Security & Data Protection

Effective: November 11, 2026. Owner and data protection contact: Paz Elad, dev@possibilityfrontier.com. Reviewed at least once a year and whenever our systems change.

1. Scope and how we work

Romantic English LLC is a small US home-decor retailer run by one owner. We sell through our own store (romanticenglish.com, on Shopify), eBay and TikTok Shop. These policies cover our company systems and any personal data we receive, including data from TikTok Shop through our private, in-house app "Romantic English Shop Desk".

• One person, the owner, runs the business and its systems. There are no employees or contractors with access to customer data.
• Our in-house tools run on one company PC. They connect to TikTok Shop, Shopify and eBay only through those platforms' official APIs.
• Customer and order data stays in the platforms where it was created (TikTok Shop, Shopify, eBay). Our in-house app reads TikTok Shop data live through TikTok's API when it is needed and does not keep its own copy of buyer personal data.

2. Information Security Policy

• The owner is responsible for information security and for keeping these policies current.
• All connections to TikTok Shop, Shopify, eBay and our other services use HTTPS (TLS encryption).
• Our in-house app is reached only through an authenticated Cloudflare tunnel; it is not opened directly to the internet. Connecting to it needs a passphrase, and only a hash of that passphrase is stored.
• The company PC is protected by a firewall and by Microsoft Defender Antivirus.
• Daily security baseline: the company PC is protected by a strong password and its screen is locked whenever the owner is away from it, and the owner's Google and TikTok accounts use multi-factor (two-step) sign-in.
• API keys, app secrets and access tokens are never written into code, chat, email or logs. Access tokens are stored encrypted, and the encryption key is kept in Windows Credential Manager, separate from the encrypted tokens.
• Any action that changes data on TikTok Shop (for example shipping updates, refunds, price or stock changes, or messages to buyers) is only prepared by the app and needs a separate, manual confirmation by the owner before it is sent.

3. Access Control Policy (least privilege)

• Access to customer personal data is limited to the owner, and only for running the business: fulfilling orders, handling returns and refunds, and answering customers.
• Our TikTok Shop app is a private app authorized only for our own shop. It is not offered to other sellers.
• We request only the API permissions needed to run our own shop, and we remove access that is no longer needed.
• Accounts use the owner's own sign-ins. Passwords and verification codes are never shared or written down in our systems.
• If we ever give anyone else access, they will get only the access their task needs, and it will be removed when the task ends.

4. Data Classification and Encryption Policy

We sort the information we handle into three groups:

• Restricted: API keys, app secrets, access tokens and passwords. Stored only encrypted or in Windows Credential Manager; never logged, emailed or shared.
• Confidential: customer personal data, such as names, shipping addresses, phone numbers, order details and buyer messages. Kept in the sales platforms, read only when needed, and not written to disk by our in-house app. Our app's log records only basic request lines, not message text or buyer details.
• Internal: business records without personal data, such as product listings, stock levels and sales totals.

Encryption:

• In transit: all data is sent over HTTPS (TLS).
• At rest: TikTok Shop access tokens are encrypted (Fernet: AES with an HMAC check), with the key kept in Windows Credential Manager. Buyer personal data is not stored at rest by our app.

5. Incident Response Policy

A security incident is any suspected loss, theft, leak or unauthorized access to customer data, credentials or our systems. If we suspect one, the owner will:

• Contain it at once: revoke or rotate the affected keys and tokens, change passwords, and disconnect the affected app or device.
• Find out what happened, what data was involved and whose data it was.
• Notify TikTok Shop, and any affected seller or platform, by email within 72 hours of becoming aware of the incident, and keep them updated. Customers and authorities are notified where the law requires it.
• Fix the cause, then record what happened, what was done and what we changed so it doesn't happen again.

Incidents can be reported to us at dev@possibilityfrontier.com.

6. Vulnerability Management Policy

• Windows Update is used to keep the operating system patched, and security updates are installed as they are released.
• Microsoft Defender Antivirus runs on the company PC with automatic updates to its threat definitions.
• The firewall stays on.
• The software our in-house app depends on is kept up to date and updated promptly when a security fix is published.
• Keys and tokens are rotated whenever we suspect they may have been exposed.

7. Personal Data Protection Policy

• We use customer personal data only to fulfill orders, ship products, handle returns and refunds, answer customer questions and meet our legal obligations. We do not sell it or use it for any other purpose.
• We collect and read only the data we need for those purposes.
• Personal data received from TikTok Shop is processed in the United States.
• We will help TikTok Shop and our customers when a person asks to see, correct or delete their data, and we respond to such requests promptly.
• When our relationship with TikTok Shop ends, or the data is no longer needed, we delete any TikTok Shop customer data we hold and revoke our app's access.
• Our customer-facing privacy policy is published on romanticenglish.com and kept up to date.
• Data protection contact: Paz Elad, owner, dev@possibilityfrontier.com.