Shopify Consumer Privacy Policy

This privacy policy describes the personal data that Shopify receives and/or processes (which may include collecting, organizing, structuring, storing, using, or disclosing) when you interact with Shopify or use Shopify Consumer Services, as defined in the Consumer Terms of Service, including while shopping with a merchant that uses or is powered by Shopify's platform (“Shopify Merchants” or “Merchants”). Additionally, please review our overall privacy policy that applies to everyone whose information we process. If any provisions in this policy conflict with provisions of the overall privacy policy, the provisions in this policy will apply.

Personal Data is any information from or about an identified or identifiable person, but does not include aggregated or anonymized information. We receive Personal Data when you use or interact with Shopify or Shopify services, which may include the following categories:

• Profile and Contact Information: We receive contact or other profile information when you sign up for or interact with Shopify Consumer Services, which may include name, shipping address, email address, profile picture, or other information you choose to provide us. We may link this information to the different devices or accounts you use when you interact with Shopify or use the Shopify Consumer Services.

• Device Information: We receive information about the computers, phones, and other devices you use or interact with Shopify or Shopify Consumer Services, including IP address (which may be used to determine general location), device identifiers, cookie IDs, the browser you use, your network connection, or other unique identifiers or device information.

• Payment Information: We receive payment information when you use Shop Pay or make a purchase through Shopify services, such as your payment card number and expiration date.

• Use of Shopify Consumer Services: We receive information regarding your use of or interactions with Shopify Consumer Services, whether or not you are logged in to Shopify, such as your interactions with Shopify Merchants, the Shop(s) you visit, the products you view and visit, the product reviews and ratings you post and share, your order history, your interactions with Shop.app/search or other marketing activities related to the Shopify Consumer Services, and favorited Shops.

• Settings and Privacy Preferences: We receive information about your settings and preferences on Shopify and our Merchants, as well as information about your browser and device privacy settings.

• Communications with Shopify: We receive information, including message and email content, when you communicate with Shopify (such as for customer support inquiries, taking surveys, participating in promotions or research).

• Social Network Accounts. If you choose to link, connect, or login to Shopify Consumer Services through a third party online service, you direct the service to send us certain information about you controlled by that service, such as profile information. This sharing is subject to the applicable privacy notices and your privacy settings of that service.

• Email and Shopping Service Integrations. We receive information from email messages in the inboxes that you connect to your Shop account, and information from email messages you transfer to the app to be included in your order history. We do not use this information for advertising or marketing purposes.

Shopify uses Personal Data for the following purposes depending on how you interact with us or which Shopify services you use and based on your activity across all devices where you log in to, or interact with, Shopify or Shopify services:

• Provide, Improve, and Customize Shopify Services: To provide customized Shopify services to you, including by displaying your purchase history and order status in one place, providing easy payment options when you shop, recommending products, Merchants and Shop(s) and customizing the products featured for you, and to improve Shopify services, including based on your use of Shopify Consumer Services and activity with our Merchant(s).

• Track and Implement Your Privacy Preferences and Settings: To track and implement your settings and privacy preferences with Shopify and our Merchants.

• Perform Product Research and Development: To develop, test, and improve Shopify services, including troubleshooting our products and services, developing new or improved Shopify services, and analyzing your use of and interactions with Shopify services.

• Advertise, Market and Promote Shopify: To market, advertise, and promote Shopify services on and off Shopify, including for personalized communications or advertisements relating to the Shopify services on third-party services.

• Provide Customized Advertising for our Merchants: To provide advertising services to our Merchants, which may include personalized advertising.

• Communicate with You: To communicate with you about Shopify services, including about product updates, your account, and changes to our policies and terms. We also use your information to respond to you when you contact us.

• Authentication, Integrity, Security, and Safety: To authenticate your account, provide a secure payment and shopping experience, and to detect, investigate, and prevent malicious conduct, fraudulent activity or unsafe experiences, address security threats, protect public safety, and secure Shopify Services for you and our Merchants.

• Legal Reasons: To comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

Shopify may also aggregate, de-identify, and/or anonymize any information collected through the Shopify services in such a way that we cannot reasonably link information to you or your device. We may use such aggregate, de-identified, or anonymous information for any purpose, including, for example, to improve the Shopify service.

