We ask for less than we could, on purpose.

Read and write on products, collections, pages, blogs, files and online-store metafields, plus read on orders so the audit can weight issues by revenue. We do not request protected customer data (no names, addresses, emails or phone numbers), and Shopify's API redacts that by default anyway since API version 2022-10.

All three: customers/data_request, customers/redact and shop/redact. They are declared in our shopify.app.toml compliance_topics and respond 2xx. The shop/redact webhook fires 48 hours after uninstall, and customer redaction completes within 30 days as required.

Audit results and your app settings are stored on our infrastructure, encrypted at rest and in transit. The specific regions and the full subprocessor list are set out on the privacy page. If that page still reads as a template, treat it as incomplete rather than as a commitment.

Affected merchants notified without undue delay and in any case within 72 hours of confirmation, with what happened, what data was involved and what we are doing about it. That is the GDPR standard and it is written into the DPA, not just this page.

No. ShopSEO is a new, small app and we have not been through either audit. Any app that claims a certification should be able to show you the report. Ask for it, from us or anyone else.