Mint LabsMint AI Assistantby Mint Labs

Security policy

Last updated October 1, 2026

This policy describes how Mint Labs protects the data Mint AI Assistant handles, including personal data of merchants' shoppers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

  • We keep as little data as possible. Email addresses and long numbers typed into the chat are replaced before messages are stored or sent to the AI model. A shopper's email is stored only when they type it in the hand-off form and tick "Email me the reply". Chats are deleted after the store's retention period (default 90 days).
  • Order status is read live from Shopify only after the shopper enters both the order number and the checkout email address. The email is compared in memory and never written to our database or logs; order details are never stored and never sent to the AI model. Unknown orders and wrong emails get the same answer, and repeated failures are blocked per order number, per visitor (keyed one-way hash of the IP address) and per store.
  • The AI model only sees the shopper's question, a few recent turns of the same chat, and excerpts of the store's public content. Store content and shopper messages are passed as data, not instructions, and every sentence of an answer is checked before it's shown (no prices, codes, time frames or contact details that don't appear in the store's content; no promotions from product copy; no claims of actions). The model has no tools: it can't read orders, customers or anything else, or change anything in the store.
  • The app's Shopify access is read-only (products, pages, policies, shipping settings and, on Pro, orders for the status lookup).
  • Abuse limits: per-visitor and per-store rate limits on every public endpoint, a daily AI-reply limit per visitor, a length limit per chat, and a hard monthly reply cap per store enforced in the database before the AI model is called.
  • Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
  • All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or shopper data.
  • Webhooks are verified with Shopify HMAC signatures; unsigned requests are rejected. Admin pages require Shopify session tokens.

Access control

  • Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
  • The app has no internal screen that lets us browse stores' chats or shoppers' personal data.
  • Access is removed immediately when it is no longer needed.

Passwords and authentication

  • Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
  • Two-factor authentication is required on all of those accounts.
  • API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

  • Every request to the app, including requests that process personal data, is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain chat text, email addresses, IP addresses or order details.
  • Logs are reviewed when investigating errors or suspected incidents.

Security incident response

  1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
  2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
  3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
  4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
  5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
  6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com