Shopify App Privacy Policy
Last updated: October 21, 2026
This policy applies to Shopify apps published by SiAZ ("we," "us") through the Shopify App Store, unless an app's listing links to its own policy. It explains what data our apps access when a merchant installs them and how we handle it. Our Shopify themes do not send store or customer data to us. They are covered by our general Privacy Policy.
1. Roles
- Merchant data: for the store owner's account and contact details, we are the controller.
- Customer data: for the data of a merchant's customers that an app processes, the merchant is the controller. We act as the merchant's processor (or "service provider" under US state laws). We use that data only to provide the app's features to the merchant.
2. What we access
When a merchant installs an app, Shopify asks the merchant to approve a set of permissions ("scopes"). Each app requests only the scopes it needs, and its listing explains why. Depending on the app, this may include:
- Store information: shop domain, store name, owner name and email, currency, language, and plan
- Product and order data: products, inventory, orders, and fulfillment status, when a feature needs them
- Customer data: names, emails, and addresses, only if a feature needs them and the merchant has approved access to protected customer data
- App settings: the configuration the merchant chooses inside the app
We do not sell this data, use it for advertising, or combine it across merchants for our own purposes.
3. How we use it
We use the data to provide, maintain, and support the app; to bill through Shopify; to prevent abuse; and to meet our legal obligations.
4. Privacy requests and uninstalls
Our apps subscribe to Shopify's three mandatory compliance webhooks and verify every request's HMAC signature:
customers/data_request: when a customer asks the merchant for their data, we send the merchant the data the app holds about that customer within 30 days.customers/redact: when Shopify tells us to delete a customer's data, we delete the personal data the app holds about that customer within 30 days, unless the law requires us to keep it.shop/redact: Shopify sends this 48 hours after a merchant uninstalls the app. We then delete the shop's data within 30 days, unless the law requires us to keep it.
5. Where data is stored and who helps us
Each app's listing and settings name the hosting providers it uses, such as Cloudflare or a cloud database provider, and the regions where data is stored. We bind these providers to contracts that protect the data. Transfers outside the EEA, UK, or Switzerland use the safeguards described in our Privacy Policy.
6. Security
Apps use HTTPS and verify Shopify webhook signatures. They store access tokens and secrets outside source code with restricted access, and limit staff access to what support requires.
7. Retention
We keep merchant and customer data only while the app is installed and for the deletion periods above. Billing records are kept as long as tax law requires.
8. Contact
Merchants and their customers can reach us at . Merchants who need a data processing agreement can request one at the same address.