By platform

Privacy Policy Generator for Shopify

Written for Shopify checkout, Shopify Payments, the app ecosystem and the customer privacy API.

Generate your privacy policy Read the privacy policy guide

A Shopify privacy policy has to account for three layers at once: what Shopify collects as your processor, what Shopify collects as a controller for fraud and platform security, and what every installed app collects on its own account. The generated draft asks about all three rather than assuming a bare storefront.

A Shopify store is not one data flow, it is about a dozen. Checkout collects name, address, phone and payment token; Shopify Payments runs fraud analysis; Shop Pay stores card details for reuse across merchants; the customer accounts system holds order history; and every app you install adds its own collection, usually with its own processor and its own cookies.

That app layer is what most Shopify privacy policies get wrong. Reviews, upsell, loyalty, subscription, back-in-stock and abandoned-cart apps all read customer data through the Shopify API, and several of them place third-party scripts on the storefront. A policy that names only Shopify is describing a fraction of the processing actually happening.

Shopify gives you real tooling for this. The customer privacy API carries consent state to apps and pixels, the Customer Privacy settings can block tracking until consent, and the built-in policy fields render at /policies/privacy-policy and are linked automatically from checkout. Using them properly is the difference between a policy that is published and one that is enforced.

What a privacy policy for a Shopify store has to cover

Shopify as processor for order data, and as an independent controller for fraud analysis and platform security
Every payment route you offer - Shopify Payments, PayPal, Klarna, Shop Pay - and the fact that card details go to them rather than to you
Installed apps that read customer or order data, listed as recipients rather than hidden behind "our service providers"
Carriers, 3PLs and customs authorities for fulfilment, including cross-border transfers
Marketing consent captured at checkout, and how it is separated from the contract basis for order processing

Shopify exposes GDPR webhooks - customers/data_request, customers/redact and shop/redact - that apps are required to honour. If you build or commission a custom app, your policy is describing a system that must respond to those calls; if you install apps, their handling of those webhooks is part of your own compliance picture.

How a Shopify store actually moves personal data

Checkout and order data

Name, email, shipping and billing address, phone and order contents, processed under contract. Shopify processes it on your behalf, and separately as a controller for fraud prevention and platform security.

Shop Pay and accelerated checkouts

Shop Pay, Apple Pay, Google Pay and PayPal Express each collect through their own interface and hand back a token. The customer’s payment details go to the provider, not to you, and the policy should say so rather than implying you store cards.

Storefront analytics and the Meta pixel

Shopify’s own analytics, Google Analytics 4 through the Google & YouTube channel, and the Meta pixel through the Facebook channel all set identifiers on the storefront. Under UK and EU rules these need consent before firing.

App-installed scripts and web pixels

Reviews widgets, loyalty programmes, live chat, upsell popups and back-in-stock alerts inject scripts that set their own cookies and send data to their own vendors. Each is a separate recipient.

Abandoned cart and email marketing

Capturing an email at checkout and then sending a recovery email is direct marketing. In the UK and EU it needs either consent or a correctly-applied soft opt-in, and the checkout marketing checkbox has to be unticked by default.

Customer accounts and Shopify’s new login

Passwordless customer accounts move identity handling to Shopify, which changes who holds the authentication data and belongs in the recipients section.

Fulfilment and shipping carriers

Address data goes to carriers and to any third-party logistics provider, plus customs data for cross-border orders - which is a transfer as well as a disclosure.

Third parties the draft will ask you about

Shopify Inc. · Shopify Payments (Stripe) · PayPal · Klarna · Shop Pay · Klaviyo · Judge.me or Loox · Gorgias · Google Analytics 4 · Meta · ShipStation

The rules that apply

Shopify Terms of Service

Merchants must publish a privacy policy that meets applicable law. Shopify provides the policy fields and links them from checkout, but the content is your responsibility.

Shopify Protect and fraud analysis

Fraud scoring means Shopify processes order data for its own purposes as well as yours, which is a disclosure and, in the EU and UK, potentially an automated-decision question.

Customer Privacy API and consent tracking

Shopify’s consent framework gates when apps and pixels may collect. If it is not configured, apps typically default to collecting immediately.

App Store data-access declarations

Every app you install declares the customer data it reads. That list is the starting point for your recipients disclosure.

Payment card industry obligations

Shopify Payments and third-party gateways handle card data so you do not store it - but your policy still has to describe the hand-off accurately.

