Security and data breach policy

Last updated 20 October 2026

This page explains how Algoritmi Solutions protects the store and customer data that Algoritmi Assist handles, and what we do if a security incident happens. It sits alongside our privacy policy.

How data is protected

• In transit: every connection to our website, dashboard, chat and API uses HTTPS.
• At rest: customer emails and mobiles from store orders are kept as salted one-way fingerprints, used only to check who is asking about an order. Where a store switches on reorder reminders or review requests, the customer's email is stored encrypted (AES-256-GCM). Store connection keys and Shopify access tokens are encrypted the same way, and Shopify tokens expire and renew automatically.
• Only what we need: from store orders we read the order number, status, items, total, tracking, email and phone. We don't read customer names or addresses.
• Separate stores: each store's data is kept under its own account and is only used for that store's assistant, reports and emails. We never sell it or use it to train AI models.

Who can access it

Access to production systems and data is limited to the founder of Algoritmi Solutions, through accounts protected by two-factor sign-in. Our hosting provider (Cloudflare) records sign-ins and changes to the account. Store staff see only their own store's data in their dashboard.

How long we keep it

• Order records and the log of reminder and review emails sent are deleted automatically after 24 months.
• Unsubscribes are kept so that a customer who opted out is never emailed again by that store.
• When a Shopify store uninstalls the app, Shopify asks us to erase its data 48 hours later and we delete everything for that store. Customer erasure requests from Shopify delete that customer's orders.
• Any store can ask us to delete its data at any time through hello@algoritmi.com.au.

If something goes wrong

If we suspect that store or customer data has been accessed, changed or lost without permission, we follow these steps:

1. Contain: within hours, cut off the access involved, rotate affected keys and tokens, and pause affected features if needed.
2. Assess: work out what data and which stores are affected, and whether the incident is likely to cause serious harm.
3. Notify stores: tell every affected store within 72 hours of confirming the incident, with what happened, what data was involved and what we have done.
4. Notify regulators and partners: where the Notifiable Data Breaches scheme applies, notify the Office of the Australian Information Commissioner and affected individuals as it requires. Where Shopify data is involved, notify Shopify as its Partner terms require.
5. Fix and review: fix the cause, check that it is fixed, and record what happened and what we changed.

Report a security issue

If you find a security problem in Algoritmi Assist, please tell us through hello@algoritmi.com.au. We reply within one business day.