Shopify app privacy policy template

This page lists what Shopify asks of an app that handles customer data and gives a free excerpt of template wording.

What Shopify asks for

Source: Shopify developer docs, Protected customer data, read 2026-10-12 as a summary from a page-reading tool, not verbatim.

Tell merchants what personal data the app processes and why, in a privacy policy or data protection agreement.
Process only the minimum personal data needed.
Name, address, phone and email are protected customer data (Level 2); request access in the Partner Dashboard.
Apply retention periods, respect consent and opt-outs, and encrypt at rest and in transit; Level 2 adds further security duties.
Shopify may request evidence of compliance.

Not covered by the page content read: the mandatory privacy webhooks. Check the current Shopify documentation for them.

Where a policy commonly falls short

Going only by the source above: not saying what personal data is processed and why, processing more than the app needs, and having no retention period or encryption statement you can back up. The source gives no rejection statistics, and this page does not promise app approval.

Free excerpt from the template

Four complete clauses, copyable as plain text. Replace every [[FIELD]].

1. Our role

For data about a merchant (the person or business that installs the app), we act as a controller. For data about a merchant's customers, we act as a processor (service provider) on the merchant's instructions, and the merchant is responsible for its own notices to customers.

2. Data we process

Merchant data: [[MERCHANT_DATA_LIST]]

Customer data received from the store: [[CUSTOMER_DATA_LIST]]

3. Shopify access scopes

The app requests these access scopes, each used only for the reason given: [[SCOPES_AND_WHY]]

We process only the minimum data needed for the app to work.

4. How long we keep data

[[RETENTION_PERIOD]]

When a merchant uninstalls the app, we delete or anonymize the merchant's store data as described in this section, and we act on deletion requests passed on by Shopify.

Fill-in checklist

List every Shopify access scope in your app and the reason for each.
Separate merchant data from customer data, and mark which customer fields are name, address, phone or email.
Decide your role (controller or processor) for each group and say so.
Set retention periods and write what happens on uninstall.
Check that encryption at rest and in transit is true for your stack.
Read Shopify's current documentation for the privacy webhooks and confirm your app handles them.

The full editable pack (7 templates in Markdown, PDF and HTML) is being prepared.