GDPR might be a problem here. But this brings us to an important point: this is not your infrastructure, but someone elses.
*privacy invasive that GDPR is explicitly set up to make harder, so duh
Also, lots of companies assert GDPR compliance via magical thinking. They most often are wholly wrong. Shopify can say whatever they want, but there’s no certification body.
Source: I’m the person who evaluates and builds compliance systems for a range of services you almost definitely use.