What information is shared between my site and the Provenance app?

The Provenance app is deliberately narrow in what it accesses. It requests only permission to read and write product information — nothing else. It does not request or receive access to orders, customer records, customer or shopper email addresses, payment data, or any checkout information, and it has no technical ability to do so.

What we read from your Shopify store:

• Basic store details — store name, store URL, .myshopify.com domain, and the store-owner email associated with your account (used for account setup and support, not shopper data).
• Product catalogue data — product, variant, and collection details such as titles, handles, descriptions, SKUs, barcodes (GTINs), images, and prices. This lets us match your products to their sustainability proof points.

What we write back to your Shopify store:

• Provenance "proof points" and trust content, and SEO-friendly structured data (JSON-LD), stored on your products and collections. This is display-ready marketing content — it contains no secrets and no personal data.

What we share from the Provenance platform:

• The sustainability claims and proof points associated with your store's products, which we send to the plug-in so they can be displayed on your storefront.

On your live storefront:

• The app renders the Provenance trust badge and proof-point content on your product pages.
• It can optionally collect anonymous, aggregate engagement signals (e.g. badge impressions and clicks) to measure performance. These signals contain no personal identifiers — only page URL, referring site, and browser type — and analytics can be switched off entirely.

On uninstall, all data associated with your store is deleted from our system.