Our first experiences of SHOP aka Shopify today were informative, despite one of us claiming never to have joined or saved details to Shopify, installed the App or created an account. It was evident some form of tracking was in place with automatic pre-filling of all the details including CC when making an online purchase with a known Australian Brand “ooGee”.
Initially we thought Safari was the source of the details and CC - however (refer to link below to check) we found that there were no saved CC details attached to Safari and only limited contact details insufficient for the order to be pre-filled for shipping. It would appear an online purchase some weeks or months prior with another business may have provided the details to Shopify to save. A cookie or two or other forms of user tracking may have completed the link.
It’s not totally clear how this other business contributed. We attempted a trial order of the earlier used site. It offered a direct order by completing their web order form and using any of the popular CC choices EG AMEX, VISA, PAYPAL, …. Or separately to click on the SHOP logo to pre-fill all and order. It would appear that if one uses the retailer’s order form with a manual entry, it is likely connected to Shopify and may be their form. An added option at the end to save your details for the next time you use that retailer. Somewhere in the fine print or T&C’s we think our purchaser did not observe any advice connecting Shopify to the form just completed or the save option. IE in saving the information when filling out a direct order with the retailer one was agreeing subsequently to saving that content with Shopify. It only needs a small SHOP logo at the end of the text from experience elsewhere. A logo that may not mean anything to some.
It’s arguable that a decision to use SHOP (Shopify) by a retailer as a service lowers their risk of loss of a customers CC and other personal information. Shopify attest to having a secure system of encryption of such data. Please consider how secure is relative to none and never 100% guaranteed.
We ultimately accessed Shopify and the personal account the user had created despite the user believing they had never created one. To note both ooGee and the previous retailer were revealed in the purchase history.
It is possible to delete ones Shop (Shopify) account including all personal details. It came with advice this could take up to 30 days and all purchase history would also be deleted. Note deletion might affect orders in progress or the ability to retrieve past order details available through a Shopify link.
We noted with ooGee that the order placed had sent a conformation email with several links included. The large blue button in the email to track the order actually transferred one to Shopify’s website. Fortunately in lesser text was a link direct to the shipping agent independent of Shopify. The Shopify link also encouraged one to connect to or create an account.
Aside from the questionable promotion of the SHOP (Shopify) business model one potentially serious concern with how the account is managed. To connect to your account one only needs to provide an email, upon which a 6 digit code is sent to that email to confirm on the web connection one is the owner. While key personal details are incomplete once connected/logged in there are details of all recent purchase history. I’ll leave it for others to consider whether that is an adequate level of security, or the usefulness to someone gaining access.
RE SAFARI and Pre-Fill Settings.
For APPLE devices and the Safari browser, the following provides guidance on enabling (the default) or disabling.
To note my experience of using Safari is it asks one before it pre-fills details on a form and requires one to accept. Safari also by default allows one to select any from your contacts list for the pre-fill.
