Acceptable use

Your API key returns real commerce data from your Shopify stores, including personal data about your customers. A few rules come with that. They are short, and none of them is a surprise — but they are not optional, because most of them flow from Shopify's own terms rather than ours.

warning

Breaching these rules puts your EcomSolo account and, in some cases, our Shopify app at risk. If something you want to build looks like it might cross a line, ask us first at support@ecomsolo.com — we would much rather have that conversation early.

Where the rules come from

EcomSolo reads your store data from Shopify with your permission, and serves it back to you through this API. Shopify's API terms allow us to hand that data to you and to destinations you nominate, because you — the merchant who owns the data — authorized it. Creating an API key is that authorization.

That authorization is what makes the API legitimate, so the conditions attached to it pass through to you.

You may

  • Pull your data into your own systems: a warehouse, a BI tool, a spreadsheet, an internal dashboard, a script.
  • Share it inside your organisation, and with contractors or agencies working on your behalf.
  • Combine it with data from other sources.
  • Store it for as long as you have a legitimate reason to.

You may not

Republish the data publicly

Never expose data from this API on a public or unauthenticated endpoint — a page anyone can load, an open bucket, a URL without a login. Shopify's terms specifically prohibit putting merchant data anywhere a search engine or crawler can reach it, and an unauthenticated endpoint is exactly that.

Practical version: if a URL returns store data and it does not check who is asking, it is a problem regardless of how obscure the URL is.

Resell or redistribute the data

You may not sell, license or redistribute data obtained from this API to third parties. Sending your own data to a service you use is fine. Turning it into a product other people buy is not.

Train AI or machine-learning models on it

warning

Data obtained from this API may not be used to create, develop, train, fine-tune or improve any machine-learning or artificial-intelligence system.

This one catches people out, so it is worth being concrete. The prohibition comes from Shopify's API terms and it applies to data that originated from Shopify — which is nearly everything this API returns.

  • Asking an AI assistant a question about your data is normally fine. That is inference, not training.
  • Feeding API responses into a training or fine-tuning pipeline is not.
  • Watch the defaults. Several AI providers train on data submitted through their APIs unless you explicitly opt out. If you pipe EcomSolo responses into a model provider, check that setting — the obligation is yours, and it is easy to breach by accident rather than intent.

If you have a genuine use case here, it needs the merchant's and Shopify's consent rather than a workaround. Talk to us.

Customer personal data

Some responses contain personal data about your customers. POST /v1/query can return customer names, and record endpoints return more — email addresses, phone numbers and shipping addresses.

You are the controller of that data; we process it for you. So when it lands in your systems, your obligations follow it:

  • Have a lawful basis for holding it, and keep it only as long as you need it.
  • Honour erasure and access requests from your customers — including for copies sitting in the systems you pulled data into.
  • Protect it in transit and at rest, and limit who on your team can reach it.
  • Respect the marketing-consent state that comes with the record. A customer who did not opt in has not opted in just because their row is now in your warehouse.

tip

Only ask for the fields you need. It is the cheapest way to reduce your exposure, and every endpoint here lets you choose your columns.

When your customers or Shopify ask you to delete data

If a customer exercises their erasure rights, or you disconnect a store from EcomSolo, data we hold is deleted — see Data deletion and When access ends for what happens to your keys.

Copies you pulled through the API are outside our reach, so deleting them is your responsibility. It is worth knowing where those copies live before someone asks you to erase them.

Keys are your responsibility

An API key acts with your authority. You are responsible for what is done with it, including by anyone you give it to.

  • Issue a separate key per integration, so you can revoke one without breaking the rest.
  • Never put a key in browser JavaScript, a mobile app, or anything a third party can read.
  • Revoke a key the moment it is no longer needed, or if it may have been exposed.
  • If you give a key to an agency or contractor, these rules apply to them too — and the account remains yours.

See Authentication for how keys work and how to revoke one.

FAQ

Can I load EcomSolo data into my data warehouse?

Yes. That is one of the main reasons the API exists. Keep it access-controlled once it lands, and remember the personal-data obligations travel with it.

Can I use an AI tool to analyse my data?

Asking questions of your data is normally fine — that is inference. What you may not do is use the data to train, fine-tune or improve a model. Check whether your AI provider trains on API inputs by default, because some do.

Can I build a public dashboard for my customers?

Not with unauthenticated access to store data. If each viewer logs in and only sees data they are entitled to, that is a different situation — but a public page serving store data is not permitted.

Can I share a key with my agency?

Yes, and it is better to issue them their own key so you can revoke it independently. These rules bind them, and the responsibility stays with your account.

What happens if I stop paying, or uninstall?

Access ends. See When access ends for the detail — keys are revoked and the data endpoints stop answering.