Handle GDPR data requests for a Shopify store and a WordPress site

A customer who signs in to your WordPress site with their Shopify customer account has personal data in two places. When they ask for a copy of it, or ask you to delete it, the answer has to cover both. RedeemID brings every request, wherever it started, into WordPress’s own Tools → Export Personal Data and Tools → Erase Personal Data, and leaves Shopify’s data to Shopify.

RedeemID is a tool for handling requests. It doesn’t make a site compliant on its own, and it isn’t legal advice.

Where requests arrive

On your WordPress site. WordPress’s own request form, or Download my data and Delete my data on the Member Account block. WordPress emails the person to confirm.
From Shopify. When the store owner requests a customer’s data, Shopify sends RedeemID a customers/data_request webhook, and a confirmed export request appears in Tools.
From Shopify, erasure. When a customer is erased in Shopify, Shopify sends customers/redact. RedeemID removes its data at once and records the request, so staff decide on the rest of the WordPress account.

Shopify sends these compliance webhooks only to apps that declare them. Connect Shopify has the lines to add.

1. Export

The WordPress export includes what RedeemID mirrors for the person: their Shopify link, synced fields such as name, email, status and tags, their cart, and their rows in the activity and webhook logs. Orders, addresses and the full customer record are in Shopify. Shopify has no API to start its own customer data report, so request that in Shopify admin and send both.

2. Erase

Erasing in WordPress removes the Shopify link, the synced fields, tokens and cart, and strips the person from the logs. Their members-only access ends at once. The WordPress account itself stays, as with WordPress’s own erasers.

To erase the customer in Shopify too, press Also request erasure in Shopify on the request. Shopify queues it and waits before carrying it out, and the request can be cancelled until then. This needs the optional write_customer_data_erasure scope, and it is never pressed for you.

3. Tell people what is stored

RedeemID adds suggested text to Settings → Privacy → Policy Guide, covering what it mirrors, its cookies and its 30-day logs. Copy what applies into your privacy policy.

The limits

Data you keep elsewhere, such as a newsletter or analytics tool, needs its own process.
After the Shopify app is uninstalled, Shopify sends shop/redact, and RedeemID then unlinks every account at once.

The full reference, with every field and cookie, is Privacy.

Written for: Agencies

More guides

How to gate WordPress content with Shopify customer tags Lock WordPress posts, categories or part of a page to customers who carry a tag in Shopify: connect the store, name a level, add a gate or a rule, and check what each reader sees.
Turn a Shopify purchase into WordPress membership access The whole path from a paid Shopify order to an open WordPress page: a Flow workflow tags the buyer, the tag reaches WordPress by webhook, a level opens the content, and the return link brings the buyer back.
Members-only WordPress content for Shopify subscription customers Give customers with an active Shopify subscription members-only content on WordPress: tag them from the subscription app, point a level at the tag, and let renewals, pauses and cancellations follow on their own.
A metered paywall on WordPress without cookies Let signed-in readers open a few locked stories a month before they need a membership, counted on the server per account, with no tracking cookie and no split page cache.
Paywalled content and SEO on WordPress How locked WordPress posts stay findable without leaking: paywall structured data, teaser-only descriptions, search that matches public text only, and when to noindex a post type.
Caching a WordPress membership site with a page cache or CDN Keep a full-page cache or CDN on a WordPress membership site: what RedeemID marks as private, the X-RedeemID-Access header, and the cookies a cache rule should bypass.
Keeping AI crawlers away from paid WordPress content Why an AI crawler can’t train on or quote your locked WordPress posts when the paywall is server-side, what robots.txt adds, and what no plugin can promise.
Membership plugin or paywall service: which a WordPress site needs The difference between a WordPress membership plugin and a hosted paywall service, what each keeps where, and where a Shopify-backed setup like RedeemID fits.
Time passes and gift memberships with Shopify Sell a 24-hour, 7-day or 30-day pass, or a gift membership, in Shopify and open WordPress content for exactly that long, with Shopify Flow adding and removing the tag.
Use WordPress as the blog for a Shopify store Keep selling on Shopify and publish on WordPress: what each one does best, how the two sites share one customer account, products and a cart, and the limits of running content and store apart.
Add Shopify products and a cart to WordPress Show Shopify products and collections on a WordPress site with live prices, keep a cart, and send customers to Shopify checkout signed in, without JavaScript and without Shopify’s own WordPress plugin.