Research guide
Shopify privacy policy requirements for apps and stores
Shopify app developers must present merchants with a privacy policy that complies with applicable privacy laws, delete merchant data after uninstall, and handle Shopify's mandatory privacy webhooks for data requests and redaction. Store owners must publish their own privacy policy, which Shopify links from the checkout footer once it is added under Settings, Policies. Shopify's templates are a starting point, but merchants remain responsible for following what they publish.
What the Shopify API terms require of app developers
Shopify's API License and Terms of Use, section 6.1.3, state that the developer will have in place and will present the merchant with a privacy policy that complies with all applicable privacy laws. The policy should describe the app's services and the merchant data and customer personal information it accesses. Section 6.2 addresses what happens after the relationship ends: the app must delete merchant data within 30 days after the merchant uninstalls the app or asks for deletion, subject to the exceptions in the terms. Your policy should describe that timeline truthfully.
Mandatory privacy webhooks
Shopify's privacy law compliance documentation requires apps distributed through the Shopify App Store to subscribe to three compliance webhooks: customers/data_request, when a customer asks a merchant for their data; customers/redact, when a merchant requests deletion of a customer's data; and shop/redact, sent after a store uninstalls the app. Shopify states that any app distributed through the Shopify App Store must respond to data subject requests, regardless of whether the app collects personal data. Your privacy policy should explain how these requests are handled and the timeframes involved.
Who is the controller in a Shopify app
For most embedded apps the merchant decides why customer data is processed and the app processes it to deliver the service, which makes the app a processor or service provider for customer data. The app developer is usually a controller for its own merchant account data, such as the store owner's contact details, billing, support conversations, and usage analytics. A good app privacy policy separates these two roles, explains which data the app reads through the Admin API scopes it requests, and describes any data the app stores outside Shopify.
What an app privacy policy should cover
Name the developer and contact details; list the Shopify data the app accesses, such as orders, customers, products, or storefront events, tied to the scopes requested; explain why each is needed; describe storage location, sub-processors such as hosting, email, analytics, and AI providers, retention, deletion after uninstall, and the webhook-driven request process; and state international transfers and regional rights for merchants and their customers. If the app injects scripts into storefronts, describe any cookies or tracking they set, because merchants need that information for their own notices and consent tools.
Store owners: publishing the merchant privacy policy
Shopify's Help Center explains that merchants add store policies under Settings, Policies, where an Insert template option is available. Policies added there are automatically linked in the footer of checkout pages. Shopify notes that although it can generate templates, the merchant is responsible for following the published policies. A template does not know which apps, analytics, advertising pixels, email tools, or payment providers a store uses, so the published text must be edited to match the store's real setup.
Store policy content that often needs attention
Shopify stores typically process customer contact and shipping details, order history, payment status from Shopify Payments or other gateways, marketing consent, abandoned-checkout emails, analytics and advertising pixels, reviews, and support messages. Each installed app may add processing. The store policy should list these purposes and recipients, explain marketing opt-outs, describe retention of order records for accounting and tax, and cover the regions the store sells into, such as the EU, UK, California, or Canada.
Generating the right policy
App developers can choose the SaaS platform in the questionnaire to describe merchant accounts, integrations, providers, retention, and transfers; merchants can choose the store platform to activate payment, fulfillment, marketing, and regional clauses. The generator names only the providers you select and produces a hosted link you can paste into Shopify's policy settings or your app listing. It does not implement Shopify's webhooks for you; the policy should describe the handling you have actually built.
Official sources checked for this guide
Platform rules and legislation can change. Verify the current text before publishing or making a high-risk decision.
Common questions
Does a Shopify app need its own privacy policy if the merchant has one?
Yes. The API terms require the developer to present the merchant with the app's own privacy policy. The merchant's store policy covers the store's processing, not the app developer's.
Can I use Shopify's policy template as is?
Shopify states that merchants are responsible for following their published policies. Edit any template so it matches the apps, providers, and practices your store actually uses.