Mint LabsMint Price Matchby Mint Labs

Security policy

Last updated October 4, 2026

This policy describes how Mint Labs protects the data Mint Price Match handles, including personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

  • We keep as little data as possible. For each price match request we store the shopper's email address, the competitor link, price and optional note they submitted, and the decision and code. We never store IP addresses: rate limits use a keyed one-way hash, deleted after 30 days. Emails, notes and links are erased 60 days after a request ends.
  • Email addresses are encrypted by the app (AES-256-GCM) before they are written to the database, with a key stored as a separate encrypted secret. Duplicate checks and privacy requests use a keyed one-way hash, so the address itself is only decrypted to send an email or to show it to the merchant.
  • Emails are never dropped on errors: an email is marked sent only after the email service accepted it; anything else puts it back in the outbox, and stuck messages are recovered automatically.
  • Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
  • All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or shopper data.
  • Webhooks and storefront requests are verified with Shopify HMAC signatures; unsigned requests are rejected. Shopper status links are signed (HMAC-SHA256) and can't be guessed. Discount codes are derived from a secret key, so they can't be predicted, and each works once.

The competitor price check

The optional price check fetches one web page a shopper submitted, which makes it a server-side request to an address chosen by someone outside the store. It is limited on every side:

  • Only pages on sites the merchant put on their competitor list are fetched; links to other sites are never requested.
  • Only https links on the standard port, without user names or passwords, with a host name (never an IP address), and never internal or reserved names or shared app-hosting domains.
  • Before the request, the host name is resolved over DNS-over-HTTPS and every address must be a public internet address (private, loopback, link-local, cloud-metadata, carrier-grade NAT, multicast, documentation and reserved ranges, and IPv6 equivalents, are refused).
  • Redirects are followed only to https pages on the merchant's listed sites, re-checked at each step, at most 3 times.
  • One GET request with an 8-second limit, at most 1.5 MB read, only web pages (HTML) accepted, no cookies, credentials or shopper data sent.
  • Only the prices found are stored; the page itself is never kept.
  • Known limit: our hosting can't pin a request to the address we checked, so a site that changes its DNS answer between our check and the request isn't caught by our own check. The hosting provider's network only lets our servers reach public internet services, and only listed sites are ever requested.

Access control

  • Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
  • The app has no internal screen that lets us browse customers' personal data.
  • Access is removed immediately when it is no longer needed.

Passwords and authentication

  • Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
  • Two-factor authentication is required on all of those accounts.
  • API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

  • Every request to the app, including requests that process personal data, is logged with a timestamp by our hosting provider's request logs. Logs never contain shoppers' email addresses.
  • Logs are reviewed when investigating errors or suspected incidents.

Security incident response

  1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
  2. Contain. We stop the exposure first: disable the affected feature (for example the price check), revoke and rotate keys and access tokens, and block abusive traffic.
  3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
  4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
  5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
  6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com