How is customer data processed by Google and Facebook?

Files generated by the module

The module writes contact details to a plain-text CSV without hashing or content encryption. The file is stored in your shop and can be downloaded to your computer. Later processing by Google or Meta does not delete these copies: protect access and manage their retention.

When uploading to Google Ads

For a manual upload of unhashed contact details, Google says that email addresses, phone numbers, first names and last names are hashed on your computer before transmission. Country and postal code are not hashed. Hashes support matching to Google accounts; not every uploaded customer will necessarily be matched.

This step is described in the official manual upload instructions. Google describes data use, access and retention in its Customer Match data documentation. Those commitments concern its processing; they do not delete your own export files. Customer Match membership lasts for no more than 540 days; this duration does not describe how long your shop retains its CSV.

When uploading to Meta

The module’s original CSV still contains plain-text data before upload. For Meta’s rules on hashing, matching and retention, consult its customer information hashing guidance and Customer List Custom Audiences Terms.

Hashing and responsibilities

Hashing should not be treated as encryption or a guarantee of anonymisation. Pseudonymised data remains personal data. Informing customers and obtaining the necessary permissions remain essential; creating an audience does not prove compliance.

See also module configuration and export, Google Ads upload and Meta upload. The privacy policies of Google and Meta provide further information.