Security and Data Handling Policy

Effective date: 2 November 2026

This policy describes how Kavio Labs Software Limited protects personal data in its Shopify apps and its own stores. It applies to everyone who works for us.

1. Data minimisation

• An app collects only the fields it needs for a feature the merchant uses.
• Customer details are read from the platform when needed rather than copied, where the feature allows it.

2. Retention and deletion

Deletion runs automatically every day. We keep our own encrypted database backups for 7 days; records deleted from the database leave the backups when those expire.

3. Encryption

• HTTPS (TLS) for all traffic.
• Personal data stored by our apps is encrypted by the application with AES-256 before it reaches the database. Keys are kept outside the database in the server's environment configuration, readable only by the application account.
• Database backups are encrypted as a whole (AES-256) with a separate key, and the personal data inside them is already encrypted by the application.
• Lookups (for example matching a phone number against a block list) use keyed HMAC-SHA256 hashes with a separate key.

4. Access control

• Only authorised staff of Kavio Labs Software Limited can access production servers, databases and app admin tools. Access is given only to people who need it for their work and removed when they no longer do.
• Staff accounts use strong, unique passwords (at least 12 characters, kept in a password manager). Two-factor authentication is switched on for the hosting provider account, the Shopify Partner account and the DNS and CDN account; the hosting control panel and database access are protected by strong, unique passwords and are reachable only over encrypted connections.
• Customer personal data is never copied to personal devices, e-mail or chat.

5. Logging

• Every view of customer personal data in an app's admin pages is logged with time, store and user.
• Logs are reviewed when an incident is suspected.

6. Test and production separation

• Development and testing use separate development stores with made-up data. Production customer data is never used for testing.

7. Data loss prevention

• No exports of customer personal data except through the app's own export, which the merchant starts.
• Exported files are deleted automatically after a short period.
• Production credentials are stored only in the server environment, never in source code.
• Least privilege on servers and databases; unused accounts are removed.
• Daily database backups, encrypted with AES-256 before they are written to disk, kept 7 days and test-decrypted after each run, so data can be restored after an accident.

8. Security incident response

1. Detect and contain: whoever notices a possible incident reports it immediately to [email protected]. We contain it first (rotate keys and passwords, disable the affected access, take the affected component offline if needed).
2. Assess: what data, which stores and customers, how it happened, whether it is still ongoing.
3. Notify: affected merchants without undue delay and within 72 hours; Shopify as required by the Shopify Partner Program Agreement; the supervisory authority (for example, in the United Kingdom, the Information Commissioner's Office (ico.org.uk)) where the law requires it.
4. Fix and learn: fix the cause, document the incident and what changed.

9. Contact

Kavio Labs Software Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, [email protected].