What is stored, and where
| Claim | What it means in practice |
|---|---|
| No customer PII | Nothing that identifies an individual shopper is kept by the app |
| Rules live in your metafields | Your rule set is stored in your own shop's Shopify metafields |
| Analytics are aggregate | Counts and totals, not a record per shopper |
| GDPR webhooks implemented | Shopify's mandatory data-request and erasure webhooks are handled |
The metafield point is the one worth understanding, because it explains most of the others. Your rules are not held in a database Prime MOQ controls and you cannot see. They live in your shop, which is also how the checkout Function reads them fast enough to run on every cart. That is why Safe uninstall can hand you a complete export, and why enforcement does not depend on a call out to us at checkout time.
Analytics follow from the same shape. What a blocked attempts report counts is how many carts a rule stopped and what they were worth in total, not who was pushing them.
The links
The section links to two documents, both opening in a new tab:
Those are the citable versions. If you keep a register of the apps installed on your store and what each one processes, they are the pages to reference rather than this article.
Common mistakes
- Assuming an uninstall wipes your rules. They are in your shop's metafields. Export before uninstalling anyway, described in Safe uninstall, because a reinstall on a cleared store is much faster from a backup file.
- Expecting per-shopper reporting. Aggregate counts are a deliberate limit, not a missing feature. There is no per-customer blocked-attempt log to open.