Shopify

Shopify says merchant store-level data is not used to power Shopify Magic for other merchants.

Merchants can choose whether to use Shopify Magic features instead of having them forced across every workflow.

Shopify's privacy materials distinguish some processor or service-provider contexts from Shopify-controlled processing.

Shopify provides privacy-portal rights and role-specific notices for different user types.

Shopify Magic can still use a merchant's own store-level data to provide results to that merchant.

Shopify says it uses machine learning to improve services, which keeps AI-related internal processing in scope.

Shopify still shares data with service providers, merchants, partners, payment providers, advertisers, and legal recipients.

Store apps, themes, and merchant-controlled data flows can expose buyer and merchant data beyond Shopify's native surface.

Shopify provides privacy rights and processor or controller guidance for merchants, consumers, partners, and visitors.

Shopify says it will refuse third-party requests for personal data unless it has permission or is legally required.

Store owners control many app, theme, and partner connections rather than having every external path turned on by default.

Shopify's privacy portal and supplemental notices give each role a clear route for understanding data handling.

Shopify uses cookies, tracking, analytics, and advertising vendors across sites and services.

The privacy policy says Shopify does not respond to Do Not Track signals in any particular way.

Shopify says it does not sell personal data under U.S. privacy-law definitions.

Shopify provides role-based privacy notices and cookie disclosures for merchants, buyers, and visitors.

Store owners can configure some of the consent and collection experience on their own storefronts.

Closed merchant store information may be retained for two years before deletion begins.

Retention still varies by role, legal need, account type, and merchant-controlled data flows.

Shopify documents privacy-portal rights and deletion request paths.

The privacy policy says Shopify retains personal data only as long as necessary for the purposes collected.

Shopify provides different supplemental privacy policies for merchants, consumers, and partners, which makes lifecycle expectations more reviewable.

Merchants can manage apps, customer data, store settings, exports, and privacy requests.

Shopify says users should be able to access and control personal data no matter where they live.

Merchants control whether to connect many apps, themes, and partner services.

Shopify provides privacy-portal and support paths for privacy requests instead of relying only on informal contact.

Buyers often need to contact the merchant that controls the store transaction data.

Practical control is split across Shopify, the merchant, store apps, and connected providers.