A
Least privilege
Authorization scopes are limited to data needed for dashboards, synchronization, diagnostics, and reporting.
Trust center
Security and Data Handling
How semfeed protects connected commerce, advertising, and analytics data.
B
Server-side tokens
OAuth tokens are exchanged and stored by backend services, not exposed on public website pages.
C
User control
Users can disconnect integrations or request deletion of account and connected-source data.
1. Operational controls
semfeed is designed as an authenticated SaaS application. Production deployments should use HTTPS, environment-managed secrets, access-controlled databases, audit logging, separate development and production environments, and monitored backend services.
2. OAuth and integration handling
Authorization begins only when a signed-in user chooses to connect a platform. The service validates callback parameters, exchanges authorization codes on the server, records granted scopes, and associates authorized resources with the user's workspace.
Access tokens and refresh tokens are stored server-side and encrypted with application-level encryption before persistence. Tokens are decrypted only when required to call the corresponding platform APIs. Public website pages do not expose platform credentials or OAuth client secrets.
Transport between browsers, semfeed services, and Google / commerce APIs uses TLS/HTTPS. Users can disconnect Google Analytics, Google Ads, Google Search Console, and other sources in the application to clear local connection records and stop further synchronization.
3. Access control
Product data is scoped to authenticated users and authorized shops or workspaces. Backend requests from the web application use internal authentication headers and user identity checks before accessing protected resources.
4. Transparency and data use
Users should be able to understand what the product does, what sources are connected, where connected data appears, and how to disconnect or request deletion. Connected platform data is used for user-facing dashboards, diagnostics, synchronization, alerts, action tasks, and reporting.
5. Disconnect and deletion
Users may disconnect data sources in the application. Account deletion, privacy, and data access requests can be submitted through support. For Shopify app privacy events, semfeed provides webhook endpoints for customer data requests, customer redaction, and shop redaction.
6. Contact
Security and privacy questions can be sent to taow23044@gmail.com.