Agent skill · data analytics · jeremylongshore
shopify-data-handling
Handle Shopify customer PII, implement GDPR/CCPA compliance, and manage
Why this skill is useful
Provides specific implementation details for handling Shopify customer PII, GDPR compliance, and mandatory webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires shopify account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Shopify Data Handling Overview Handle customer PII correctly when building Shopify apps. Covers the mandatory GDPR webhooks, data minimization, and the specific privacy requirements Shopify enforces for App Store submission. Prerequisites Understanding of GDPR/CCPA requirements Shopify app with webhook handling configured Database for storing and deleting customer data Instructions Step 1: Understand What Data Shopify Shares When a merchant grants your app access, you may receive: Data Type Source Sensitivity Retention Obligation ----------- -------- ------------- --------------------- Customer email, name, phone readcustomers scope PII — encrypt at rest Delete on customers/redact Shipping addresses readorders scope PII — encrypt at rest Delete on customers/redact Order details (amounts, items) readorders scope Business data Delete on shop/redact Product data readproducts scope Public Delete on shop/redact Shop owner email readshop scope PII Delete on shop/redact Step 2: Implement Mandatory Privacy Webhooks Shopify requires three GDPR webhooks for App Store apps. Your app will be rejected without them: customers/datarequest (customer wants their data), customers/redact (delete a customer's PII), and shop/redact (delete all shop data 48h after uninstall). See GDPR Privacy Webhooks for the complete implementation of all three handlers. Step 3: Data Minimization and PII Detection Only fetch the fields you actually use in GraphQL queries. Add PII redaction middleware to prevent customer data from leaking into logs — detect emails, phone numbers, and credit card patterns. See Data Minimization and PII Detection for query examples and redaction middleware. Step 4: Data Retention Policy Automate cleanup with a daily cron job: delete API logs after 30 days, webhook logs after 90 days, and keep audit logs for 7 years (regulatory requirement). See Data Retention Policy for the complete implementation. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/shopify-data-handling--defe14