Information Security Policy

1. Introduction

At Meowgic, protecting the security, confidentiality, integrity, and availability of information is a fundamental part of our commitment to customers, partners, and users.

As an AI-powered commerce platform, Meowgic provides tools and services that help e-commerce businesses manage their stores, optimize product listings, create applications, automate workflows, and improve business operations.

We recognize the importance of protecting business information, customer data, platform credentials, and information accessed through third-party integrations.

This Information Security Policy establishes the principles, responsibilities, and security requirements governing how Meowgic protects information throughout its lifecycle.

Our security program is designed to identify, assess, mitigate, and monitor information security risks while supporting applicable legal, regulatory, contractual, and platform security requirements.

2. Purpose and Objectives

The purpose of this policy is to establish a consistent framework for managing information security risks across Meowgic's operations.

Our primary security objectives are to:

• Protect sensitive business, customer, and personal information against unauthorized access, disclosure, modification, or destruction.

• Maintain the confidentiality, integrity, and availability of information systems and services.

• Establish appropriate access controls and authentication mechanisms.

• Prevent, detect, and respond to information security incidents.

• Ensure secure integration with third-party e-commerce platforms and APIs.

• Promote security awareness and accountability throughout the organization.

• Maintain compliance with applicable data protection laws and platform security requirements.

• Continuously review and improve our information security practices.

3. Scope

This policy applies to all information assets, systems, applications, infrastructure, processes, and individuals involved in Meowgic's operations.

It includes:

• Meowgic websites, applications, APIs, and AI-powered services.

• Cloud infrastructure, databases, and supporting systems.

• Customer accounts, merchant information, and business data.

• Data accessed through authorized third-party platform integrations.

• Employees, contractors, and authorized service providers.

• Devices and systems used to access company or customer information.

• Development, testing, deployment, and production environments.

All personnel and authorized third parties handling Meowgic information must comply with the applicable requirements of this policy.

4. Information Security Governance

Meowgic management is responsible for establishing, maintaining, and overseeing the organization's information security program.

Security responsibilities include:

Management Responsibilities

• Approving and reviewing information security policies.

• Assigning responsibility for security-related activities.

• Allocating appropriate resources for information security.

• Evaluating significant security risks and corrective actions.

Technical and Operational Responsibilities

• Implementing and maintaining security controls.

• Managing access permissions and authentication.

• Monitoring systems for security vulnerabilities and incidents.

• Applying security updates and remediation measures.

• Maintaining secure development and deployment procedures.

Employee and Contractor Responsibilities

• Following applicable security policies and procedures.

• Protecting account credentials and confidential information.

• Accessing information only for authorized business purposes.

• Promptly reporting suspected security incidents.

• Completing applicable security awareness activities.

Security responsibilities must be reviewed when organizational or operational changes materially affect the security program.

5. Information Classification and Data Protection

Meowgic classifies information according to its sensitivity, business value, and protection requirements.

Information may be categorized as:

• Public Information: Information approved for public disclosure.

• Internal Information: Operational information intended for authorized internal use.

• Confidential Information: Customer information, business records, internal documentation, and other non-public information requiring restricted access.

• Restricted Information: Highly sensitive information, including authentication credentials, API secrets, access tokens, and sensitive personal data.

Appropriate security measures must be applied according to the classification and sensitivity of the information.

Meowgic follows these data protection principles:

• Collect and process only information necessary for legitimate, authorized business purposes.

• Restrict access based on business requirements.

• Protect sensitive information during transmission and storage.

• Avoid unnecessary duplication or retention of sensitive data.

• Prevent unauthorized disclosure of customer or merchant information.

• Securely delete or anonymize information when it is no longer required, subject to applicable legal and contractual obligations.

6. Access Control and Authentication

Access to Meowgic systems and information must follow the principles of least privilege and need-to-know access.

Security requirements include:

• Assigning access permissions according to authorized roles and responsibilities.

• Using unique accounts for authorized personnel where technically supported.

• Requiring strong authentication mechanisms for sensitive systems.

• Applying multi-factor authentication to privileged and sensitive accounts where supported.

• Restricting access to production systems, databases, credentials, and administrative functions.

• Reviewing access permissions periodically and when personnel responsibilities change.

• Promptly revoking access when it is no longer required.

• Prohibiting unauthorized sharing of account credentials.

Administrative and privileged access must receive additional scrutiny appropriate to the level of risk.

7. Encryption and Secure Data Transmission

Meowgic requires appropriate technical safeguards to protect information during storage and transmission.

These safeguards include:

• Using secure communication protocols, such as HTTPS and TLS, for transmitting sensitive information.

• Protecting sensitive information stored in databases and cloud infrastructure through appropriate encryption and access controls.

• Securing API credentials, authentication tokens, and other application secrets.

• Restricting access to encryption keys and credentials.

• Avoiding the inclusion of sensitive information in publicly accessible source code, application logs, or client-side resources.

• Reviewing encryption and credential management practices as technologies and security requirements evolve.

