GDPR and privacy requests
How Lumen handles Shopify's customer data and deletion requests.
Lumen supports Shopify's three required privacy webhooks. You don't need to do anything for them to work.
Customer data request
When a shopper asks your store for their data, Shopify tells Lumen. Lumen collects what it holds about that customer and emails it to your escalation email, or to your store owner email if none is set. You then send it on to the shopper.
Customer deletion request
When a shopper asks your store to delete their data, Shopify tells Lumen. Lumen deletes the conversations, tickets and related records linked to that customer's orders.
Shop deletion request
About 48 hours after you uninstall Lumen, Shopify sends a shop deletion request. Lumen deletes any of your store's data that is left.
Shoppers who contact you directly
Shoppers should send privacy requests to your store, since you are responsible for your customers' data. Handle them through Shopify's customer privacy tools, and Lumen receives the request automatically.
Data minimization
- Read-only Shopify access.
- The checkout email is used to verify, not stored with the conversation.
- Emails, card numbers and phone numbers are masked in transcripts, ticket notes and text sent to AI providers.
- Conversations are deleted after 90 days (Free) or 180 days (paid plans).
Security
- HTTPS for all traffic.
- Shopify authentication for the Lumen admin.
- Shopify app proxy signatures on every storefront request.
- Access controls on production systems.
Your own privacy notice
Mention Lumen in your store's privacy policy as a service that processes order lookups and support chats. Lumen doesn't set cookies. It uses the browser's session storage, which clears when the tab closes. See Data handling.
Questions
Read the Lumen privacy policy or contact us.