Security and data protection

What we store

• Account data: name, email, company, role. Sign-in is passwordless by default (an emailed code or link); sessions are stored only as hashes.
• Your setup: store URL, imported public catalog data, prompts, competitors and actions.
• AI answers we collect for your prompts. Raw provider responses are kept 14 days; full answer text 45 days, after that a 1,000-character excerpt.
• If you connect Shopify: product data and, per order, the order id, date, total, currency, referring site, landing page and UTM source. We do not store customer names, emails or addresses.
• Billing: only Paddle customer and subscription ids, plan and status. Paddle holds payment data; we never see card numbers.

Shopify access: read-only

We request two read scopes and nothing else: read_products (catalog, GTINs) and read_orders (orders from the last 60 days). For a longer before/after baseline we will ask you separately for read_all_orders once Shopify has approved it. We cannot change your store, products, prices or orders. Tracking itself needs no Shopify connection at all; we read your public pages. The Shopify connection is coming soon.

You can disconnect in the app at any time; the token is deleted. If you uninstall the app in Shopify, we delete the token when Shopify notifies us.

Encryption and access

• HTTPS only, with HSTS. A strict Content Security Policy on every page.
• Shopify tokens and webhook secrets are encrypted at rest with AES-256-GCM. Each ciphertext is bound to its store or rule, so it cannot be swapped to another account.
• Every database query for customer data goes through one access layer that requires your account id. Agency client logins are read-only and limited to the stores assigned to them.
• API keys are read-only and scoped to one account. Sign-in, forms and the free scan are rate-limited and protected by Cloudflare Turnstile.
• Security-relevant actions (sign-ins, member and role changes, API keys, store connections, exports, deletions) are written to an audit log.

Infrastructure

The app runs on Cloudflare Workers with a Cloudflare D1 database. There are no servers of our own to patch or forget. Some processors are located outside the EU/EEA (notably the USA); transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses. Our privacy policy and the data processing agreement (DPA) under Art. 28 GDPR are linked below.

Who processes data for us

Export and deletion

Export your data as CSV at any time. You can delete your account yourself in the settings: we cancel the subscription with Paddle, delete all account data and stored raw answers, and remove logins that no longer belong to any account. Records we must keep for tax law stay for the statutory period; the audit log keeps a deletion entry without personal data.

Free scan reports expire after 30 days.

Report a security issue

Email support@huntr-app.com with "Security" in the subject. Please give us a reasonable time to fix an issue before you disclose it.