The definitions are frustratingly vague. "Any customer data excluding sensitive personal data", which doesn't exclude stuff that isn't relevant to them, or things that don't fit in the API.

Also, it states that apps "not use an alternative to Shopify Checkout for web checkout or payment processing, or register any transactions through the Shopify API, without Shopify’s express written authorization".

That's from 2.3.17-18 of the api terms of use: https://www.shopify.com/legal/api-terms