Do Shopify apps need their own privacy policy?

Yes, your app processes merchant and buyer data separately from the store, so publish a policy for the app itself and link it in your listing.

What are Shopify’s mandatory compliance webhooks?

customers/data_request, customers/redact and shop/redact. Apps must implement and subscribe to them before publishing.

Shopify App Store · Platform guide

Privacy policy for Shopify app developers

Shopify apps must implement three mandatory compliance webhooks — customers/data_request, customers/redact and shop/redact — so merchants and their customers can view or delete data. Your app’s privacy policy should describe the merchant and customer data you store and explain that you respond to these requests.

§ 1

What Shopify App Store requires

Privacy law compliance — Mandatory compliance webhooks

“The app must implement the mandatory compliance webhooks.”

Source: shopify.dev verified 2026-10-30

1.1Subscribe before publishing. “You must subscribe to compliance webhooks before publishing your app.” Source: shopify.dev

1.2Why: GDPR and CPRA. Shopify explains that privacy rules such as the GDPR and CPRA set requirements for how apps handle personal data, which these webhooks support. Source: shopify.dev

§ 2

What common SDKs collect

SDK / API	Data it collects	Source
Compliance webhook topics	customers/data_request: requests to view stored customer data customers/redact: requests to delete customer data shop/redact: requests to delete shop data	Source: shopify.dev

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

3.1Shopify Partner Dashboard → your app’s listing → privacy policy URL.
3.2Your app’s website and in-app settings page.

§ 4

Sample clause

§ 4.1 · Merchant and customer data

When a store installs our app, we store the shop’s domain, the owner’s email, and order details needed to print labels. We delete customer data within 30 days of a customers/redact request and all shop data within 48 hours of uninstall via shop/redact.

Illustrative wording. Your generated policy is written from your own answers.

§ 5

Questions

Do Shopify apps need their own privacy policy?: Yes, your app processes merchant and buyer data separately from the store, so publish a policy for the app itself and link it in your listing.
What are Shopify’s mandatory compliance webhooks?: customers/data_request, customers/redact and shop/redact. Apps must implement and subscribe to them before publishing.