Shopify Consumer Privacy Policy

1. Introduction

This privacy policy describes the personal data that Shopify processes (which may include collecting, organizing, structuring, storing, using, or disclosing) when you use or access Shopify Consumer Services, or when you interact with a merchant that is powered by Shopify's platform ("Shopify Merchants" or "Merchants"). If any provisions in this policy conflict with provisions of any other Shopify privacy policy, the provisions in this policy will apply.

2. What Personal Data We Receive

Personal Data is any information from or about an identified or identifiable person, but does not include aggregated or anonymized information. We receive the following types of Personal Data when you interact with Shopify, Shopify Merchants, and/or use the Shopify Consumer Services:

1. Profile and Contact Information: We receive contact or other account profile information when you sign up for or interact with Shopify Consumer Services, which may include name, shipping address, email address, profile picture, or other information you choose to provide us. We may link this information to the different devices or accounts you use when you interact with Shopify, Shopify Merchants, and/or use the Shopify Consumer Services.
2. Device Information: We receive information about the computers, phones, and other devices you use to interact with Shopify, Shopify Merchants, and/or the Shopify Consumer Services, including IP address (which may be used to determine general location), device identifiers, cookie IDs, the browser you use, your network connection, or other unique identifiers or device information.
3. Payment Information: We may receive payment information when you use Shop Pay or make a purchase through Shopify or Shopify Merchants, such as your payment card number and expiration date.
4. Use of Shopify apps and services: We receive information regarding your use of or interactions with our apps and services, whether or not you are logged in to Shopify, such as your interactions with Shopify Merchants in the Shop app, the shop(s) you visit and purchase from, the products you view and purchase, the product reviews and ratings you post and share, your order history, the purchases where you use Shop Pay, your search queries, favorited shops and other activities related to the Shopify Consumer Services.
5. Activity with Shopify Merchants: When you browse or shop with Shopify Merchants, we receive information about your activity on the Shopify Merchant site, including information about your browsing and search activity, the products and services you place in your cart and/or purchase, your billing and shipping information, transaction details and your payment information.
6. Settings and Privacy Preferences: We receive information about your settings and preferences on Shopify and our Merchants, as well as information about your browser and device privacy settings.
7. Communications with Shopify: We receive information, including message and email content, when you communicate with Shopify (such as for customer support inquiries, taking surveys, participating in promotions or research).
8. Social Network Accounts: If you choose to link, connect, or login to Shopify Consumer Services through a third party online service, you direct the service to send us certain information about you controlled by that service, such as profile information. This sharing is subject to the applicable privacy notices and your privacy settings of that service.
9. Email and Shopping Service Integrations: We receive information from email messages in the inboxes that you connect to your Shop account, and information from email messages you transfer to the Shop app to be included in your order history. We do not use this information for advertising or marketing purposes.

3. How We Use Your Personal Data

Shopify uses Personal Data for the following purposes depending on how you interact with us, which Shopify services you use, Merchants you visit, and based on your activity across all devices where you log in to or interact with Shopify, Shopify Merchants, and/or use the Shopify Consumer Services:

1. Provide, Improve, and Customize Shopify services: To provide customized Shopify services to you, including by displaying your purchase history and order status in one place, providing easy payment options when you shop, recommending and customizing the products and Merchants featured for you, and to improve Shopify services, including based on your use of Shopify Consumer Services and activity with our Merchant(s).
2. Track and Implement Your Settings and Privacy Preferences: To track and implement your settings and privacy preferences with Shopify and our Merchants.
3. Perform Product Research and Development: To develop, test, and improve Shopify services, including troubleshooting our products and services, developing new or improved Shopify services, and analyzing your use of and interactions with Shopify services and with Shopify Merchants.
4. Advertise, Market and Promote Shopify and Shopify Merchants: To market, advertise, and promote Shopify and Shopify Merchants on and off Shopify, including for personalized communications or advertisements relating to Shopify and Shopify Merchants on third-party services. You can opt-out of our use of your Personal Data to show you marketing and advertisements based on your interaction with different Shopify Merchants here.
5. Communicate with You: To communicate with you about Shopify services and your transactions, including about product updates, your account, and changes to our policies and terms. We also use your information to respond to you when you contact us.
6. Authentication, Integrity, Security, and Safety: To authenticate your account, provide a secure payment and shopping experience, and to detect, investigate, and prevent malicious conduct, fraudulent activity or unsafe experiences, address security threats, protect public safety, and secure Shopify Services for you and our Merchants.
7. Legal Reasons: To comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

When Shopify processes your Personal Data from Merchants you interact or shop with in order to help Merchants run their Stores and to provide business services to our Merchants, we are acting at the direction of the Merchant, and the Merchants' terms of service and privacy policy apply—not Shopify's. For more information about how Merchants collect and use Personal Data when you visit and make purchases in their Stores, review the Merchant's terms and privacy policy.

