Effective date: October 17, 2026
Policy owner: JPGStudios LLC
Security and privacy contact: privacy@jpgstudios.us
1. Purpose and scope
This policy establishes how JPGStudios LLC identifies, reports, assesses, contains, investigates, remediates, and documents suspected or confirmed security incidents affecting Privacy Desk, its production systems, Merchant Personal Data, credentials, source code, logs, backups, or service providers.
This policy applies to every person authorized to administer Privacy Desk and to incidents reported by merchants, customers, Shopify, hosting or email providers, security researchers, or other third parties.
2. Definitions
- Security event: An observable occurrence that might affect the confidentiality, integrity, or availability of Privacy Desk or its data.
- Security incident: A security event that requires investigation or response because it might involve unauthorized access, disclosure, alteration, loss, destruction, misuse, or material unavailability.
- Personal Data Incident: A confirmed security incident involving Merchant Personal Data or other personal information.
- Merchant: A Shopify merchant using Privacy Desk.
3. Roles and authority
JPGStudios LLC designates an Incident Lead for every suspected incident. Until another person is formally assigned, the managing member of JPGStudios LLC serves as Incident Lead and is responsible for coordinating the response, maintaining the incident record, controlling evidence, making containment and recovery decisions, coordinating communications, obtaining specialist assistance, and confirming closure.
The Incident Lead may authorize emergency actions necessary to protect data or systems, including disabling integrations, revoking sessions, rotating credentials, restricting access, suspending affected functionality, or temporarily taking the service offline.
4. Reporting and intake
Suspected incidents must be reported promptly to privacy@jpgstudios.us. Reports should include the reporter’s contact information, date and time observed, affected systems or records, a description, relevant evidence, and actions already taken when available.
The Incident Lead will create an incident record, assign a severity, record decisions and actions with timestamps, and limit the record to information necessary for response and compliance.
5. Severity classification
- Severity 1 — Critical: Confirmed or strongly suspected unauthorized disclosure or destructive access involving Merchant Personal Data, widespread credential compromise, active exploitation, or material service compromise affecting multiple merchants.
- Severity 2 — High: A contained compromise or significant vulnerability that could affect protected data or a merchant, without evidence of widespread active exploitation.
- Severity 3 — Moderate: A security control failure, suspicious activity, or limited availability or integrity issue with low apparent data risk.
- Severity 4 — Low: An unsuccessful attempt, informational report, or issue with no identified effect on confidentiality, integrity, or availability.
Severity may be changed as facts develop. Severity 1 and 2 incidents receive immediate attention.
6. Response procedure
6.1 Triage and validation
The Incident Lead will determine whether the report is credible, identify potentially affected systems and data, establish an initial timeline, assign severity, and determine whether specialist or provider assistance is required.
6.2 Containment
Containment may include revoking sessions or credentials, resetting passwords, disabling affected services, restricting access, blocking malicious traffic, preserving affected resources, and contacting relevant service providers. Containment should minimize further harm while preserving evidence.
6.3 Evidence preservation and investigation
The response record will document relevant timestamps, affected systems, indicators, access and application logs, configuration or code changes, provider notices, and actions taken. Evidence will be access-controlled and preserved appropriately.
The investigation will seek to determine the cause and attack path, period of exposure, affected systems and merchants, affected data and approximate volume, whether data was viewed or changed, whether the incident remains active, and required corrective actions.
6.4 Notification and escalation
For a confirmed Personal Data Incident involving Merchant Personal Data, JPGStudios LLC will notify affected merchants without undue delay after becoming aware of the incident, consistent with the Privacy Desk Data Processing Addendum. Information may be provided in phases as the investigation develops.
Notifications will include, when reasonably available, the nature of the incident, affected data and Data Subjects, likely consequences, remediation measures, recommended merchant actions, and a follow-up contact.
The Incident Lead will assess obligations under Shopify agreements, applicable law, insurance terms, provider agreements, and merchant instructions. Merchants remain responsible for their own regulatory and Data Subject notifications as controllers, and JPGStudios LLC will provide reasonable assistance. Legal counsel will be consulted when duties or deadlines are uncertain.
6.5 Eradication, recovery, and monitoring
Before restoring normal operation, JPGStudios LLC will remove or mitigate the cause, rotate affected secrets, patch vulnerable components, validate controls, and test affected functionality. Restored systems will be monitored for recurrence.
7. Post-incident review
After containment and recovery, JPGStudios LLC will document the final timeline and root cause, affected data and systems, response effectiveness, notifications, corrective actions and owners, and required policy or technical changes. An incident is closed only after material corrective actions are tracked and the Incident Lead approves closure.
8. Service-provider incidents
Security notices from Shopify, Heroku, the database provider, Mailgun, DNS, email, source-control, or other providers will be assessed under this policy. JPGStudios LLC will determine the effect on Privacy Desk and Merchant Personal Data and perform required notification and remediation even when the incident originates with a provider.
9. Training, testing, and review
Authorized personnel must understand how to recognize and report incidents before receiving production access. This policy will be reviewed at least annually and after every material incident or substantial service change. JPGStudios LLC will perform and document at least one incident-response tabletop exercise each year.
10. Records and confidentiality
Incident records, evidence, and communications are confidential and accessible only to persons with a response, legal, or compliance need. Records will be retained according to documented legal and security-record retention requirements and securely deleted when no longer needed.
11. Related documents
- Privacy Desk Data Processing Addendum
- Privacy Desk Terms of Service
- Privacy Desk Subprocessor List
- Privacy Desk data-retention and access-control procedures
This policy describes operational security procedures and does not replace advice from qualified legal, privacy, insurance, or forensic professionals.