Key Points
- Customer names, emails, phone numbers and exact addresses are not required by default.
- Provider tokens must never be exposed to the landing site, mobile app or analytics.
- Exports should not include customer PII by default.
- Private push mode hides sensitive amounts on lock screen surfaces by default.
- Deletion and privacy requests follow Shopify privacy requirements and MarginPatrol retention policy.