AfterSale Suite for Shopify · last changed 20 September 2026
AfterSale is built and run by Ștefănică Ștefan Gheorghe PFA, a sole trader registered in Romania.
Questions, requests and complaints: contact@maste.ro. Every message is answered within 48 hours, even when the answer is "still looking".
This is what happens when something goes wrong with the data AfterSale holds. It is written down so that it does not have to be invented on the day.
Any unauthorised access to, loss of, or disclosure of merchant or buyer data. Also: a leaked credential, a dependency with a known exploited vulnerability, a server that has been reached by someone who should not have reached it, and any bug that shows one shop's data to another.
1. Contain, within one hour of becoming aware. Rotate the affected credentials, revoke the affected tokens, and take the service offline if that is what it takes to stop the bleeding.
2. Assess, within 24 hours. Which shops, which data, over what period. The access trail and the server logs are the record used for this.
3. Notify. Affected merchants and Shopify are told without undue delay, and in any case within 72 hours of becoming aware, by email to the address on the installation. The notice says what happened, what data it touched, what has been done, and what the merchant should do. Where the law requires it, the Romanian supervisory authority (ANSPDCP) is notified in the same window.
4. Fix. A permanent fix ships with a test that fails without it.
5. Write it down. Within 14 days: what happened, why, what changed so that it cannot happen the same way twice. Merchants who ask are sent this.
Write to contact@maste.ro. A first answer comes within 48 hours. There is no bug bounty; there is credit in the changelog for anyone who wants it, and a straight answer for everyone.
The steps above are reviewed once a year, and after any incident above Low.