Privacy Policy — Notion Connection
Last updated: November 12, 2026
Notion Connection ("the app") is a Shopify app built and operated by Tamerio Web Studio ("we", "us"). It syncs order and product records from a merchant's Shopify store into databases in the merchant's own Notion workspace. This policy explains what data the app processes, what it deliberately does not, and how it is handled.
If you are a merchant considering installing the app, or a customer of a merchant who uses it, this policy applies to you.
The short version
The app never collects, stores, or transmits any personal data about a merchant's customers. It syncs order and product records — order status, totals, line items, product catalog details — and strips every customer field (name, email, phone number, billing address, shipping address) before that data is queued for processing. This is enforced in code, not just policy: every webhook payload passes through a single whitelist function that builds its output from named, non-personal fields only, and is never permitted to copy or forward the payload it receives.
What data we process
From Shopify
When installed, the app requests exactly two permissions: read access to orders and read access to products. It never requests access to customer records, and never requests permission to write, modify, or delete anything in a merchant's Shopify store — the sync runs in one direction only, from Shopify into Notion.
From each order, the app reads and retains only: the order's identifier, order number, financial status, fulfillment status, delivery status and the name of the delivery method chosen, total price, currency, line item titles/quantities/prices, product variant names, item count, merchant-applied order tags, creation and last-updated timestamps, cancellation status, and a link back to the order in Shopify admin. It does not read or retain the customer's name, email address, phone number, billing address, shipping address, IP address, browser information, parcel tracking numbers, order notes, or any custom gift message or line item property a customer may have entered at checkout.
From each product, the app reads and retains only: the product's identifier, title, status, vendor, product type, price, inventory count, tags, the first product image's URL, the last-updated timestamp, and a link back to the product in Shopify admin.
To stay connected to Shopify, the app also stores, for each installed store, its Shopify domain, the permissions it was granted, the access and refresh tokens Shopify issued to the app, and which plan the store is on (Free, Plus or Pro), as reported by Shopify's own billing. The tokens are encrypted at rest (see Data security below).
From Notion
The app stores an encrypted OAuth access token for the merchant's connected Notion workspace, the workspace name, and the identifiers of the Orders and Products databases it syncs to. These are either databases the app creates or databases the merchant chooses.
To do its job, the app also reads a small amount of information from the pages and databases the merchant has shared with it. None of it is stored:
- Database columns. The names and types of the columns in the databases it syncs to, so it can add any column it needs that is missing.
- Whether its pages still exist. So a record the merchant deleted by mistake can be recreated.
- Page and database titles, and where they sit. When a merchant chooses new databases to sync to, the app lists the pages and databases shared with it, grouped by page, so the merchant can pick from them.
- Team columns, once, during a switch. When a merchant moves the sync to different databases, the app reads four columns from each page it already created (Owner, Stage, Ops notes and Reorder point) and writes them onto the matching page in the new databases, so the team's work carries over. Owner is read as Notion user IDs only, never names or email addresses. The values are held in memory just long enough to copy them and are never saved by the app. This happens only when the merchant starts a switch.
The app does not read the content of any page, any comments, or anything else in the merchant's workspace. It never edits or deletes databases it has stopped syncing to.
What we do not collect
- Customer names, email addresses, or phone numbers
- Billing or shipping addresses
- Payment details or payment method information
- Browsing behavior, analytics, or tracking data
- Cookies used for advertising or cross-site tracking
How we use the data we process
Order and product data is used for exactly one purpose: to create and keep up to date a matching record in the merchant's own Notion workspace, so the merchant can view and organize their store's orders and inventory outside Shopify admin. Data is never used for advertising, sold to any third party, or shared with anyone other than the merchant's own Notion workspace and the service providers below, which process it only to run the app.
Service providers
The app relies on a small number of providers, each of which handles data only to provide its service to us:
- Railway hosts the app, its database, which holds the records described above, and the job queue (Redis) that carries records to Notion. A queued record is the same sanitized order or product record described above, never the payload Shopify sent. See Data retention for how long queued jobs are kept.
- Notion receives the synced records, in the workspace the merchant connects.
- Sentry receives technical error reports when something fails. Reports are scrubbed of customer data and credentials before they are sent.
Data retention
The app retains a mapping between each synced Shopify record and its Notion page for as long as the merchant keeps the app installed, so that updates to an order or product update the same Notion page rather than creating a duplicate. If a sync fails, a sanitized error record is kept to help diagnose the failure — this record is built from the same whitelist as everything else and never contains customer data.
Queued jobs that carry an order or product record are removed automatically: completed ones after one day, failed ones after seven days, and ones that failed repeatedly, which are set aside so the cause can be investigated, after 30 days. The other jobs (the first import, the nightly check and moving to different databases) carry only the store's domain.
Uninstalling the app immediately clears the Notion connection and stops
all further syncing. A merchant can request full deletion of all records
the app holds for their store at any time by contacting us (see below).
The app also processes Shopify's mandatory shop/redact
webhook automatically, which deletes everything held for that store: its
records and mappings, its Shopify session and tokens, and its jobs in
the queue.
Data security
The Notion access token, and the access and refresh tokens Shopify issues to the app, are encrypted at rest using AES-256-GCM. All traffic between Shopify, the app, and Notion is encrypted in transit using HTTPS. Every inbound webhook is cryptographically verified before it is processed, so data cannot be injected by an unauthorized source. The pages merchants see inside Shopify admin are marked so that browsers do not store them.
Customers' rights (GDPR and equivalent)
Because the app does not collect or store any personal data about a
merchant's customers, a customers/data_request or
customers/redact request received from Shopify is a no-op —
there is nothing to return or delete, since nothing was ever retained. We
still log that the request was received to confirm it was handled,
without logging any personal data the request itself may have carried.
Children's privacy
This app is a business tool used by Shopify merchants and is not directed at children. It does not knowingly collect data from or about children.
Changes to this policy
If how the app handles data changes, this page will be updated and the "last updated" date above will reflect the change.
Contact us
Questions about this policy or requests regarding your data can be sent to:
Tamerio Web Studio
info@tamerio.com