Security & Data Protection

1. Scope

This page describes the security approach for the HappifyApps website, Shopify apps, and services operated by Udaan Technologies Pvt. Ltd. It is a public control summary, not an independent certification or penetration-test report.

2. Data minimisation

Each app requests only the Shopify access scopes its features need, and each import query names the exact fields it reads.
Order imports keep buyer contact details only while an app on the store needs them. Stock Rescue and Pick List & Low Stock import orders without customer names, emails, phone numbers or addresses. RepeatIQ keeps customer ID, name and email, not phone numbers or addresses. Local Delivery Sheet and Invoice & Packing Slip keep names, contact details and addresses because they print them.
Audit log entries do not record customer email addresses, and processed webhook payloads are emptied once their data is stored.
Protected customer fields are never written to logs, error reports, or analytics.

3. Encryption

Production traffic is sent over HTTPS/TLS through the hosting and database providers.
Managed providers supply encryption for data at rest under their published service controls.
Shopify access tokens stored by supported apps are additionally encrypted with AES-256-GCM using a key held in the hosting environment rather than source control.
Secrets are kept in managed environment configuration and are not intended to be committed to source control.

4. Access control

Production hosting and database access is restricted to authorised personnel with a business need.
Multi-factor authentication is required for privileged accounts where the provider offers it, and unique credentials must be used.
Access should be removed when no longer needed and reviewed when roles change.
Applications record security and operational events needed to diagnose installs, imports, writes, and privacy requests without intentionally placing protected fields in analytics.

5. Environments and backups

Development and testing should use development stores and non-production data wherever practical.
Encrypted database backups are deleted 90 days after they are taken. A backup is not treated as verified until restore testing succeeds.
Deletion can be triggered through Shopify redaction webhooks, uninstall processing, or a verified merchant or data-subject request.

6. Retention

Store data synced from Shopify is kept while an app is installed.
An uninstalled app’s data is deleted when Shopify’s shop redaction request arrives, 48 hours after uninstall. Store data shared with another HappifyApps app still installed is kept for that app and deleted with the last app’s redaction.
Customer redaction requests are processed through the applicable Shopify privacy webhook and recorded in the audit log.
Webhook delivery records are deleted after 30 days and audit log entries after one year, except saved settings versions kept while the app is installed.

7. Security incident response

If we suspect unauthorised access to merchant or customer data, we follow these steps:

Contain: revoke or rotate the affected credentials and, if needed, take the affected app offline.
Assess: identify which stores, fields, and time range were affected, using the audit log and hosting provider logs.
Notify: inform affected merchants, Shopify, regulators, or individuals within the time required by applicable law and contract, with the facts available at that time.
Remediate: fix the root cause, re-issue credentials, and record the incident and follow-up actions.
Report a concern to security@happifyapps.com. We acknowledge reports within two business days.

8. Providers and independent assurance

The current provider list and processing roles are maintained on the Sub-processors page.
Security claims on this page describe intended and implemented controls but do not represent SOC 2, ISO 27001, PCI DSS, or another certification unless a current certificate is expressly published.
Merchants may request relevant security and data-processing information, subject to confidentiality and provider restrictions.

9. Contact

Report a suspected vulnerability or security event to security@happifyapps.com. Send privacy requests to privacy@happifyapps.com. Do not include passwords, full payment-card details, Shopify access tokens, or unnecessary personal data in a report.

See our Privacy Policy, Sub-processors, and Data Processing Terms for related information.

2. Data minimisation

Each app requests only the Shopify access scopes its features need, and each import query names the exact fields it reads.

Order imports keep buyer contact details only while an app on the store needs them. Stock Rescue and Pick List & Low Stock import orders without customer names, emails, phone numbers or addresses. RepeatIQ keeps customer ID, name and email, not phone numbers or addresses. Local Delivery Sheet and Invoice & Packing Slip keep names, contact details and addresses because they print them.

Audit log entries do not record customer email addresses, and processed webhook payloads are emptied once their data is stored.

Protected customer fields are never written to logs, error reports, or analytics.

3. Encryption

Production traffic is sent over HTTPS/TLS through the hosting and database providers.

Managed providers supply encryption for data at rest under their published service controls.

Shopify access tokens stored by supported apps are additionally encrypted with AES-256-GCM using a key held in the hosting environment rather than source control.

Secrets are kept in managed environment configuration and are not intended to be committed to source control.

4. Access control

Production hosting and database access is restricted to authorised personnel with a business need.

Multi-factor authentication is required for privileged accounts where the provider offers it, and unique credentials must be used.

Access should be removed when no longer needed and reviewed when roles change.

Applications record security and operational events needed to diagnose installs, imports, writes, and privacy requests without intentionally placing protected fields in analytics.

5. Environments and backups

Development and testing should use development stores and non-production data wherever practical.

Encrypted database backups are deleted 90 days after they are taken. A backup is not treated as verified until restore testing succeeds.

Deletion can be triggered through Shopify redaction webhooks, uninstall processing, or a verified merchant or data-subject request.

6. Retention

Store data synced from Shopify is kept while an app is installed.

An uninstalled app’s data is deleted when Shopify’s shop redaction request arrives, 48 hours after uninstall. Store data shared with another HappifyApps app still installed is kept for that app and deleted with the last app’s redaction.

Customer redaction requests are processed through the applicable Shopify privacy webhook and recorded in the audit log.

Webhook delivery records are deleted after 30 days and audit log entries after one year, except saved settings versions kept while the app is installed.

7. Security incident response

If we suspect unauthorised access to merchant or customer data, we follow these steps:

Contain: revoke or rotate the affected credentials and, if needed, take the affected app offline.

Assess: identify which stores, fields, and time range were affected, using the audit log and hosting provider logs.

Notify: inform affected merchants, Shopify, regulators, or individuals within the time required by applicable law and contract, with the facts available at that time.

Remediate: fix the root cause, re-issue credentials, and record the incident and follow-up actions.

Report a concern to security@happifyapps.com. We acknowledge reports within two business days.

8. Providers and independent assurance

The current provider list and processing roles are maintained on the Sub-processors page.

Security claims on this page describe intended and implemented controls but do not represent SOC 2, ISO 27001, PCI DSS, or another certification unless a current certificate is expressly published.

Merchants may request relevant security and data-processing information, subject to confidentiality and provider restrictions.

9. Contact