GapFillKeep your tag. Fill the gap.
English 日本語

GapFill

Data Processing Addendum

Last updated: 2026-10-07

This Data Processing Addendum (“DPA”) is part of the GapFill Terms of Service between the business that operates the store (“you”) and ULTRO Inc. (“ULTRO”, “we”). It applies whenever GapFill processes personal data of your store’s customers on your behalf. You agree to it when you agree to the Terms of Service. If this DPA and the Terms of Service differ on the handling of personal data, this DPA prevails.

1. Roles

  • You decide why and how your customers’ personal data is processed. You are the controller (or “business”) of that data.
  • We process that data only to provide GapFill to you. We are your processor (or “service provider”).
  • “Customer personal data” in this DPA means the personal data of your store’s customers and visitors that GapFill processes for you, as listed in section 2.

2. What is processed

  • Purpose. To compare your Shopify orders with the purchases in your GA4 property, to send the purchases, refunds and cancellations you chose to your own GA4 property, to count usage for billing, and to keep the app secure and supported.
  • People concerned. Customers who place orders in your store and visitors who reach its checkout.
  • Types of data. Order data (order ID and number, time, totals, items, sales channel, payment gateway names, refunds, the landing page, referrer and UTM parameters of the last visit, and the shipping or billing country); the GA4 client ID and session ID from the customer’s browser; the checkout token; the customer’s analytics and marketing consent status; and, for orders that contain a subscription, the Shopify customer ID. GapFill does not read or store names, email addresses, phone numbers or street addresses.
  • Duration. For as long as the app is installed, and until the data is deleted as described in section 8.

The full list of data and how it is used is in the Privacy Policy.

3. Your instructions

  • We process customer personal data only on your documented instructions. Your instructions are the Terms of Service, this DPA, and the choices you make in the app (the GA4 property you connect, what you turn on in Settings, and your approval to start sending).
  • We do not sell customer personal data, use it for advertising, use it for our own purposes, or combine data from your store with data from another store.
  • If we believe an instruction breaks data protection law, or if we can no longer meet our obligations under this DPA, we will tell you.

4. Your responsibilities

  • You have a lawful basis for the processing, give your customers the notices the law requires, and obtain any consent the law requires.
  • You set up your store’s customer privacy settings correctly. GapFill follows the consent status that Shopify reports for each customer and does not send purchases of customers who declined analytics cookies.
  • Your GA4 property is your own. Data that has been sent to GA4 is stored by Google under your agreement with Google, and GapFill cannot change or delete it.

5. Confidentiality and security

  • Only ULTRO personnel who operate the app can access the production systems, and they are bound by confidentiality.
  • We apply the technical and organisational measures described in section 7 of the Privacy Policy, including encryption in transit and at rest, access control per store, verification of incoming requests, and logs that do not contain tokens or secrets.
  • We may update these measures, but we will not lower the overall level of protection.

6. Sub-processors

  • You authorise us to use the service providers listed in section 5 of the Privacy Policy as sub-processors. At the date of this DPA, customer personal data is stored and processed at Cloudflare, Inc. (hosting and database), and events are sent to your own GA4 property at Google.
  • We have written terms with each sub-processor that require it to protect the data, and we remain responsible for its work.
  • Before we add or replace a sub-processor that handles customer personal data, we will update that list and tell you in the app or by email at least 30 days in advance. If you object, you can stop the processing by uninstalling the app before the change takes effect.

7. Requests from individuals and help with compliance

  • When a customer asks your store to erase or provide their data, Shopify notifies us and we handle the request automatically, as described in the Privacy Policy.
  • If a customer contacts us directly, we will refer them to you and will not respond on your behalf unless the law requires it.
  • Taking into account the kind of processing and the information we have, we will give you reasonable help with data protection impact assessments and with requests from a regulator that concern GapFill.

8. Deletion

  • GA4 client and session IDs collected by the pixel are deleted after 30 days. The content of each event we sent is deleted after 90 days. The link between a Shopify customer ID and a GA4 client ID, kept for subscription renewals, is deleted 13 months after it was last used.
  • When you uninstall the app, sending stops immediately. Shopify asks us to erase your store’s data 48 hours later, and we then delete all customer personal data for your store.
  • You can ask us to delete your store’s data earlier by emailing us.

9. Security incidents

If we become aware of unauthorised access to, or loss of, customer personal data in GapFill, we will notify you by email without undue delay, and where feasible within 72 hours. We will tell you what happened, what data is affected and what we are doing about it, and we will update you as we learn more. We will take reasonable steps to contain the incident.

10. Information and audits

On request, we will give you the information reasonably needed to show that we meet this DPA. We will answer a written security or privacy questionnaire once a year, or more often if a regulator requires it or after a security incident that affects your data. Because GapFill runs on shared infrastructure, on-site audits are not available unless the law requires them.

11. International transfers

  • ULTRO is established in Japan, and the app is hosted on Cloudflare’s global network. Customer personal data may be processed in Japan, the United States and other countries where our sub-processors operate.
  • Where the law that applies to you restricts the transfer of personal data to another country, the transfer to ULTRO relies on an adequacy decision where one applies. The European Commission and the United Kingdom have recognised Japan as providing an adequate level of protection.
  • Where no adequacy decision applies and the law requires another safeguard, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914, Module Two, controller to processor) apply between you and us and are incorporated into this DPA by reference, with you as data exporter and ULTRO as data importer, together with the UK addendum issued by the UK Information Commissioner where UK law applies. The details of the processing are those in section 2, and the security measures are those in section 5. Contact us if you need a signed copy.

12. California

Where the California Consumer Privacy Act applies, we act as your service provider. We do not sell or share customer personal data, do not keep, use or disclose it for any purpose other than providing GapFill to you, and do not combine it with personal data we receive from other sources, except as the Act allows a service provider to do. We will tell you if we can no longer meet these obligations.

13. Liability, term and law

  • The limits of liability in section 10 of the Terms of Service apply to this DPA, to the extent the law allows.
  • This DPA applies for as long as we process customer personal data for you.
  • The governing law and courts are those set out in the Terms of Service, unless data protection law requires otherwise.
  • A Japanese translation is available for reference. If the two versions differ, this English version prevails.

14. Contact

ULTRO Inc., 2-19-15 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan (Miyamasuzaka Building 609)
Email: [email protected]