Encryption mechanisms must be selected and maintained according to the sensitivity of the information and applicable security requirements.

8. Third-Party Platform and API Security

Meowgic integrates with third-party commerce platforms and services to provide authorized merchant functionality.

These integrations may include TikTok Shop, Shopify, SHOPLINE, Shoplazza, and other supported platforms.

To protect merchant information, Meowgic establishes the following requirements:

Authorization and Permissions

• Access merchant information only through authorized integration mechanisms.

• Request only the API permissions necessary to provide the requested functionality.

• Respect platform authorization scopes and merchant permissions.

• Discontinue unauthorized access following the revocation or expiration of authorization.

API Credential Protection

• Protect access tokens, refresh tokens, application secrets, and authentication credentials.

• Restrict sensitive credential access to authorized systems and personnel.

• Avoid exposing confidential API credentials in publicly accessible application code.

• Revoke, rotate, or invalidate credentials when appropriate, including after suspected compromise.

Merchant Data Protection

• Process merchant data only for legitimate, authorized service purposes.

• Maintain appropriate logical separation between different merchants' information.

• Prevent unauthorized cross-merchant access or disclosure.

• Avoid collecting merchants' platform account passwords through unauthorized methods.

• Prohibit unauthorized resale, disclosure, or misuse of platform data.

Platform Compliance

All integrations must comply with applicable platform developer agreements, API policies, data protection requirements, and security guidelines.

For TikTok Shop integrations, Meowgic must comply with applicable TikTok Shop Partner Center requirements and developer security policies.

9. AI Services and Data Processing Security

Meowgic uses artificial intelligence technologies to provide commerce-related services, including content generation, store optimization, design assistance, and workflow automation.

AI-related information processing must follow the same security principles applied to other services.

Our AI security requirements include:

• Processing customer and merchant data only for authorized service purposes.

• Limiting information shared with AI service providers to what is necessary for the requested task.

• Assessing AI service providers' security, confidentiality, and data handling practices.

• Protecting sensitive information transmitted to AI processing services.

• Restricting unauthorized access to AI-generated content and associated business information.

• Evaluating data retention and permitted data use when selecting AI service providers.

• Applying appropriate controls to prevent unauthorized disclosure of confidential information through AI-powered workflows.

Third-party AI processing must remain subject to applicable contractual, privacy, and security obligations.

10. Secure Software Development

Security must be considered throughout the software development lifecycle.

Meowgic establishes secure development requirements covering design, implementation, testing, deployment, and maintenance.

These requirements include:

• Applying secure coding practices.

• Reviewing application changes according to their security impact.

• Protecting source code repositories and development credentials.

• Restricting access to production environments.

• Managing sensitive configuration values and secrets securely.

• Testing applications for security vulnerabilities appropriate to their risk.

• Maintaining processes to identify and remediate software vulnerabilities.

• Applying appropriate change management and deployment controls.

• Preventing the unnecessary use of real sensitive customer data in development and testing environments.

Security-related defects must be prioritized and addressed according to their severity and potential impact.

11. Infrastructure and Network Security

Meowgic's cloud and application infrastructure must be managed using risk-appropriate security controls.

Infrastructure security requirements include:

• Restricting access to cloud management consoles and production infrastructure.

• Using appropriate network and service access restrictions.

• Keeping systems and software dependencies updated.

• Reviewing system configurations for security risks.

• Protecting databases and storage services against unauthorized access.

• Maintaining appropriate system monitoring and operational logging.

• Securing backup resources and administrative functions.

• Disabling or removing unnecessary services and exposed interfaces where practical.

Infrastructure security controls must be reviewed when significant architectural changes occur.

12. Security Monitoring and Vulnerability Management

Meowgic establishes processes for identifying and managing potential security threats and vulnerabilities.

Security activities include:

• Monitoring relevant systems for suspicious or unauthorized activity.

• Recording security-relevant events as appropriate.

• Reviewing identified vulnerabilities and assessing their potential impact.

• Prioritizing remediation according to risk and severity.

• Applying security updates and patches within appropriate timeframes.

• Investigating unusual authentication, application, or system behavior.

• Reviewing security controls following material changes or incidents.

Monitoring and logging practices must protect personal information and avoid unnecessary exposure of sensitive data.

13. Security Incident Response

Meowgic maintains an information security incident response process intended to identify, contain, investigate, and remediate security incidents.

Potential incidents may include unauthorized access, credential compromise, data exposure, malicious activity, and service disruption.

The incident response process consists of:

1. Identification

Identify and assess reported or detected events to determine whether a security incident has occurred.

2. Containment

Take appropriate actions to limit the impact of the incident and prevent further unauthorized activity.

3. Investigation

Determine the nature, scope, cause, and potential consequences of the incident.

4. Remediation

Address identified vulnerabilities, remove unauthorized access, rotate affected credentials where necessary, and implement corrective measures.

5. Recovery

Restore affected systems and services while taking reasonable steps to verify their security and integrity.

6. Notification

Notify affected parties, relevant platform providers, or regulatory authorities when required by applicable law, contractual obligations, or platform security requirements.

