Security & data protection
Updated 23 October 2026A plain-language overview of the safeguards Bunty uses today and the responsibilities shared with store owners. This page is not a security certification or a promise that any online service can eliminate every risk.
Access to accounts
Bunty uses authenticated user accounts and store-level roles. Access to store management is checked against the user’s membership and role. Store owners are responsible for protecting their passwords, email accounts and authorised team access.
Store data separation
Database row-level controls and restricted server functions are used to keep one store’s private records separate from another store. Public storefront requests are limited to information intended for published websites and the minimum information required to place an order, booking or enquiry.
Private drafts and publishing
Website policies, customer stories and FAQs use separate draft and published versions. Private drafts are not returned through the public storefront endpoints. A store must explicitly publish content before it becomes public.
Encryption and infrastructure
Bunty is served over HTTPS. Its application and database are hosted through established managed infrastructure providers. Provider-level protections apply to information in transit and at rest, while Bunty applies application-level access controls on top.
Secrets and payment information
Private service credentials are kept in server-side configuration or protected secret storage and are not intentionally placed in browser code. Bunty does not currently store shoppers’ full card numbers. When an online payment provider is connected, sensitive payment credentials should be handled by that provider.
Data minimisation and lifecycle
Bunty collects the business, customer, order, booking and enquiry information needed to provide the service. Store owners can export records and request store deletion. Some limited information may be retained where required for fraud prevention, dispute handling, security, backups, legal obligations or service integrity, as described in Bunty’s policies.
Monitoring and maintenance
Bunty reviews provider logs and database security advisories, restricts privileged functions and tests important access boundaries. Security work is continuous; findings are prioritised according to their risk and impact.
Incident reporting
If you believe a Bunty account or store has been accessed improperly, change the affected password, remove unrecognised users and contact connect@bunty.store promptly with the store name and a description of the issue. Do not email passwords, payment credentials or unnecessary customer records.
Store-owner responsibilities
Store owners decide what customer information they collect, publish accurate policies, obtain required consent, restrict staff access and use downloaded customer data responsibly. Bunty’s safeguards do not replace the store owner’s legal and operational responsibilities.