4. Third-Parties Who May Receive Personal Data

Depending on which Shopify services you use or interact with and Merchants you visit, Shopify may provide Personal Data to the following categories of third parties or in the following circumstances:

1. Vendors: Shopify works with third-party service providers to provide, support, and improve Shopify services and technical infrastructure, for business services, such as payment processing, including in relation to purchases made when you use Shopify services, and for marketing and business analytics.
2. Marketing, Advertising, and Analytics Partners: We may use third-party marketing, advertising, and analytics partners to deliver personalized advertising and to help us understand how people use or interact with Shopify services and our Merchants. These partners may receive information about your use of, or interactions with, Shopify services and our Merchants, including through third-party cookies or other technologies. For example, we may make information available to third-party advertising companies to serve you with relevant ads or content and to manage, improve and measure our advertising campaigns. Providing information to certain third parties for advertising services may be considered "sharing" or "targeted advertising," as defined by certain privacy laws that may apply in your jurisdiction. You can opt-out of our sharing of your Personal Data for targeted advertising here.
3. Change of Control: We may share Personal Data with actual or prospective acquirers, their representatives and other relevant participants in, or during negotiations of, any sale, merger, acquisition, restructuring, or change in control involving all or a portion of Shopify's business or assets, including in connection with bankruptcy or similar proceedings.
4. Legal Reasons: We may share Personal Data as needed to: (1) comply with applicable law or respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; (2) enforce or investigate potential violations of our terms or policies; (3) detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; (4) meet our corporate and social responsibility commitments; (5) protect our and our Merchants and users' rights and property; and (6) resolve disputes and enforce agreements.
5. Sharing at Your Discretion: Where you provide consent, we share your Personal Data as described at the time of consent, such as when connecting with a third party application or website.

5. Third Party Partners & Integrations

Parts of Shopify services may link to third party services. Shopify doesn't own or control these third parties. When you interact with these third parties and choose to use their services, your use is subject to the privacy policies of those providers.

6. Your Privacy Rights and Choices

You may have certain rights to manage your Personal Data depending on where you live. To exercise any privacy rights available to you, please visit our privacy portal. Depending on your jurisdiction, the following rights may apply, subject to certain exceptions:

1. Access and Portability: Right to request access to your Personal Data.
2. Correction / Rectification: Right to correct inaccurate or incomplete Personal Data in certain circumstances.
3. Deletion / Erasure: Right to delete Personal Data about you.
4. Right to opt out of Sharing or Targeted Advertising: Right to direct us not to share your Personal Data with third parties for targeted advertising or to use information about your interactions with Shopify Merchants to show you targeted advertisements and marketing. To opt-out of having your Personal Data used for these purposes, visit our privacy portal.

Data subjects who are subject to the data protection laws of the European Economic Area, the UK, or Switzerland may have additional rights under applicable law, addressed below.

If you are a Shop app user, you can also update your account information or request to delete your account directly through your in-app settings.

You may have additional rights with Shopify Merchants. For information and any choices related to how an individual Merchant enables Shopify to use your data, see that Merchant's website and policies.

7. Retention

We retain Personal Data for as long as we have an ongoing business need to do so (e.g., to provide the Shopify services to you and our Merchants, to comply with applicable legal, tax, or accounting requirements, for security and fraud detection or prevention, or in connection with backup or disaster recovery processes), unless a different retention period is permitted or required by applicable law.

The criteria used to determine our retention periods include the following:

1. The length of time we and our Merchants have an ongoing relationship with you and provide Shopify services to you (for example, for as long as you have an account with us or keep using our services or services offered by our Merchants);
2. Whether you modify or delete your information through your accounts;
3. Whether Shopify has a legal obligation to keep the data (for example, certain laws require Shopify to keep records of your transactions for a certain period of time); or
4. Whether retention is advisable in light of our legal position (such as in regard to the enforcement of our agreements, the resolution of disputes, the applicable statutes of limitations, litigation, or regulatory investigation).

8. How to Contact Us

To exercise your rights, please visit our privacy portal. For questions or concerns related to this Privacy Policy, you may contact us by visiting our overall privacy policy, under "How you can reach us."

9. Changes to this Privacy Policy

We may update this Privacy Policy periodically to account for changes in our processing of Personal Data, and we will post the updated Privacy Policy on our website, with a "Last Updated" date at the top.

10. European Data Subjects

This section 10 applies if the processing of your Personal Data is subject to the data protection laws of the European Economic Area, the UK, or Switzerland.

1. Our legal basis for processing your Personal Data: Our legal basis for processing your Personal Data to show you targeted advertisements is your consent. For information about our legal basis for other processing described in this Privacy Policy, please refer to our overall privacy policy.

2. Your rights in relation to your Personal Data: In addition to the rights noted in Section 6 above, you can exercise the following rights:

3. Objection to Processing and Restriction of Processing: Right to object to the processing of your Personal Data for certain purposes and to request the restriction of the processing of your Personal Data.

4. Withdrawal of Consent: Right to withdraw consent where processing of your Personal Data is based on consent. If you withdraw your consent, this will not affect the lawfulness of any processing based on your consent before its withdrawal.