Security and Data Protection Policy

Scope

This policy covers the SL Korea PCCC Guard Shopify app operated by SL Studio. For the personal data of a merchant's customers, the merchant is the controller and SL Studio processes it only to check Korea-bound orders, tag them and, when the merchant turns it on, email the customer a request for the customs code.

Minimum data

Customer names, addresses, phone numbers, email addresses and customs clearance codes are read from Shopify only at the moment an order is checked, are held in memory while the check runs, and are not written to our database. CSV exports are streamed to the merchant and not stored. The app's only write to Shopify is the order's pccc-* tag.

Encryption

• In transit: every connection (merchant browser, Shopify, our database, our email provider) uses HTTPS/TLS.
• At rest: the shop data the app stores (sessions and access tokens, settings, access log, email throttle) is encrypted by the application with AES-256-GCM before it is written to the database, so the database and its backups hold only ciphertext. The key lives in the hosting provider's encrypted environment settings (with one copy in the operator's encrypted OS keychain for maintenance), never in source code.

Retention

• Customer personal data and customs codes: not retained by the app.
• Sessions and access tokens: deleted immediately on uninstall.
• Settings, plan and monthly counters: deleted when Shopify sends shop/redact (48 hours after uninstall).
• Access log: entries expire 90 days after the last entry and are deleted with the shop data.
• Request-email throttle (order ID, count, time of last send): 30 days.

Test and production data

Automated tests and local development use generated sample orders and an in-memory store. Production data is never copied into test or development environments, and testing in Shopify uses development stores with generated test orders and a test inbox.

Access control and passwords

• Production access (Shopify Partners, hosting, database, email provider, source repository, domain) is limited to the owner of SL Studio. There is no other staff access.
• Every account with production access must use a unique password of at least 16 characters generated by a password manager, and two-factor authentication where the service supports it.
• Keys and tokens are stored only in the hosting provider's encrypted environment settings and the operator's encrypted OS keychain, never in source code, and are rotated after any suspected exposure.

Access logging

Each time the app reads customer data from Shopify (a list scan, a webhook check, a tag write, a request email) it records the time, the action and the order IDs in an encrypted per-shop access log. Hosting request logs are kept in addition.

Data loss prevention

• No customer records or customs codes are stored, so there is no customer database to lose.
• Logs contain shop domains and order numbers only — never names, addresses, emails, phone numbers or codes.
• Request emails go only to the email address on the order, at most twice per order, and only when the merchant has turned them on.
• Every admin action requires an authenticated Shopify admin session; dependencies are kept current.

Security incident response

If we detect or are told about a suspected incident (unauthorised access, leaked key, data exposure):

• Contain: revoke and rotate affected keys and tokens, disable the affected feature or take the app offline if needed.
• Assess: use the access log and hosting logs to determine what data and which shops are affected.
• Notify: tell affected merchants and Shopify without undue delay and no later than 72 hours after confirming an incident that affects personal data, with what happened, what data was involved and what we are doing.
• Recover and review: fix the cause, restore service, and record what changed so it does not recur.

Report a problem

Email support@sl-studio.dev with "Security" in the subject. We acknowledge reports within two business days.