Shopify Shows How Apps Use Your Data

Shopify has always developed as a platform that can be tailored to the individual needs of merchants. One element of this flexibility is Shopify apps, which allow adding new functionalities to the store, both free and paid. Many merchants use popular Shopify apps, such as Shopify Flow and Translate & Adapt.

The use of apps involves the issue of shared data. Shopify shows users how apps use their data. Let's take a closer look, starting with data protection on Shopify.

Data Protection in a Shopify Store

Shopify treats data protection as one of the fundamental principles of the platform's operation. The tools it offers are designed to help merchants provide customers with greater transparency and control over data transfer. The solutions aim to meet legal standards in individual countries.

Shopify can act in various roles related to data processing:

• Data Processor - processing data according to instructions from the merchant

• Data Controller - if the store has Shopify Network Intelligence enabled, Shopify may in certain cases process data as a controller in accordance with its regulations and Data Processing Addendum

• International Data Transfer Rules - Shopify documents its obligations regarding the processing of customers' personal data in the Data Processing Addendum, which is part of the Shopify Terms of Service

Shopify also allows data deletion in accordance with specific privacy rules.

It is important to note that Shopify may recommend solutions, but ultimately it is not legally responsible for the compliance of a given store with legal requirements.

All privacy settings can be found in the Shopify admin panel.

GDPR and Shopify Apps

As mentioned above, Shopify provides a range of tools and information designed to help ensure compliance with GDPR, the General Data Protection Regulation.

When installing apps from the Shopify app store, it is worth paying attention to the privacy section and the app's data access (e.g., Data access). There you will find information regarding data processing.

Apps marked as "Built for Shopify" meet additional Shopify requirements for quality, performance, and security. Others should not be rejected outright, but it is certainly worth familiarizing yourself with their documentation.

An installed app may have access to personal data such as:

• personal information of the Shopify store owner (name, surname, email, phone number, location addresses)

• personal information of employees

• data of people creating content in the store (e.g., authors of blog posts or commenters)

• personal information of customers (name, surname, email, phone number, residential address). For example, apps dealing with order processing may also have access to location or operating system data.

Shopify Customer Data Security

Customer data security is ensured not only by merchants but also by the Shopify platform. Below is a summary:

Shopify:

• maintaining security standards - regular compliance audits, including SOC 1 and SOC 2 reports

• data encryption and technical safeguards limiting access to sensitive information

• implemented information security program - access rights management, data integrity protection, operational continuity assurance, and disaster recovery procedures

• provided privacy management tools - "Customer privacy" tab in the admin panel with the option to configure a cookie banner and privacy policy

Merchant:

• responsibility for handling customer data

• obligation to adapt the store to applicable law (using the Shopify platform alone will not guarantee compliance with regulations such as GDPR)

Shopify App Audit Step by Step

Regular app auditing is one of the simplest ways to increase store security and reduce the risk associated with excessive data access. It takes only a few minutes to check which apps are still needed, what permissions they have, and whether their scope is justified. Below you will find instructions on how to conduct a Shopify app audit step by step.

1. In the admin panel, open Apps. Select the one you want to audit

2. Review the sections below (the naming may vary in each app, so look for similar phrases)

1. privacy section - how the developer prepared the privacy policy and what personal data the app has access to

2. access and activity section - when and how the app last operated and what areas of the store it has access to

3. fees section - whether there is a subscription, or if fees are charged based on usage

4. Pixels and extensions section - what, if anything, the app adds to the store, customer accounts, cart, checkout

It is worth noting that if an app has extensive access to orders, customers, or products but is no longer used, it should be uninstalled.

During the audit, it is also worth answering a few questions:

• Is the app still being used?

• Are the app's permissions adequate for the function it is supposed to perform?

• Does the app have access to customer data?

• Does the app have actively used extensions?

• Does the app have fixed fees or usage-based billing?

• Is the app easy to uninstall?

If a merchant needs support in auditing their apps or uses many tools and finds it difficult to assess which ones are truly necessary, a Shopify agency specializing in working with stores and apps can provide assistance. With experience in working with various stores and apps, the agency can help determine which solutions should be kept, and which can be removed or replaced with more effective alternatives.

A good time to conduct such an audit is also during a migration to Shopify. When moving a store to a new platform, it is worth verifying what permissions the installed apps will receive and whether they are truly necessary for the proper functioning of the store. This allows for better data security and organization of the tools used already at the implementation stage.

How to uninstall a Shopify app without losing data

To uninstall an app, simply go to its menu and find the "Uninstall" button. Does this operation, however, mean preserving customer data?

Here, too, everything depends on the individual operating principles of a specific application. Therefore, before uninstalling it, it is worth verifying the documentation and information regarding data storage. However, three common scenarios can be distinguished:

• Data is stored by the app - after uninstalling the app, data may still remain on the developer's servers for a specified period or be deleted according to their policy.

• Data is saved in Shopify - some apps create or save information in metaobjects, metafields, or other Shopify areas. In such cases, even after uninstallation, these resources may remain.

• The app automatically deletes data upon uninstallation - some apps offer to delete all data along with the uninstallation of the app.

Whether data will be retained after deleting a Shopify app depends on its developer and the method of information storage. Before uninstalling, it is worth checking the app's documentation and making a backup of your data if possible.

It is also worth checking whether the app has not left changes in the theme code, pixels, or other elements of the store, as some integrations require manual removal of remnants.

Considering all the above issues, it is also worth considering the risks associated with using apps installed on Shopify.

Are Shopify apps safe and is there a risk in using Shopify apps?

Shopify apps can be safe. Everything depends on where the app comes from and what data it requests access to. Apps available in the Shopify App Store undergo a verification process consistent with Shopify's requirements, but responsibility for app selection and configuration still lies with the merchant. Apps installed via an external link are not automatically unsafe, but it should be remembered that they have not undergone the same verification process. Other custom apps can also be safe, but here one should rely heavily on their developer and configuration method.

The risk of using Shopify apps can therefore be associated with:

• an app that has overly broad permissions

• an app that has access to customer data

• an app that was installed from a location other than the Shopify App Store

• external or custom integration

Summary

Shopify apps are an important element in expanding a store, but each installation involves a specific scope of data access. Regularly checking permissions, removing unused tools, and making informed app choices help to limit risk and better protect customer information. New Shopify features increase transparency, but the ultimate responsibility for how data is used still lies with the merchant.