service before anything is sent to Shopify. Background removal is limited per store and month.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse merchants' images.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app is logged with a timestamp by our hosting provider's request logs. Our own log lines contain IDs and error messages only.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: pause jobs, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which stores were affected, and when.
4. Notify. We notify affected merchants without undue delay and within 72 hours of confirming an incident, and tell Shopify where required.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com