> For the complete documentation index, see [llms.txt](https://help.littledata.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.littledata.io/advanced/developer/shopify-data-security.md).

# Shopify data security

Littledata takes the security of your customers' data seriously. This page explains how Littledata processes your Shopify data and which customer details it sends to each destination. For the full policy, see our [data security policy](https://docs.google.com/document/d/1wyyWTVPrXVtG4hjn5-Q_K_UNK5t29sMNtoBnqev4cYg).

### How Littledata processes data

![Littledata AWS infrastructure](https://res.cloudinary.com/littledata/w_1024,h_524,c_fit/littledata-blog-images/2021/07/Shopify-data-processing-2021-Full-status-now.png)

Littledata's systems run on AWS in the US (US-East-1). They receive webhooks and API responses from Shopify over encrypted connections. Littledata then processes this data and sends it to the destinations you connect.

Littledata's tracking script also collects some pseudonymous identifiers from the shopper's browser, like cookie IDs. Littledata stores these temporarily so it can link server-side events to the same shopper.

Access to Littledata's systems is limited to a small number of senior full-time employees. They get only the access they need, and they sign in with multi-factor authentication.

### How Littledata stores data

Littledata's policy is to store and process as little personally identifiable information (PII) as possible.

* Littledata stores some data for a short time so it can link later events to the same shopper. For example, cart contents are kept for up to 30 days.
* Littledata stores non-PII event data for up to 2 months, to process refunds and investigate errors.
* All data is encrypted in transit and at rest.

### What every destination receives

Each connected destination receives:

* Details of the products, carts, checkouts and orders, like item name, SKU, quantity and price.
* That destination's own browser or click IDs, like the GA4 client ID, Segment anonymous ID or Meta `_fbp` and `_fbc` cookies.

Littledata doesn't send payment card details to any destination.

### Customer data processed

Our policy is to store and process as little personally identifiable (PII) data as possible, and the specifics of how we handle PII fields is below.

We also store non-PII data in our MongoDB instance, for up to 2 months after the event, to use in refunds and error investigation. All data is encrypted in transit and at rest

| Data field                                                  | Received by Littledata | Temporary storage \* | Relayed to Google | Relayed to Segment | Relayed to Facebook \*\* | Relayed to Pinterest | Relayed to TikTok | Relayed to Klaviyo |
| ----------------------------------------------------------- | ---------------------- | -------------------- | ----------------- | ------------------ | ------------------------ | -------------------- | ----------------- | ------------------ |
| Payment information                                         | ❌                      | ❌                    | ❌                 | ❌                  | ❌                        | ❌                    | ❌                 | ❌                  |
| Physical address                                            | ✔                      | ✔                    | ❌                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Email address                                               | ✔                      | ✔                    | ❌                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Customer name                                               | ✔                      | ❌                    | ❌                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Partial IP address \*\*\*                                   | ✔                      | ✔                    | ✔                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Platform specific client ID \*\*\*\*                        | ✔                      | ✔                    | ✔                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Shopify customer number                                     | ✔                      | ✔                    | ✔                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Contents of the shopping cart (item name, sku and quantity) | ✔                      | ✔                    | ✔                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |
| Phone Number                                                | ✔                      | ✔                    | ❌                 | ✔                  | ✔                        | ✔                    | ✔                 | ✔                  |

We store some fields for up to a month for reuse with other events for the same customer. Any fields not specified here are not stored. These fields are not stored with any other data which could be used to infer the customer.

\*\* All data relayed to Facebook is hashed.

\*\*\* Last octet is anonymized

\*\*\*\* GA client ID / Segment Anonymous ID / fbp / fbc

Need help? Email <help@littledata.io>.

### Related articles

* [How server-side tracking works](https://help.littledata.io/get-started/how-server-side-tracking-works)
* [Using Google Consent Mode v2 with Shopify](https://help.littledata.io/integrations/shopify-to-google-analytics/using-google-consent-modev2)
* [Cookie consent integrations](https://help.littledata.io/partner-recipes/cookie-consent-integrations)