What Data ShopMy Accesses
Order Data
ShopMy reads order data from your Shopify store to attribute sales to the creators who drove them. This includes order IDs, order amounts, currency, discount codes used, and line item details. ShopMy stores a record of each attributed order in its database to calculate and track affiliate commissions. Customer email addresses received via order webhooks are used only to determine attribution and are never stored.
Product & Inventory Data
ShopMy reads product and variant data — including titles, prices, SKUs, images, and inventory levels — to power creator storefronts and keep product availability up to date. This data is synced to ShopMy's catalog and updated in real time via Shopify webhooks.
Discount Codes
ShopMy creates, updates, and deletes discount codes in your Shopify store on behalf of your brand to enable creator-specific tracking codes. These codes and their configurations are stored in ShopMy's database and linked to your Shopify integration.
Customer Data
ShopMy does not store any customer personally identifiable information (PII). If the read_customers scope is granted, ShopMy may read a customer's order count solely to determine whether an order is from a returning customer, which affects commission calculations. No customer names, email addresses, phone numbers, or addresses are retained.
Webhooks
ShopMy registers webhooks on your Shopify store to receive real-time notifications for the following events:
| Event | Purpose |
|---|---|
| Order created | Attribute the order to a creator and record commission |
| Order cancelled | Mark the associated commission as cancelled |
| Order fulfilled | Update shipment tracking info for lookbook orders |
| Order updated | Keep commission and fulfillment records in sync |
| Product updated | Refresh variant availability in creator storefronts |
| App uninstalled | Disable the integration and trigger data deletion |
Data Deletion & GDPR
ShopMy complies with Shopify's mandatory GDPR webhook requirements.
Customer data requests: Because ShopMy stores no customer PII, there is no customer data to return or redact in response to these requests.
Shop redaction: When your store uninstalls ShopMy, Shopify sends a redaction webhook 48 hours later. At that point, ShopMy permanently deletes all data associated with your integration, including product/variant records, discount code configurations, inventory location mappings, and the integration credentials themselves.
OAuth & Permissions
ShopMy connects to your store via Shopify OAuth and requests only the scopes required for the features you enable:
| Scope | Required For |
|---|---|
read_orders, write_orders | Commission tracking, order tagging |
read_products | Product sync, creator storefronts |
read_inventory, read_locations | Inventory availability tracking |
read_discounts, write_discounts, read_price_rules, write_price_rules | Creator discount codes |
write_draft_orders, read_draft_orders, write_customers | Lookbook order fulfillment |
OAuth access tokens are stored securely and scoped to your store. They are deleted when your integration is removed.