Shopify is a commerce platform operated by Shopify Inc., a Canadian company (registered office in Ottawa, Ontario) dual-listed on the NYSE and Toronto Stock Exchange (Class A subordinate voting shares). Shopify's privacy policy (updated July 2026) covers four distinct audiences — merchants, consumers who shop at Shopify-powered stores or use the Shop app, partners, and website visitors — and states as a core value that data is only shared with third parties when the user permits it or Shopify is legally required, disclosing transfers to Subprocessors under Standard Contractual Clauses and publishing a 'Guidelines for Legal Requests' page for compelled disclosures. The policy discloses collection of government-issued ID for 'know your customer'/anti-money-laundering compliance and use of website-access data for fraud prevention and analytics under a legitimate-interest legal basis. The consumer-facing Shop app's App Store label discloses purchase history, precise location, payment info, contact info and search history linked to identity across analytics, personalization and app-functionality purposes, plus contact-info use for the developer's own advertising; no 'Data Used to Track You' category is declared. Shopify's own annual information form (AIF, filed with the 2023 40-F) discloses that 'there have been in the past ... successful attempts to obtain or to provide unauthorized access to the personal or confidential information' of its merchants, merchants' buyers, and consumers, a self-disclosed past-incident statement rather than a hypothetical risk factor.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
The Shop app's App Store privacy label states that data linked to the user's identity for Analytics purposes includes Purchase History, Financial Info (Payment Info), precise and coarse Location, Contact Info (Physical Address, Email Address, Phone Number), Search History, Identifiers and Usage Data; the privacy policy separately states Shopify relies on compliance with a legal obligation to use copies of government-issued identification for 'know your customer', anti-money-laundering or anti-terrorism laws.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Shopify's privacy policy states it relies on 'compliance with a legal obligation to use copies of government-issued identification that you provide us to comply with different laws such as "know your customer", anti-money laundering or anti-terrorism laws,' and on legitimate interest 'to use information about how you access Shopify websites to prevent fraud, provide reporting and analytics, and improve our services.'
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes, including audits.
Shopify's annual information form (filed as an exhibit to its 2023 Form 40-F) states its registered office is 151 O'Connor Street, Ground Floor, Ottawa, Ontario, Canada, and that its Class A subordinate voting shares are subject to the requirements of both the New York Stock Exchange and the Toronto Stock Exchange; the Shop app's App Store listing names the seller as Shopify Inc.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Shopify's privacy policy states as a core value that if a third party requests personal data, Shopify will refuse to share it unless the user gives permission or Shopify is legally required, and separately discloses that transfers of Personal Data to its Subprocessors are protected by contractual commitments such as Standard Contractual Clauses, with disclosures compelled by law handled per a published Guidelines for Legal Requests page.
Shopify's annual information form states in its risk factors that 'there have been in the past, and may be in the future, successful attempts to obtain or to provide unauthorized access to the personal or confidential information of our partners, our merchants, our merchants' buyers, and consumers with whom we have a direct relationship, including as a result of breaches of a secure network by an unauthorized party, software vulnerabilities or coding errors, human error or malfeasance, including employee misconduct.'
The Shop app's App Store privacy label declares no 'Data Used to Track You' category (the App Store category reserved for cross-app/cross-website tracking), but does declare identity-linked Contact Info (Name) used for the developer's own advertising or marketing purpose.