Privacy and security
How do I handle access, deletion and objection?
Privacy requests are handled in the portal under “Privacy”, not by ticket. Every request is recorded and logged in the change log; the data subject is located through a pseudonymous identifier.
A data subject exercises their rights. What do I do?
How the person is found
The search does not take names or addresses: event fields are not meant to hold them, and detected email addresses and phone numbers are rejected on receipt. Pseudonymous identifiers are accepted.
| Identifier | Origin |
|---|---|
| id_… | public identifier of an identity |
| jr_… | public identifier of a journey, found under “Customer Journeys” |
| anonymous_id | first-party identifier of the browser |
| customer number or user_id_hash | as your shop sends it, for example the SHA-256 of the email address from the Shopify app or the Shopware plugin |
| order number or lead ID | from the shop or CRM system |
A customer number is stored only after being combined with your account’s key. You still enter it the way your shop sent it: Metrunio does the combining itself during the search and finds both forms.
Effect of each request type
| Type | Effect |
|---|---|
| Access (Art. 15) | produces a JSON file with identities, links, journeys, touchpoints, conversions and raw events, plus the stored consent decisions, the recipients of reported conversions and any suppression in place; changes nothing |
| Deletion (Art. 17) | deletes raw events, conversions and identities; attribution values already reported decrease retroactively |
| Objection (Art. 21) | removes identifiers, addresses and referrer and deletes the links; journeys, values and timestamps remain without them for aggregated reporting. Revenue reconciliation orders for the given order number are deleted, because they serve no other purpose |
| Rectification (Art. 16) | is not automated: a pseudonymous attribution can be wrong too, and it has to be corrected everywhere it could be rebuilt from. Write to privacy@metrunio.com with the request ID; the correction is made by hand following our documented procedure, including the recipients the data went to. Afterwards you close the request with “Close as done” and a record of what was done |
| Restriction (Art. 18) | is not a request type of its own in the portal, and a deletion does not replace it. Write to privacy@metrunio.com with the request ID: following our documented procedure, the affected data is preserved under protection and blocked from reports, AI queries, exports and reports to advertising platforms. Affected recipients are included |
Caution
Before execution the identifier must be repeated for confirmation. A completed request cannot be run again. The Admin role is required (privacy.read and privacy.write).
- After a deletion or objection the message states how many records were affected and how many identifiers are suppressed. If an inventory check was shown above, it is run again; if that fails, it is marked as out of date.
- The access file is created from the data as it stands when you download it (generatedAt) and is not stored. If you download it after a later deletion, whatever was deleted is missing.
- It contains at most 5,000 rows per table; exportTruncated says whether there was more. If it is true, the access file is not yet complete: request the supplementary complete export via privacy@metrunio.com, quoting the request ID, before you answer the access request and close it.
Note
The platform administration sees the request, its status and deadline, but not the data subject’s identifier. Handling stays with you.
Requests from Shopify
If your store is connected through the Metrunio app, deletion and access requests from your customers arrive via Shopify. Metrunio carries out a deletion itself on receipt, with the same routine as “Carry out” in the portal, and puts the identifier on the suppression list; the request then shows as completed. An access request stays open and carries the deadline Shopify sets: 30 days from receipt. Open requests with a deadline are shown at the top of the privacy area.
A deletion from Shopify lists the customer’s order IDs alongside the email checksum. Metrunio deletes by those as well, so that revenue reconciliation orders stored under nothing but their order ID are covered, and suppresses the order IDs. If the email address is missing, the request shows the order IDs as its identifier in the portal.
Legal note
The 30-day deadline is Shopify’s expectation. The one-month deadline under Art. 12(3) GDPR applies independently and can end sooner if the customer contacted you first.
Last reviewed on 16 Oct 2026
In the customer portal
Also asked
- GDPR access request
- Carry out a deletion request
- Article 15 access
- Article 21 objection
- Deletion request from Shopify
- customers/redact
- Deadline for access requests from Shopify
- Deletion by email checksum
- Orders in a Shopify deletion request
- orders_to_redact
Related articles
- Does a deletion take lasting effect?
Does a deleted person’s data come back on their next visit?
It lasts: a deleted person’s data does not come back on their next visit. Deletion and objection put the identifiers concerned on a suppression list; only a hash of them is stored, which is still pseudonymous personal data and is read for nothing but enforcing the suppression. The collector rejects events from suppressed persons before anything is stored.
- How long is data retained?
Which retention periods apply and can I change them?
Raw events are retained for 180 days by default, 90 days on the free Start plan; the period is configurable per tenant up to the plan’s limit and enforced automatically. Journeys, touchpoints and conversions share the period of the raw events they were derived from and are deleted with them, or earlier if a deletion is requested. If a change of plan lowers the limit below the configured period, we announce the reduction 30 days in advance.
- How do I inspect a single journey?
Where can I trace which contacts preceded a conversion?
Under “Customer journeys” you open a journey by its order number and see ad contacts, visits, shop steps and conversions in one sequence with the time. Each touchpoint names time, channel, campaign and the share under the model of the context row; the side column says how that model splits the conversion across channels, and what was recorded.
- How do I set up Metrunio in Shopify?
How do I connect my Shopify store to Metrunio?
You install the Metrunio app in your store via its installation link: from the setup assistant in the portal or from our email. If you do not have a Metrunio account yet, the app creates one without a second sign-up once you accept the terms and conclude the data processing agreement with two tick boxes; an existing account you connect by signing in to the portal. Measurement starts only once the DPA is concluded, and then covers storefront, checkout and order at once, with no change to your theme code.
- Additional instruction for revenue reconciliation
When do orders count after a refusal in the cookie banner?
Orders your shop reports server-side after a refusal in the banner only count if the additional instruction for revenue reconciliation is activated for your account. You fill it in and sign it, and then we activate it; without it Metrunio rejects such orders. Orders with no decision in the banner at all count even without the instruction.