SK Form Builder documents handling of Shopify's three mandatory privacy webhooks: a customer data request, a customer redact, and a shop redact. That is the app's stated role in a Shopify form GDPR request that arrives through Shopify. It is not a legal opinion, and it is not a certificate that your store complies with the GDPR or the UK GDPR.
If you collect names, emails, or other customer data on a form, you still choose the consent copy, the privacy notice, and how long you keep the submission. The app can store the entry, export it, and pass fields to other tools. Your counsel decides whether that collection is lawful. A form consent checkbox can record that the shopper ticked a box. The tick is evidence of a choice on that form. It does not, by itself, finish a privacy review.
What the app says it handles
Shopify requires App Store apps to subscribe to three compliance topics. Shopify's privacy-law documentation names them, and it says the page is not legal advice. The topics are:
- customers/data_request: a request to view stored customer data. Shopify sends the customer identifiers to the app. The app is expected to provide the relevant data to the store owner.
- customers/redact: a request to delete that customer's data. Shopify's docs say the webhook can be delayed: if the customer has not ordered in six months, Shopify sends it 10 days after the request; otherwise Shopify waits until six months have passed.
- shop/redact: a request to delete the shop's data. Shopify sends it 48 hours after the store owner uninstalls the app.
The SK Form Builder catalog says the app handles those three webhooks. Shopify's developer docs also say an app should confirm the webhook and complete the action within 30 days, unless the app is legally required to keep the data. That 30-day note is Shopify's rule for apps. The SK catalog does not publish a retention schedule or a field-by-field deletion list. Ask counsel and the app's support before you promise a customer a deletion date.
What a webhook does not decide
A webhook cannot see why you collect a field, how long you keep the inbox row, who else receives a copy, or what you tell the shopper before submit. EU and UK customers can ask for access or deletion through your store. Shopify may then notify installed apps. You still answer the customer. Webhook handling is not your privacy policy and not a data-processing agreement with every vendor you connect.
Form analytics count views, submissions, completions, device type, and grouped UTM source, medium, and campaign. Field drop-off is a count of abandonments, not a stated reason. Include those reports when you describe what you store. A chart can still contain personal data.
The accept-terms checkbox
The catalog includes a single checkbox among its 34 field types. Use it as the accept-terms control when counsel wants a recorded choice on the form. Make the label specific. "I agree" is weaker than a sentence that names the privacy notice and says what the person is agreeing to. Link the notice in the label or in the text beside the field, and make the checkbox required when the submission should not proceed without it.
A required checkbox stops an empty submit. It does not prove the shopper read the policy. Leave it unchecked by default. When counsel treats a contract term and a marketing opt-in as different choices, use two boxes. Conditional logic can show the marketing box after the terms box is ticked. Smart prefill can fill name, email, or address for a logged-in customer. Show those values before submit. A hidden field should not carry a consent flag the shopper never saw.
Where the submission can go
Data leaves the form app through paths the catalog documents. Know which ones you turned on before you write the privacy notice.
- The submissions inbox, with status and assignment, plus CSV, Excel, and PDF export. CSV exports over 1,000 rows are emailed as a download link.
- Merchant email, with reply-to set to the customer, and an optional autoresponder. Custom SMTP can send through your server.
- A Shopify customer record, including tags and customer metafields, when you enable that link.
- Mailchimp, Klaviyo, HubSpot, or ActiveCampaign, when you connect a list or a contact create. Klaviyo creates or updates a profile and adds it to a list.
- Google Sheets, Airtable, Slack, or a Zapier webhook, when those integrations are on.
- Shopify Flow, which can carry the submission and the UTM parameters. UTM is stored on the submission and on that Flow trigger. The catalog does not say Klaviyo receives UTM.
- SMS or WhatsApp through Twilio, when you enable that notification.
- A token-based REST API that can read forms and responses or create a submission from your own system.
A file upload is stored under a randomized filename. The catalog does not publish a megabyte cap. A photo is still personal data. The signature pad stores a canvas drawing as a data URL. That drawing can identify a person, and it is not a certificate e-sign workflow. Turn an integration off if the notice does not mention it.
Questions to take to your own counsel
These are the questions to put in front of counsel, with a test submission beside them. This article cannot clear a form for the EU or the UK.
- Which fields are required for the purpose, and which are optional marketing?
- Is the accept-terms label specific enough, and is marketing consent a separate box?
- How long do you keep the inbox row, the export files, and the copies in Sheets, email, and Klaviyo?
- Who answers a customer access request while Shopify's redact webhook may still be delayed?
- What will you tell the customer you deleted, given that the catalog does not publish a field-by-field redact list?
The storefront form ships with locale files. Those files do not rewrite the legal sentence on the checkbox. Translate that sentence yourself.
Questions merchants ask about form privacy
Does webhook support mean the form is GDPR compliant?
No. The app documents Shopify's data-request and redact webhooks. Consent wording, lawful basis, and retention remain the merchant's responsibility, with counsel.
Does the accept-terms box replace a privacy policy?
No. The checkbox records a choice on that submission. The policy is the document the choice refers to. Use both when counsel says you need both.
Can I export everything a customer submitted?
The inbox exports CSV, Excel, and PDF, and a token-based API can read responses. Use the export that matches the request your counsel described. Confirm on a test customer that the file includes the fields you believe you store, including uploads and a signature data URL if you collect one.
Use the webhook support as one fact in a larger privacy review, not as the whole review. The product description is on the SK Form Builder page, and the webhook topics are defined in Shopify's developer docs linked above.