Shopify
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Shopify collects a lot of business and shopper data, can close accounts without notice, takes a broad license, and does not refund fees.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account and store info, purchases, device and browsing data, and sometimes photos, IDs, location, and emails.
Read the exact line
Privacy policy
“Identifiers, including name, email address, mailing address, phone number; Personal Data categories listed in the California Customer Records statute, including name, mailing and billing address, phone number, credit or debit card information;”
Training
They use your data to run the service, fight fraud, personalize, market, and run machine learning.
Read the exact line
Privacy policy
“We use your information for a range of purposes connected to the provision and improvement of our services (for example, to process your subscription payments to use the Shopify platform)”
Sharing
Service providers, advertisers, merchants, partners, and sometimes law enforcement can receive your data.
Read the exact line
Privacy policy
“Advertisers and marketing vendors; Merchants whose stores you visit or make purchases from; Partners who provide a range of services to merchants”
Kept
They keep data while you use Shopify; closed merchant stores are kept two years before deletion starts.
Read the exact line
Privacy policy
“If you are a merchant operating a Shopify-powered store, and you close the store, stop paying your subscription fees, or we terminate your account, we retain store information for two years before we begin the deletion process.”
Controls
You can ask to see, fix, or delete data through their privacy portal or Shop’s delete-account page.
Read the exact line
Privacy policy
“To exercise your rights, including the "right to know" and "," please submit a request through our online portal.”
Fine print
They can close your account without notice, take a wide license, skip refunds, and you may have to cover their legal costs.
Read the exact line
Terms of service
“we may suspend or terminate your Account or the Terms of Service for any reason, without notice and at any time (unless otherwise required by law)”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Request access or deletion of your data
Privacy portal described in the privacy policy; Shop users: https://shop.app/delete-account
Turn off Shopify Network Intelligence if you are a merchant
Terms section 9.2 says you may disable the setting that powers Enhanced Services (Shopify Network Intelligence) at the link they label “here”
Cancel your merchant account
Contact Shopify Support and follow the instructions in their reply (Terms section 14)
Review cookie opt-outs
Shopify Cookie Policy linked from the privacy policy
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can shut your store and account whenever they want, and they do not have to warn you first unless the law says they must.
Read the exact line
Terms of service
“we may suspend or terminate your Account or the Terms of Service for any reason, without notice and at any time (unless otherwise required by law)”
For example, your store could go offline overnight and you would not get an email first.
If someone sues them because of your store or a sale, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and hold us and (as applicable) our parent, subsidiaries, affiliates, Shopify partners, officers, directors, agents, employees, and suppliers harmless from any claim or demand, including reasonable attorneys' fees”
For example, if a customer sues over a product you sold, you might have to pay Shopify’s lawyers too.
You still own your store content, but they get a wide right to use, copy, change, and it to run and promote the platform.
Read the exact line
Terms of service
“You hereby grant Shopify a non-exclusive, transferable, , , worldwide right and license to host, use, distribute, expose, modify, run, copy, store, publicly perform, communicate to the public”
For example, they can show your product photos in Shopify ads or partner channels.
If you cancel or they end the service, they say you do not get money back for fees you already paid.
Read the exact line
Terms of service
“Shopify does not provide refunds.”
For example, if you cancel mid-month, you still pay that billing cycle with no refund.
The Shop app can collect your exact location if you turn that permission on.
Read the exact line
Privacy policy
“Your device's precise location (if you are a Shop user, but only when you allow Shop to access this information);”
For example, Shop could know the street you are on, not just your city.
If you connect Gmail or Outlook to Shop, they can read shopping-related emails in that inbox.
Read the exact line
Privacy policy
“The contents of email messages in the email inboxes that you connect to your Shop account, and information from email messages you transfer to the app to be included in your order history (if you use Shop).”
For example, order emails from Amazon in your connected inbox could be pulled into Shop.
They say they do not sell your personal data under those US state definitions, even though they still share it with others who help them operate and market.
Read the exact line
Privacy policy
“We do not "sell" your Personal Data as that term is defined under US Privacy Laws.”
For example, they still list advertisers and marketing vendors as recipients of personal data.
Closing a merchant store does not wipe the data right away. They keep store information for two years first.
Read the exact line
Privacy policy
“If you are a merchant operating a Shopify-powered store, and you close the store, stop paying your subscription fees, or we terminate your account, we retain store information for two years before we begin the deletion process.”
For example, product and order records from a closed shop can sit with them for two years.
Outside auditors check how they store data and handle payment systems.
Read the exact line
Privacy policy
“We also have independent auditors assess the security of our data storage and systems that process financial information.”
For example, card data systems are reviewed by independent security auditors.
You must be 18 or the adult age where you live to open a merchant account. They rely on you to say you are old enough.
Read the exact line
Terms of service
“You must be the older of: (i) 18 years, or (ii) at least the age of majority in the where you reside and from which you use the Services to open an Account.”
For example, a 17-year-old is not allowed to open a Shopify merchant account under these terms.
Disputes go to named courts (such as Ontario, Singapore, or Ireland).
Read the exact line
Terms of service
“Any dispute or claim relating to the Services or these Terms of Service can only be brought in the courts listed in the table below.”
For example, a US merchant billed in the US/Canada table would sue in Ontario courts as listed.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- right to erasure
- Your right to have a company delete the personal data it holds about you, with some exceptions. For example, you can ask a social app to wipe your old posts and profile and it must, unless a law says otherwise.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- governing law
- Which country's or state's laws are used to settle any dispute, no matter where you live. For example, a user in Ohio may find the terms are judged under California law.
How we got here · grade D · score 39/100 · 16 of 16 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account and payment details, purchases, device and browsing data, inferences, photos and videos, and sometimes precise location, government IDs, and connected email contents.
Does it record your voice, face or body, and what happens to that?
They may collect photos and videos that include face imagery if you choose to provide them, and they generally keep personal data while you use the service.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They share personal data with advertisers and marketing vendors and use cookies and similar tools. Enhanced services can be targeted advertising.
Do they sell or share your data, and can you opt out?
They say they do not sell personal data under US privacy laws, but they share it with advertisers, merchants, and partners, and describe opt-outs for some targeted advertising.
What rights do they take over what you type and what the AI makes?
You keep ownership of your materials, but you grant a transferable, sublicensable worldwide license that can last after you leave for rights that arose while you used the service.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion through their portal or Shop’s delete-account page. Merchant store information is kept for two years after a store closes before deletion starts.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They create inferences about your preferences and interests to personalize your experience, and the policy does not describe memory controls you can turn off.
Do they commit to basic security, and have they leaked data?
They say independent auditors assess security of data storage and financial systems, and they point to more security detail and PCI DSS compliance.
Is there a real age gate, and are teens protected?
Merchant accounts must be opened by someone 18 or the age of majority where they live. The terms do not describe extra age checks.
Can you sue or join a class action if things go wrong?
No arbitration clause
Will they tell you when the rules change, and is the policy specific?
Both documents are dated. They say they will tell you about significant or material adverse changes, for example by email or in the admin.
Can they close your account without warning, and can you get your data out first?
You can cancel by contacting support. They may suspend or terminate your account for any reason without notice unless the law requires notice.
If something goes wrong, who pays?
The service is offered as is with a broad limit on what they pay, and you must cover their legal costs for many claims tied to your store or sales.
Do subscriptions renew on their own, and can you get a refund?
Subscription fees are billed in advance on a 30-day cycle from a card on file. They say they do not provide refunds. Fee changes get 30 days’ notice.
The privacy policy is 3,509 words at a college graduate level (Flesch reading ease 30.4); the terms are 11,794 words at a college level.
