ConsentKit Privacy Policy

Last updated: July 18, 2026

Overview

ConsentKit ("the app") is a cookie-consent banner for Shopify stores. This policy explains what data the app processes and how. The app is designed to store no personal data about a store's visitors.

Data the app processes

• Store record. When a merchant installs ConsentKit, we store the store's .myshopify.com domain and a Shopify access token so the app can function. No merchant personal data is collected.
• Banner settings. The configuration a merchant chooses (text, colors, position, geo-targeting, Consent Mode toggle).
• Proof-of-consent log. When a store visitor makes a consent choice, we record the choice (accept / reject / custom), the selected categories, an approximate region (country code), and a salted, non-reversible hash derived from the visitor's IP address and user-agent. We do not store IP addresses, names, emails, or any information that identifies a visitor.

How data is used

Solely to operate the consent banner and to provide the merchant a proof-of-consent audit trail. Data is never sold, rented, or shared with third parties, and is not used for advertising.

Where data is stored

All data is stored in the app's own database on Cloudflare's infrastructure. The only external service the app communicates with is the Shopify Admin API (for install, billing, and the uninstall webhook).

Data retention & deletion

When a merchant uninstalls ConsentKit, the store's access token is cleared. ConsentKit implements Shopify's mandatory GDPR webhooks: a shop/redact request permanently erases all data we hold for that store. Because the app stores no customer personal data, customers/redact and customers/data_request have no personal data to return or delete.

Contact

Questions: farazmoin.uk@gmail.com