7. Post-Incident Review

Evaluate the incident, document relevant findings, and identify improvements to reduce the likelihood or impact of similar events.

Security incidents must be escalated promptly to the responsible personnel.

14. Third-Party Service Provider Security

Meowgic may use third-party service providers to support hosting, infrastructure, databases, artificial intelligence capabilities, monitoring, and other business operations.

Third-party providers that process or access sensitive information must be evaluated according to the nature and risk of their services.

Security considerations include:

• Appropriate data protection and confidentiality commitments.

• Access control and authentication practices.

• Secure data transmission and storage.

• Incident response and notification arrangements.

• Data retention and deletion obligations.

• Applicable privacy and regulatory requirements.

• Risks associated with subprocessors or additional service providers.

Access granted to third parties must be limited to authorized purposes and reviewed as appropriate.

15. Data Retention and Secure Deletion

Meowgic must retain information only for as long as necessary to fulfill legitimate business purposes or applicable legal, contractual, and platform requirements.

Data retention requirements include:

• Defining retention periods appropriate to the information category and processing purpose.

• Avoiding unnecessary long-term storage of merchant or customer data.

• Supporting deletion or anonymization when information is no longer required.

• Addressing authorized account deletion and data removal requests.

• Removing or invalidating integration credentials when authorization is revoked or no longer required.

• Applying appropriate controls to backup data and stored copies.

• Preserving information where retention is required by applicable law or legitimate legal obligations.

Following the termination of a merchant integration, access to the relevant platform data must cease, and associated stored data must be handled according to applicable deletion and retention requirements.

16. Business Continuity and Disaster Recovery

Meowgic recognizes the importance of maintaining service availability and recovering from operational disruptions.

Business continuity requirements include:

• Identifying critical systems and service dependencies.

• Maintaining appropriate backup and recovery arrangements.

• Protecting backup information against unauthorized access.

• Establishing procedures for responding to service interruptions.

• Reviewing recovery capabilities according to operational risk.

• Restoring critical services in a controlled manner following significant disruptions.

Business continuity and recovery procedures must be reviewed and updated when material changes affect critical services.

17. Personnel Security and Awareness

All personnel with access to Meowgic systems or confidential information are expected to understand their information security responsibilities.

Security awareness activities must address relevant topics, including:

• Password and authentication security.

• Phishing and social engineering risks.

• Protection of confidential customer information.

• Secure handling of API credentials and access tokens.

• Responsible use of company systems and third-party services.

• Recognition and reporting of security incidents.

Personnel access must be adjusted or revoked when roles change or access is no longer authorized.

18. Privacy and Regulatory Compliance

Meowgic is committed to handling information in accordance with applicable privacy and data protection requirements.

Our information security program supports compliance with relevant laws, contractual obligations, and third-party platform policies.

Where applicable, these may include:

• Data protection and privacy laws in jurisdictions where services are offered.

• Contractual confidentiality and data processing obligations.

• Platform-specific developer and API security requirements.

• Requirements concerning personal information access, disclosure, retention, and deletion.

This Information Security Policy complements Meowgic's Privacy Policy and Terms of Service.

In the event of a conflict with an applicable legal obligation or mandatory platform requirement, the relevant legal or platform obligation must be addressed accordingly.

19. Information Security Risk Management

Meowgic uses a risk-based approach to identifying, assessing, and managing information security threats.

Risk management activities include:

• Identifying important information assets and systems.

• Evaluating potential threats, vulnerabilities, and business impacts.

• Assessing security risks associated with new services and integrations.

• Implementing appropriate risk mitigation measures.

• Reviewing significant risks following major technical or operational changes.

• Tracking corrective actions where security weaknesses are identified.

Security measures must be proportionate to the sensitivity of the information and the potential consequences of a security incident.

20. Policy Review and Continuous Improvement

Meowgic is committed to maintaining and improving its information security practices.

This policy must be reviewed at least once every 12 months and whenever significant changes occur in:

• Business operations or organizational structure.

• Technical infrastructure or service architecture.

• Applicable laws or regulatory obligations.

• Third-party platform security requirements.

• The organization's threat or risk environment.

• Security incidents requiring policy or procedural changes.

The review process must evaluate whether existing security requirements remain appropriate and effective.

Updates must be approved by the designated responsible management representative and communicated to relevant personnel.

The current approved version of this policy will be made available through Meowgic's official website.

21. Policy Enforcement

All employees, contractors, and authorized personnel are expected to comply with this policy.

Suspected violations must be reported to the appropriate responsible personnel for investigation.

Non-compliance may result in corrective actions, restriction or removal of system access, termination of contractual access rights, or other actions appropriate to the circumstances and applicable requirements.

22. Contact Information

For questions regarding this Information Security Policy, security concerns, suspected security incidents, or reports of potential security vulnerabilities, please contact our security team.

Meowgic Security Team
Email: safe@meowgic.ai
Website: https://meowgic.ai

All security-related inquiries will be reviewed and handled by the appropriate personnel in accordance with our information security procedures.