Shopify protected customer data
Protected customer data is customer data a public app must be approved to receive
Direct answer. “Protected customer data” is Shopify’s term for data that directly relates to a customer. On Work with protected customer data, Shopify writes: “Protected customer data includes any data that directly relates to a customer or prospective customer, as represented in the API types and resources.” The next sentence says: “Types and resources that don’t refer to a single customer, such as the product query, aren’t included.” Public apps request access to protected customer data, and separately to the name, address, email, and phone fields, through the Partner Dashboard. After approval, “Responses will include only approved fields, and unapproved fields will be redacted.” This page is not legal advice. It does not describe any named third-party app’s data use.
Staff Access Audit Guard (Shopify App Store · Write a review): “Review installed app access, granted scopes, staff access records, and ownership evidence without reading customer or order data.”
Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.
Free check first: App access scope reader runs in your browser and sends nothing. Paste an app’s access scopes and see which the checker flags.
Checklist before you treat an API field as returned
- Read the live protected customer data page. The sentences on this page were checked against it on 13 October 2026.
- A type that does not refer to a single customer, such as the product query, is not protected customer data.
- Name, address, email, and phone are requested individually, in addition to protected customer data access.
- Use the level 0, 1, and 2 rows below. This page does not copy the later table of app types.
- A merchant reviews installed-app areas and personal-data categories in Shopify admin. The Help Center sentences are quoted below. Scope names are Shopify app access scopes.
Fields requested individually
Shopify writes: “In addition to requesting access to protected customer data, you’ll need to request access to the following protected customer fields individually because they directly identify customers:”
- Name: first and last names
- Address: address line 1, address line 2, geolocation, and zip codes in both billing and shipping addresses
- Phone
The same page says: “If your access is approved, these fields will appear in the protected customer API types and resources.” And: “Public apps request access to protected customer data and protected customer fields through the Partner Dashboard.”
Level 0, level 1, and level 2
The first table on that page is headed Level, Data use, and Partner actions. The rows, as written:
| Level | Data use | Partner actions |
|---|---|---|
| 0 | No customer data | No action required |
| 1 | Customer data excluding name, address, phone, and email fields | Request access to protected customer data in the Partner Dashboard. Implement level 1 protected customer data requirements. |
| 2 | Customer data including name, address, phone, or email fields | Request access to protected customer data and fields in the Partner Dashboard. Implement level 1 and level 2 protected customer data requirements. Participate in data protection reviews. |
The page then says: “If you’re using only protected customer data, then you must meet the level 1 requirements.” And: “If you’re using protected customer data including name, address, phone, or email fields, then you must meet all of the level 1 and 2 requirements.”
Level 1 requirements
Under the heading “Level 1 requirements”, the bold lead sentence of each item is:
- Process only the minimum personal data required to provide app functionality to merchants.
- Inform merchants what personal data you process and your reason for processing it.
- Limit your processing of personal data to the stated purposes.
- Where applicable, respect and apply customer consent decisions.
- Where applicable, respect and apply customer decisions to opt out of any data sharing such as a ‘data sale’ or similar concept under applicable laws or regulations.
- If you use personal data for automated decision-making and those decisions might have legal or significant effects, then you must allow customers to opt out.
- Make privacy and data protection agreements with your merchants.
- Apply retention periods to make sure that personal data isn’t kept for longer than needed.
- Encrypt data at rest and in transit.
Level 2 requirements
Under the heading “Level 2 requirements”, the bold lead sentence of each item is:
- Encrypt your data backups.
- Keep test and production data separate.
- Have a data loss prevention strategy.
- Limit staff access to protected customer data.
- Require strong passwords for staff accounts.
- Keep an access log to protected customer data.
- Implement a security incident response policy.
The explanatory paragraphs under those lead sentences stay on the shopify.dev page. This page does not restate them.
What the API returns
Under “Using protected customer data”, Shopify writes: “After your app is approved to access protected customer data, API requests and webhooks that contain protected resources will return the data requested. Responses will include only approved fields, and unapproved fields will be redacted.”
How a merchant reviews installed apps
Shopify Help Center, Installing and setting up apps, says: “Before you install an app, Shopify displays an Install app screen that displays the data and areas of your store the app needs access to.” The same section says the install screen shows “View personal data: The types of personal data the app can view, such as customers, store owner, and blog contributors.” And: “You can expand each category to view the specific permissions the app is requesting.”
Managing apps says: “You can review an app’s activity and permissions from the app’s about page. The Activity and permissions section displays which areas of your store the app can view or edit, along with the date of the app’s most recent activity in each area.” On privacy, the same page says: “You can review the personal data an app can access and view the developer’s privacy policy from the app’s about page. The Privacy section displays the types of personal data the app can access, grouped by category such as Customers and Staff and contributors.”
What a scope name covers is Shopify app access scopes. Classifying granted scopes is audit app scopes for customer data. An audit that does not read customer or order records is access audit without customer or order data. Custom-app approval is custom app permissions. Staff roles are the staff permissions checklist. Collaborator roles are collaborator permissions.
What this page is not
- Not legal advice, and not a statement about how any named third-party app uses data.
- Not the access-scope catalogue. That URL is Shopify app access scopes.
- Not a copy of the app-type table that follows the level 0, 1, and 2 rows on shopify.dev.
- Not a reading of customer or order payloads.
Related pages
- App access scope reader — paste scope names in the browser
- Shopify app access scopes
- Audit app scopes for customer data
- Access audit without customer or order data
- Custom app permissions
- Staff permissions checklist
- Collaborator permissions
- Protected customer data — shopify.dev
- Managing apps — Shopify Help Center
- Staff Access Audit Guard — live App Store listing
- Shopify apps hub
- Tools
Not legal advice. Confirm the live shopify.dev protected-customer-data page and the Help Center pages linked above before you treat a field as returned or withheld. The app reviews access records. It does not read customer or order data.