Security & data protection

Last updated October 29, 2026. Questions: russ@ibluetext.com.

What we collect, and why

iBlueText sends and receives texts for businesses. To do that we process the phone numbers businesses ask us to text, the messages themselves, and, through our store and CRM apps, the customer's first name and order details needed to fill in a text (order number, tracking link). We use this data only to send the texts the business has switched on, show the conversation to that business, and handle replies and opt-outs. We do not sell personal data, use it for advertising, or share it with other businesses. Details are in our privacy policy.

Encryption

• In transit: every page, API call, webhook and app connection uses HTTPS (TLS). Webhooks from Shopify and requests from HubSpot are verified by their signatures before anything is processed.
• At rest: customer phone numbers and message text received through our Shopify app, raw webhook data from Shopify, and the access tokens for our Shopify, HubSpot and Wix apps are encrypted with AES-256-GCM before they are stored. The key is kept outside the website's files and database.
• Credentials: account passwords are stored as one-way hashes, and API keys are stored only as SHA-256 hashes, so neither can be read back.

Retention

• Texts created by our Shopify app are deleted 90 days after they are sent, and raw Shopify webhook data is erased after 30 days.
• When a store uninstalls the app, pending texts are cancelled at once, and all of the store's data is deleted when Shopify sends its shop-redact request (48 hours after uninstall).
• Customer erasure and data requests from Shopify are handled automatically, and data requests are answered within 30 days.
• API request logs are kept for 30 days.

Access

• Only the company's owner has access to production systems and personal data. There are no other staff with access.
• Servers are reached only over SSH with keys. Accounts that can reach production or our app listings use strong, unique passwords, with two-factor authentication turned on wherever the service offers it.
• Account and admin actions are written to an audit log, and every API call is logged (who, what, when, result; never message bodies or keys).
• Testing of our store and CRM apps is done on development stores and test accounts, not on merchants' live data.

Data loss prevention

• We store only the fields a feature needs, encrypt the sensitive ones, and delete them on the schedule above.
• Personal data is never sent to third parties beyond the services needed to deliver the text (for example, WhatsApp for WhatsApp messages, or an AI provider only if the business turns on AI replies).
• Secrets are kept in an encrypted store, never in code or source control.

Incident response policy

1. Detect: uptime and health monitoring, error logs and security alerts are reviewed; anyone can report a problem to russ@ibluetext.com.
2. Contain: affected keys and tokens are revoked and rotated, and affected systems are isolated or taken offline.
3. Assess: we determine what data, which businesses and which people were affected.
4. Notify: affected businesses, and the platforms involved (such as Shopify, HubSpot or Wix), are told without undue delay and within 72 hours of confirming a breach of personal data, with what happened and what to do. We also notify authorities where the law requires.
5. Recover and learn: we fix the cause, restore service, and write down what we changed so it doesn't happen again.

Report a security issue

Email russ@ibluetext.com with "Security" in the subject. We reply within 2 business days.