Shopify also processes your Personal Data from Merchants you interact or shop with in order to help Merchants run their Shop(s) and to provide business services to our Merchants. When Shopify processes Personal Data in this way, we are acting at the direction of the Merchant, and the Merchants' terms of service and privacy policy apply—not Shopify's. For more information about how Merchants collect and use personal information when you visit and make purchases in their Shop(s), review the Merchant's terms and privacy policy.

In addition, some Merchants may instruct us to use Personal Data they share with us for targeted advertising for these and other Merchants using these services on third-party sites. You may have the ability to opt out of allowing a Merchant to share your information with us for these purposes directly on that Merchant's site, such as through the Global Privacy Control. We also offer you choices about how Shopify uses personal information merchants share with us for ad services here.

Depending on which Shopify services you use or interact with, Shopify may provide Personal Data to the following categories of third parties:

• Vendors: Shopify works with third-party service providers to provide, support, and improve Shopify services and technical infrastructure, for business services such as payment processing, including in relation to purchases made when you use Shopify Services, and for marketing and business analytics.

• Marketing, Advertising, and Analytics Partners: We may use third-party marketing, advertising, and business analytics partners to deliver personalized advertising and to help us understand how people use or interact with Shopify services and our Merchants. These partners may receive information about your use of, or interactions with, Shopify services, including through third-party cookies or other technologies. For example, we may make information available to third-party advertising companies to serve you with relevant ads or content and to manage, improve and measure our advertising campaigns. Providing information to third parties for personalized advertising services may be considered “sharing” for cross-context behavioral advertising, or “targeted advertising,” as defined by applicable law. You may opt-out of our sharing of Personal Data for cross-context behavioral advertising or targeted advertising by using the relevant settings available here. Please see Your Privacy Rights and Choices below for additional information.

• Change of Control: We may share Personal Data with actual or prospective acquirers, their representatives and other relevant participants in, or during negotiations of, any sale, merger, acquisition, restructuring, or change in control involving all or a portion of Shopify's business or assets, including in connection with bankruptcy or similar proceedings.

• Legal Reasons: We may share Personal Data as needed to: (1) comply with applicable law or respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; (2) enforce or investigate potential violations of its Terms of Service or policies; (3) detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; (4) meet our corporate and social responsibility commitments; (5) protect our and our Merchants and users' rights and property; and (6) resolve disputes and enforce agreements.

• Sharing at Your Discretion: Where you provide consent, we share your information as described at the time of consent, such as when connecting with a third party application or website.

Parts of Shopify services may link to third party services. Shopify doesn't own or control these third parties. When you interact with these third parties and choose to use their services, your use is subject to the privacy policies of those providers.

You may have certain rights to manage your Personal Data depending on where you live. To exercise any privacy rights available to you, please visit our privacy portal. Depending on your jurisdiction, the following rights may apply, subject to certain exceptions:

• Access and Portability: Right to request access to your Personal Data.

• Correction / Rectification: Right to correct inaccurate or incomplete Personal Data in certain circumstances.

• Deletion / Erasure: Right to delete Personal Data about you.

• Right to opt out of “sharing” for cross-context behavioral advertising or targeted advertising. Right to opt-out of the “sharing” of your Personal Data for cross context behavioral advertising or targeted advertising (as further described in the Third-Parties Who May Receive Personal Data section).

You can also update your account information or request to deactivate or delete your account directly through your in-app settings. You may have additional rights available to you. Please see our overall privacy policy for more information.

We retain Personal Data for as long as we have an ongoing business need to do so (e.g., to provide the Shopify services, to comply with applicable legal, tax, or accounting requirements, for security and fraud detection or prevention, or in connection with backup or disaster recovery processes), unless a different retention period is permitted or required by applicable law.

The criteria used to determine our retention periods include the following:

• The length of time we have an ongoing relationship with you and provide Shopify services to you (for example, for as long as you have an account with us or keep using our services);

• Whether you modify or delete your information through your accounts;

• Whether Shopify has a legal obligation to keep the data (for example, certain laws require Shopify to keep records of your transactions for a certain period of time); or

• Whether retention is advisable in light of our legal position (such as in regard to the enforcement of our agreements, the resolution of disputes, the applicable statutes of limitations, litigation, or regulatory investigation).

To exercise your rights, please visit our Privacy Portal. For questions or concerns related to this Privacy Policy, you may contact us.

We may update this Privacy Policy periodically to account for changes in our collection and/or processing of Personal Data, and we will post the updated Privacy Policy on our website, with a “Last Updated” date at the top.