Legal

Security and incident response

Effective 23 October 2026

This page says how LoyalXP protects the data it holds for your store and your customers, and what we do if that protection fails. It is written for merchants, and it describes what is in place today, not what is planned.

What we protect

Your Shopify access token, your programme rules, your customers' points ledger, and the contact details the app stores for order claims and self-referral checks. The privacy policy lists each field and why it is kept.

Who can reach the data

LoyalXP is run by one person, the founder of Suryanarayana Enterprises LLP. There are no other staff, and only the founder can reach the production database and hosting. If that changes, new people get only the access they need, under their own named logins, and access is reviewed every quarter. The app connects to the database with a restricted role that cannot edit or delete ledger or access-log rows. Each store's data is isolated by programme, the merchant admin accepts only Shopify session tokens, and every webhook and storefront request is checked against Shopify's signature before it is read.

Staff accounts and passwords

The founder uses 2-step login on Shopify Partners, Cloudflare, Supabase and GitHub, and unique random passwords kept in a password manager or the macOS keychain. Secrets are held in Cloudflare's secrets store and the keychain, and are never committed to source code.

Logging access to personal data

Every time a merchant admin, LoyalXP support or the automatic data-request export reads a customer's personal data, the app records who, what and when in an access log. The log is append-only, holds no names, emails or phones, and the merchant can see their store's most recent entries in the app. The points ledger is also append-only, so every balance can be rebuilt and every change has a reason and an actor. Hosting logs are kept on Cloudflare and Supabase, and the founder reviews them regularly.

Preventing data loss

• Everything travels over TLS. The database and its backups are encrypted at rest, and Shopify access tokens are encrypted again with a key kept outside the database.
• The database is backed up automatically every day and backups are kept for about a week. We do not copy production customer data to laptops, spreadsheets or test systems; test and production use separate databases.
• We store only what the programme needs. When Shopify sends a customer erasure request we remove the customer's identity and contact details, and when a store uninstalls we delete its data within 30 days. See the privacy policy for each field and how long it is kept.

Reporting a problem

If you believe you have found a security issue, write to hello@loyalxp.com. Include what you saw, where, and how to reproduce it. We acknowledge every report within one business day. We do not run a paid bounty programme, and we credit reporters who want to be credited.

What we do when something goes wrong

1. Detect: from alerts, logs, or a report to the address above.
2. Contain, within the first hour of confirming an incident: rotate affected secrets, revoke tokens, and switch off the affected route or feature.
3. Assess, within the first day: establish what data was involved, for which stores and over what period, using the access log and the ledger.
4. Notify: we tell Shopify immediately, and no later than 24 hours after becoming aware of an actual or suspected breach of merchant data, as Shopify's terms require. We tell each affected merchant by email without undue delay, and within 72 hours of confirming that their customers' personal data was involved: what happened, what was affected, what we did, and what they may need to do.
5. Fix: remove the cause, and restore from backup if data was damaged.
6. Review, within seven days: a written review of the cause and the fix, shared with affected merchants on request.

Who is responsible

LoyalXP is operated by Suryanarayana Enterprises LLP, Hyderabad, India. The person responsible for security and for this policy is the founder, Smaran Challapalli, reachable at hello@loyalxp.com.

Changes

If this policy changes in a way that affects you, the effective date above moves and we note the change here.