Security and Data Protection Policy

Scope

This policy covers the Invoice & Packing Slip ko/ja/en Shopify app operated by SL Studio. For the personal data of a merchant's customers, the merchant is the controller and SL Studio processes it only to produce the documents the merchant asks for.

Minimum data

Customer names, addresses, emails and phone numbers are read from Shopify only at the moment a document is generated, are held in memory while the PDF is rendered, and are not written to our database. Generated PDFs are streamed to the merchant and not stored. The app's Shopify access is read-only.

Encryption

• In transit: every connection (merchant browser, Shopify, our database, our email provider) uses HTTPS/TLS.
• At rest: the shop data the app stores (sessions and access tokens, settings, access log) is encrypted by the application with AES-256-GCM before it is written to the database, so the database and its backups hold only ciphertext. The key lives in the hosting provider's encrypted environment settings, never in source code.
• Automatic emails are delivered by Resend, which encrypts its datastores at rest and in transit.

Retention

• Customer personal data: not retained by the app.
• Sessions and access tokens: deleted immediately on uninstall.
• Settings, plan and usage counters: deleted when Shopify sends shop/redact (48 hours after uninstall).
• Access log: entries expire 90 days after the last entry and are deleted with the shop data.
• Automatic emails: kept by the email provider only as delivery records under its own retention policy.

Test and production data

Automated tests and local development use generated sample orders and an in-memory store. Production data is never copied into test or development environments, and testing in Shopify uses development stores with generated test orders.

Access control and passwords

• Production access (Shopify Partners, hosting, database, email provider, source repository, domain) is limited to the owner of SL Studio. There is no other staff access.
• Every account with production access must use a unique password of at least 16 characters generated by a password manager, and two-factor authentication where the service supports it.
• Keys and tokens are stored only in the hosting provider's environment settings and rotated after any suspected exposure.

Access logging

Each time the app reads customer data from Shopify (preview, download, bulk ZIP or automatic email) it records the time, document type, order IDs and channel in an encrypted per-shop access log. Hosting request logs are kept in addition.

Data loss prevention

• No customer records are stored, so there is no customer database to lose.
• Logs contain shop domains and order numbers only — never names, addresses, emails or phone numbers.
• Bulk downloads are limited to 50 orders per request and every document requires an authenticated Shopify admin session or a verified Shopify webhook.
• Dependencies are kept current and the app's API scopes are read-only.

Security incident response

If we detect or are told about a suspected incident (unauthorised access, leaked key, data exposure):

• Contain: revoke and rotate affected keys and tokens, disable the affected feature or take the app offline if needed.
• Assess: use the access log and hosting logs to determine what data and which shops are affected.
• Notify: tell affected merchants and Shopify without undue delay and no later than 72 hours after confirming an incident that affects personal data, with what happened, what data was involved and what we are doing.
• Recover and review: fix the cause, restore service, and record what changed so it does not recur.

Report a problem

Email support@sl-studio.dev with "Security" in the subject. We acknowledge reports within two business days.