Download free

Security policy: Vinyl Lettering Designer for Shopify

Operator: Twilper.com (KvK 98440217), Merelstraat 64, 8916 AX Leeuwarden, the Netherlands. Adopted 18 October 2026. Reviewed at least once a year and after every incident.

This is a summary of our security and data protection policy for the Shopify app. Which data the app processes and for how long is described in detail in the privacy policy for the Shopify app.

1. Minimum data and purpose limitation

  • Access scopes: write_products, write_publications, read_orders, write_app_proxy, read_locales. No theme, inventory, shipping or customer scopes.
  • Protected customer data level 1 only. From orders the app keeps the order name and ID, date, payment and cancellation status, and per design line the quantity and paid price. No customer name, e-mail, phone or address is stored.
  • The data is used only to link order lines to the production files of the design and to check the paid price. No marketing, profiling, automated decision-making or sale of data.
  • Design text is treated as possible personal data (it can contain a name).
  • Client IP addresses are only stored as a one-way keyed hash, for rate limits, and only when a client IP is known. Requests through the Shopify app proxy carry no customer IP (the forwarded chain only holds Shopify's and Railway's addresses), so for those the app stores no IP hash at all.

2. Retention

  • Designs that are never ordered: 31 days in the design service. Ordered designs and order references: 365 days.
  • Privacy request references: at most 90 days. Erasure jobs and webhook receipts: 30 days. Hashed IP rate-limit data: 2 days.
  • On uninstall, access tokens are deleted immediately; 48 hours later (shop/redact) everything of the store is deleted in both services. customers/redact deletes the requested orders, their design summaries and files.
  • A daily job enforces these periods.

3. Encryption

  • In transit: TLS only (Shopify, Railway, the design service). Service-to-service calls are signed with HMAC-SHA256 plus a timestamp and a single-use nonce.
  • At rest: Shopify access and refresh tokens are encrypted at application level with AES-256-GCM. Railway states that all user data, including the database and its backups, is encrypted at rest at the storage level.
  • Download links for production files are signed and short-lived. Upload and preview tokens for the designer expire after hours or minutes.

4. Separating test and production

  • Development and tests use mocked Shopify data, an in-memory database and a local design service. Production data is never copied to a development environment.
  • Manual testing uses a Shopify development store with fictional customers.

5. Preventing data loss and abuse

  • Postgres on Railway in the EU region europe-west4 (Netherlands), with backups enabled: daily (kept 6 days) and weekly (kept 27 days).
  • Webhooks are verified (HMAC over the raw body) and deduplicated; Shopify retries on a database error. Privacy webhooks are processed as jobs with daily retries until done.
  • The storefront endpoints are only reachable through the Shopify app proxy (signature checked), with request body limits and rate limits. Per-IP limits only apply when a client IP is known; the app proxy does not pass the customer's IP, so for storefront traffic the per-store limits apply: an alert to the merchant at 100 new designs in one hour and at 300 in one day, a hard stop at 1,500 new designs per day (existing designs keep working), and at most 20 new carrier products per hour and 200 in total. Residual risk: a script can use up a store's daily budget and pause new designs for that store until midnight UTC; the alerts make this visible and the merchant can pause the designer. File uploads and the admin preview use signed, short-lived tokens bound to the store.

6. Access

  • Only the operator has access to production (Railway, Shopify Partner Dashboard, Cloudflare). There are no other staff with access.
  • Every account with access uses a strong, unique password and two-step verification.
  • Access is logged: the Railway audit log for project and variable changes. Application logs contain shop domains and internal IDs, not customer data.

7. Security incidents

  1. Detect: monitor logs and handle reports via [email protected].
  2. Contain: rotate the affected keys (without downtime where possible) and, if needed, take the service offline.
  3. Report: notify affected merchants without undue delay so they can meet their 72-hour obligation under the GDPR; notify the Dutch Data Protection Authority where we are the controller.
  4. Learn: record cause, impact and measures, and update this policy.

8. Audits

No external security audits or certifications so far.

Contact

Security questions or reports: [email protected].