Privacy Policy

GuardianStack - Shopify App
Last Updated: 28 July 2026

TL;DR (Plain English Summary)

• We scan your Shopify store to find compliance gaps and suggest fixes.
• We store limited customer personal data only when you run retention exports.
• We store your shop domain, scan results, and account details needed to run the service.
• We store generated compliance artefacts (for example retention exports and review certificates) so you can re-download audit evidence.
• We use limited, cookieless website analytics to understand which public pages and campaigns lead to scans or installs.
• We share data only with trusted providers (e.g., Supabase, OpenAI, Shopify) to operate the service.
• You can request access, correction, or deletion of your data at any time.

1. Who We Are

GuardianStack is operated by MikaHari Labs Ltd, a company registered in England and Wales (Company No. 14894353).

Contact Details:

• Registered Address: 71-75 Shelton Street, London, England, WC2H 9JQ
• Company No.: 14894353
• Email: support@guardianstack.com
• Website: https://guardianstack.com

GuardianStack acts as the Data Controller for data processed through our app.

2. Information We Collect

2.1 Information from Shopify (via Shopify API)

When you install GuardianStack, we access the following data to run scans and generate recommendations:

Important: GuardianStack stores limited customer personal data only when you explicitly run retention exports. These artefacts are stored privately for audit and re-download, then removed under our retention schedule or on request.

2.2 Information You Provide

• Business context (industry, company size, jurisdiction)
• Onboarding responses and questionnaire answers
• Company profile details used for penalty estimation (e.g., turnover, headcount)
• Support communications

2.3 OAuth Access Token

We securely store your Shopify OAuth token to access your store. This token:

• Is encrypted at rest
• Is never exposed to frontend applications
• Is only accessed by server-side functions
• Is deleted when you uninstall the app

2.4 Public Website Analytics

When someone visits an approved public GuardianStack page, we record:

• the page path, with scan tokens and trust-centre slugs removed;
• sanitised campaign tags such as UTM source, medium, and campaign;
• the referring website hostname, without the full referring URL;
• whether the request belongs to the live, test, or development environment;
• a daily rotating pseudonymous visitor key used for aggregate counting.

The daily visitor key is created on our server from the request IP address and browser user-agent using a keyed one-way hash. We do not store the raw IP address or full user-agent in the website analytics ledger. The key changes each UTC day and cannot be used to follow someone across other websites.

We do not record URL query strings, email addresses, scan tokens, free-text referrers, advertising identifiers, session replay, or cross-site profiles in this ledger.

3. Data Subjects and Data Categories

3.1 Data Subjects

We may process data relating to:

• Shopify merchants and store owners
• Store staff authorised to use the app
• Store customers where required for retention export artefacts

3.2 Data Categories

• Account data (store domain, account identifiers)
• Store configuration data (installed apps, scripts, policies)
• Compliance scan outputs (gaps, scores, action items)
• Company profile information (sector, headcount, turnover)
• Support communication data

4. How We Use Your Information

We use your information to:

1. Provide compliance scanning and diagnostics
2. Generate compliance recommendations and action plans
3. Calculate risk and penalty exposure estimates
4. Improve our detection accuracy and product experience (using aggregated, anonymised data)
5. Provide support and troubleshoot issues
6. Generate and store compliance artefacts you trigger (for example retention exports, DPA drafts, and review certificates)

We do not:

• Sell your data
• Use your data for advertising
• Share individual store data publicly

5. Legal Basis for Processing (UK GDPR)

6. Data Sharing and Sub‑Processors

We use trusted service providers to operate GuardianStack:

We maintain a list of sub‑processors and will notify customers of material changes. View the current list here: https://guardianstack.com/legal/subprocessors.

7. Data Retention

When you uninstall GuardianStack, we:

1. Mark your connection inactive immediately
2. Delete your OAuth token within 48 hours
3. Respond to Shopify GDPR webhooks to delete all data

8. Data Security

We implement technical and organisational measures including:

• TLS 1.3 encryption in transit
• AES‑256 encryption at rest
• Row‑level security on databases
• Access control and audit logging
• Routine security testing and monitoring

9. Your Rights (UK GDPR)

You have the right to:

We may request verification to protect your data. We respond within 30 days.

10. International Transfers

Your data may be processed in the UK, EU, and the US. For transfers outside the UK/EU, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards.

You can request copies of relevant safeguards by emailing support@guardianstack.com.

11. Cookies

GuardianStack uses minimal cookies or local storage required for authentication, security, and remembering that you have seen our privacy notice:

Our website analytics does not use cookies, local storage, session storage, advertising identifiers, session replay, or cross-site tracking. We do not use advertising cookies.

12. Children’s Privacy

GuardianStack is a B2B service and is not intended for use by individuals under 18. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Email (if we have your contact details)
• In‑app notification
• Updating the “Last Updated” date above

14. Complaints

If you have concerns:

1. Contact us: support@guardianstack.com
2. You can also lodge a complaint with the ICO:
   • Website: https://ico.org.uk/make-a-complaint/
   • Phone: 0303 123 1113

15. Contact Us

Data Controller:
MikaHari Labs Ltd
Registered Address: 71-75 Shelton Street, London, England, WC2H 9JQ
Company No.: 14894353
Email: support@guardianstack.com
Website: https://guardianstack.com

This Privacy Policy is effective as of 2 March 2026.