The short version. One person, Alex Naum, runs Lyravant and is the only person with access to our systems, every account behind them uses two-factor authentication, and all data is encrypted in transit and at rest. We hold no shopper personal data. If an incident happens, we contain it first, then tell affected merchants and Shopify without undue delay, and within 72 hours where that's required.
Scope
This policy covers our Shopify apps, Lyravant: Free Shipping Bar and Lyravant: Pop Ups & Spin Wheel, the servers and database that run them, this website, and the accounts used to build and operate them. What data the apps handle, and for how long, is set out in our privacy policy.
Access
- One operator. Lyravant is run by Alex Naum, who is the only person with access to production systems, the database, the code and the support mailbox. No contractors or staff have access.
- Two-factor authentication is required on every account that can reach our systems or data: Shopify Partners, Railway (hosting and database), GitHub (code), Cloudflare (domain and DNS) and Google (email).
- Least privilege. Each app asks Shopify only for the permissions it needs, and we never access a merchant's store beyond what the app does for them. We don't look at store data unless the merchant asks us to, for support.
Encryption
- In transit: every connection to the apps, the Shopify APIs and this website uses HTTPS (TLS).
- At rest: our database and its backups are stored encrypted by our hosting provider.
Secrets
API keys, the Shopify app secret and database credentials are stored only as environment variables in our hosting provider, never in code, in the repository or in logs. Shopify access tokens are kept only in our database, are scoped to the store that issued them, and are deleted when the app is uninstalled.
Logging
Our servers log events such as errors, webhooks received and failed requests, identified by store domain. They never log request bodies or other personal data: a shopper's email, name or phone number never appears in our logs. Logs are kept by our hosting provider for a limited period and are visible only to Alex.
Data minimisation
- We collect only what each feature needs, and we don't keep shopper personal data: signups from Pop Ups & Spin Wheel are written straight to the merchant's Shopify customers.
- Order data is read without customer fields, and kept only as long as our privacy policy says.
- Data is deleted on uninstall and on Shopify's data deletion requests, and an automatic sweep removes leftovers and anything past its retention period.
- Development uses separate test stores and a separate local database; production data is never copied to development.
How the apps are built
- Every request from Shopify (admin sessions, webhooks and storefront requests through the app proxy) is verified with Shopify's signatures before anything happens.
- Storefront input is validated and size-limited, and signups are protected by a hidden spam field and rate limits.
- Every change runs the apps' automated tests before it's deployed.
Incident response
A security incident is anything that does or could expose, change or destroy data we're responsible for, or that gives someone access they shouldn't have, for example a leaked key, a compromised account or a bug that shows one store's data to another. When we learn of one, we follow these steps:
- Contain
Stop the damage first: revoke and rotate the affected tokens, keys and passwords (including the Shopify app secret and database credentials if there's any doubt), close the hole, and take a service offline if that's what it takes.
- Assess
Work out what happened, when, which systems and stores are affected, and what data was involved, using logs and the hosting provider's records. Keep notes and evidence from the start.
- Notify
Tell affected merchants and Shopify without undue delay, and within 72 hours of becoming aware where the law or Shopify's terms require it, with what we know, what it means for them and what we're doing. Where we're the controller, we notify the relevant data protection authority as the law requires. Merchants get what they need to inform their own customers.
- Remediate
Fix the root cause, restore from backups if needed, check that nothing else is affected, and confirm the fix holds.
- Review
Once it's resolved, write up what happened and what we changed, and update this policy, our code or our setup so it can't happen the same way again.
Reporting a problem
If you think you've found a security issue in our apps or website, please email support@lyravant.com with “Security” in the subject. Include what you found and how to reproduce it. We'll acknowledge your report promptly, keep you updated, and won't take action against anyone who reports in good faith and doesn't access or change other people's data.
Review
We review this policy at least once a year and whenever our apps, providers or risks change.