What the generated privacy policy contains

Identity and contact details of the controller
Your legal entity, trading name, registered address and a working contact route - plus a representative or DPO where one is required.
Categories of personal data and their sources
What you collect directly, what you observe automatically, and what you receive from third parties such as payment providers or ad platforms.
Purposes and lawful basis, purpose by purpose
A table that pairs each processing purpose with its lawful basis rather than listing all six bases and hoping one fits.
Recipients and sub-processors
The categories of recipient, and for the ones that matter to users - payment, hosting, analytics, support - the named provider.
International transfers and their safeguards
Where data leaves its home jurisdiction, and the mechanism relied on: adequacy, standard contractual clauses, the UK addendum or IDTA.
Retention periods per data category
Concrete periods or the criteria used to set them, which is what regulators ask for first when a complaint lands.
Rights and how to exercise them
Access, rectification, erasure, portability, objection and restriction, with the actual route to make a request and the deadline you work to.
Complaints and supervisory authority
The regulator a user can escalate to, named, with a link - not a generic "your local authority".

Publishing the document on Shopify

Paste it into Settings → Policies
Shopify hosts privacy policy, refund policy, terms of service, shipping policy and contact information as first-class fields. They render at /policies/<name> and are linked automatically from checkout.
Add the links to your footer menu
Checkout links are not enough for a crawler or a visitor who never reaches checkout. Add the policy pages to the footer menu under Content → Menus.
Wire consent into the customer privacy API
Use a consent app or the privacyBanner API so that Shopify passes consent state to pixels and apps instead of letting them collect immediately.
Audit installed apps and web pixels
Settings → Apps and Customer events list what is running. Reconcile that list against your recipients and cookie table.
Untick the checkout marketing consent box for EU and UK markets
Settings → Checkout → Marketing options. Pre-selection is a valid configuration in some markets and not in others.
Re-check after every theme or app change
A new app is a new recipient and usually a new cookie. The policy goes stale the moment the app list changes.

Where this usually goes wrong

Using the Shopify sample policy unedited

Shopify’s template is a scaffold with placeholder text. It does not know which apps you installed, which markets you sell to, or which payment providers you use - and merchants routinely publish it with the placeholders still in place.

Not listing the apps that read customer data

Every app with customer or order scope is a recipient. The app list in your admin is effectively a first draft of your sub-processor list.

Pixels firing before consent in the UK and EU

Installing the Facebook or Google channel drops a pixel on every storefront page. Without the customer privacy API wired into your banner, it fires on page one regardless of consent.

A pre-ticked marketing checkbox at checkout

Shopify lets you set the checkout marketing consent checkbox to pre-selected. In the UK and EU that is not valid consent, and it contaminates the whole list.

No cookie policy despite a dozen app cookies

The default Shopify policy set has no cookie policy, so most stores publish none - while running review widgets, chat and retargeting that each set their own.

Ignoring the storefront’s own cookies

Shopify sets _shopify_y, _shopify_s, cart and secure_customer_sig by default. Some are strictly necessary and some are analytics, and the distinction belongs in the table.

Frequently asked questions

Does Shopify provide a privacy policy?

It provides a template with placeholders and a hosting field, not a finished document. The template cannot know which apps you run, which payment providers you use or which jurisdictions you sell into - all of which change what the policy has to say.

Where does my Shopify privacy policy live?

At yourstore.com/policies/privacy-policy once you save it in Settings → Policies. Shopify links it from checkout automatically; you should also add it to the footer menu.

Do I need a cookie policy for a Shopify store?

If you sell to the UK or EU, in practice yes. Shopify sets its own cookies, and review, chat, loyalty and retargeting apps add more. A per-cookie table is the disclosure regulators ask for.

Does Shopify handle GDPR for me?

Shopify handles its own obligations as a processor and provides tooling - the customer privacy API, the GDPR webhook endpoints, data requests in the admin. The controller obligations, including the policy, the lawful basis and the consent banner, stay with you.

What about the apps I have installed?

Each one that reads customer or order data is a recipient you should be disclosing, and several place cookies on the storefront. The Apps page in your admin is the list to start from.

Is a privacy policy legally required?

If you process personal data, in almost every market yes. GDPR and UK GDPR require the disclosure at the point of collection, CCPA/CPRA requires a notice at collection plus an annually reviewed policy, and app stores and payment processors require a public policy URL before they will list or onboard you.

Can I copy another company’s privacy policy?

It is both a copyright problem and a compliance problem. A copied policy describes someone else’s data flows, processors and retention periods, so it is inaccurate the moment you publish it - and an inaccurate transparency notice is itself a breach of GDPR Article 13.

How often does a privacy policy need updating?

Whenever your processing changes - a new analytics tool, a new payment provider, a new market - and as a backstop, review it annually. CPRA makes the twelve-month review explicit.

Does PolicifyAI give legal advice?

No. PolicifyAI is a technology provider, not a law firm. The output is a structured, jurisdiction-aware draft that a qualified adviser should review before you rely on it.