VIP Atelier

Security & Data Protection Policy

Last updated: 25.09.2026. This policy describes how VIP Atelier protects personal data of merchants' customers.

1. Data minimisation and purpose

We only process what the loyalty program needs: Shopify customer ID, first name, email, points, order totals, tier, referral code and optionally birthday (day/month). No addresses, phone numbers or payment data. Data is used solely for the respective merchant's program and never sold.

2. Storage and encryption

Hosting and database run on Cloudflare (Workers, D1). Data is encrypted at rest, including backups, and every connection uses TLS. Credentials are stored as encrypted secrets, never in source code.

3. Retention and deletion

Data is kept only while the app is installed. After uninstall we delete all shop data upon Shopify's shop/redact request, at the latest after 30 days. Customer deletion requests (customers/redact) are processed automatically.

4. Data loss prevention

The database can be restored to any point within the last 30 days using Cloudflare D1 Time Travel. Schema changes are made only through versioned migrations. Testing and development use separate development stores with test data, never production data.

5. Access

Only the provider personally has access to production data. All accounts (Cloudflare, Shopify Partners, email) are protected by strong unique passwords and two-factor authentication. Access to the app is logged via Cloudflare logs.

6. Incident response

  1. Detect & contain: immediately rotate affected credentials (Shopify app secret, Cloudflare tokens) and roll back faulty releases.
  2. Assess: determine scope, affected shops and data categories from the logs.
  3. Notify: inform affected merchants without undue delay and within 72 hours by email so they can meet their Art. 33 GDPR obligations; inform Shopify via Partner Support.
  4. Remediate & document: fix the root cause, restore data via Time Travel if needed, and record the incident and actions taken.

7. Contact

Please report security issues to info@ombrefeu.de.