Security & Compliance Policy

This policy applies to:

• Visitors to the CXSnippets website
• Merchants installing and using the CXSnippets Shopify apps
• Clients engaging CXSnippets for custom Shopify development or consulting services

CXSnippets develops and distributes apps in accordance with:

• Shopify App Store Review Guidelines
• Shopify Partner Program requirements
• Shopify API and data usage policies

We only request the minimum required API scopes necessary for app functionality and do not access Shopify store data beyond what is explicitly authorized by the merchant.

2.1 Principle of Least Privilege

Our Shopify apps:

• Request only the data strictly required to deliver advertised functionality
• Do not access unrelated store, customer, or order data
• Respect the merchant consent granted during installation

2.2 Store Data Usage

Shopify store data accessed via our apps is used solely for:

• App functionality
• Configuration and performance optimization
• Customer support and troubleshooting (when requested)
• We do not sell, rent, or misuse Shopify store data under any circumstances.

3.1 Data in Transit & At Rest

• All data transmissions use secure protocols (HTTPS / TLS)
• Sensitive credentials and tokens are stored securely using industry-standard safeguards
• Payment information is handled exclusively by trusted third-party processors (e.g., Stripe, PayPal)
• CXSnippets does not store raw payment card details on its servers.

Security is embedded throughout our development lifecycle for both ready-to-install apps and custom projects:

• Secure coding standards and best practices
• Peer code reviews before deployment
• Regular updates to address bugs, vulnerabilities, and Shopify API changes
• Monitoring of third-party libraries and dependencies

This ensures compatibility, stability, and ongoing compliance with Shopify platform updates.

We enforce strict internal access controls:

• Role-based access permissions
• Limited access to production systems
• Secure authentication mechanisms
• Periodic access audits

Only authorized team members can access merchant or project-specific data, and only when required for support or delivery.

We maintain processes to detect, respond to, and mitigate security incidents:

• Continuous system monitoring
• Incident escalation and investigation procedures
• Root cause analysis and corrective actions

If a security incident impacts merchant data, affected parties will be notified promptly in accordance with legal obligations and Shopify requirements.

CXSnippets is committed to compliance with applicable regulations, including but not limited to:

• GDPR (EU/EEA)
• CCPA / CPRA (California)
• Other applicable data protection laws

Data subject rights (access, correction, deletion, restriction) are handled in accordance with our Privacy Policy.

We rely on vetted third-party providers for:

• Hosting and infrastructure
• Payment processing
• Analytics and support systems

These providers are selected based on reliability and security practices and are granted access only to data necessary for service delivery.

• Shopify store data is retained only while required for app functionality or active services
• Upon app uninstallation, store data is removed within a reasonable timeframe unless legally required otherwise
• Custom project data is retained only for contractual and support purposes
• Merchants may request data deletion subject to legal and contractual constraints.

For custom Shopify work:

• Access credentials are handled securely and confidentially
• Work is performed within agreed scopes and environments
• Credentials provided by clients remain the client’s responsibility
• Code ownership and handover are governed by contractual agreements
• Clients are advised to maintain backups and security controls for their production stores.

CXSnippets apps operate within the Shopify ecosystem. We are not responsible for:

• Shopify platform outages or service disruptions
• Changes to Shopify APIs or policies
• Security issues originating from the Shopify infrastructure
• Merchants are encouraged to follow Shopify’s own security recommendations and keep all themes and apps updated.

Our team undergoes ongoing training related to:

• Secure Shopify app development
• Data protection obligations
• Incident response and reporting

This ensures security awareness remains integral to our operations.

This Security & Compliance Policy may be updated to reflect:

• Shopify policy changes
• Legal or regulatory updates
• Enhancements to our security practices

Updates will be posted on our website, and continued use of our services constitutes acceptance of the revised policy.

For security questions or to report a vulnerability:

Email: support@cxsnippets.com