GapFillKeep your tag. Fill the gap.
English 日本語

GapFill

Privacy Policy

Last updated: 2026-10-07

This policy explains how GapFill: GA4 Server Tracking (“GapFill”, “the app”) handles data when a Shopify merchant installs and uses it. GapFill is provided by ULTRO Inc. (“we”, “us”), 2-19-15 Shibuya, Shibuya-ku, Tokyo, Japan (Miyamasuzaka Building 609). This policy covers the app only. For our website, see the ULTRO privacy policy (Japanese).

1. What GapFill does

GapFill compares a store’s Shopify orders with the purchases recorded in the merchant’s own Google Analytics 4 (GA4) property, and sends purchases that GA4 did not record to that same GA4 property using the GA4 Measurement Protocol. This includes orders paid inside AI assistants and social apps, which never reach the GA4 tag. If the merchant turns them on in Settings, GapFill also sends subscription renewal orders, orders from other routes, refunds and cancellations. The merchant controls the GA4 property. We act as a service provider (processor) for the merchant, under the Data Processing Addendum.

2. Data we collect

From the merchant and Shopify

  • Store information: the shop’s myshopify domain and Shopify shop ID, the installed plan, and the access token Shopify issues to the app.
  • Order data read through the Shopify Admin API: order ID and number, time created, totals, taxes, shipping, discounts and discount codes, currency, line items (product and variant IDs, SKU, title, vendor, product type, price, quantity), sales channel, payment gateway names, refunds and cancellation time, whether a line item was bought as a subscription, the landing page, referrer and UTM parameters of the last visit, and the shipping or billing country.
  • The Shopify customer ID (a number) of orders that contain a subscription. We use it only to recognise later renewal orders from the same customer. We do not read or store customer names, email addresses, phone numbers or street addresses.
  • Product catalog data (product and variant IDs, SKUs and titles), used to match the item ID format already used in GA4.
  • The time the merchant approved sending and the version of the Terms of Service in effect at that time.
  • An email address for product updates, only if the merchant turns on “Email updates” in Settings and enters one, together with the time it was turned on. We do not read the store’s contact email from Shopify.

From the store’s customers, through a Shopify web pixel

  • The GA4 client ID and session ID and number from the customer’s browser, the checkout token and order ID, and the customer’s analytics and marketing consent status as reported by Shopify’s Customer Privacy API.
  • The pixel runs only when the merchant has a paid plan and follows the customer privacy settings of the store. We do not use this data to identify individuals.

From Google

  • When the merchant signs in with Google, we receive an OAuth refresh token and the email address of the Google account. We use the scopes analytics.readonly and analytics.edit, plus openid and email.
  • Through the Google Analytics Data API and Admin API we read the list of GA4 properties and data streams, and report data for the connected property: transaction IDs with purchase revenue and refund amounts, and item IDs and names of viewed, added-to-cart and purchased items.
  • With the merchant’s approval, we create a Measurement Protocol API secret named “GapFill” in the connected property and confirm the GA4 user data collection acknowledgement, which Google requires before a secret can be created.

3. How we use data

  • To show the merchant a report of orders that are missing from GA4.
  • To send purchase, campaign and refund events for those orders to the merchant’s own GA4 property.
  • To send a subscription renewal order with the same GA4 client ID as the customer’s first subscription order, so GA4 counts both as one user. This happens only when the merchant has turned on renewal sending and chosen this method, and never for a customer who declined analytics at the first order.
  • To calculate usage for billing. We report only a count of recovered purchases to Shopify, with no customer information.
  • To keep the app secure, fix problems and provide support.
  • To email product updates and tips about GapFill to merchants who turned on “Email updates”. We do not send these emails to anyone else, and the merchant can turn them off in Settings at any time.

We do not sell data, use it for advertising, or combine data from one store with another.

4. Google user data

GapFill’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features described above to the merchant who connected the account. We do not transfer it to others except as needed to provide the service (see section 5), to comply with law, or as part of a merger or acquisition with notice to the merchant. No person at ULTRO reads Google data unless the merchant asks us to for support, it is needed for security, or the law requires it. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models, and we do not sell it or use it for advertising. Section 7 describes how this data is protected.

5. Service providers

  • Cloudflare, Inc. (United States): hosting, database and scheduled jobs.
  • Google LLC (United States): sign-in and the GA4 APIs, and the merchant’s GA4 property, which receives the events.
  • Shopify Inc. (Canada): the platform, billing and the web pixel.

Data may be processed in countries other than the merchant’s or customer’s own, including the United States and Japan.

6. Retention and deletion

  • GA4 client and session IDs collected by the pixel are deleted after 30 days.
  • For subscription orders, the link between the Shopify customer ID and the GA4 client ID of the first order is kept for 13 months after it was last used, because renewals can arrive months apart. If the customer declined analytics, no client ID is stored. The link is deleted earlier when the customer asks the store to erase their data or the merchant uninstalls the app.
  • The content of each event we sent, kept so the merchant can review it, is deleted after 90 days. A record that an order was sent (order ID and time) is kept while the app is installed to prevent sending it twice.
  • When a customer asks a store to erase their data, Shopify notifies us and we delete the pixel data, the sent-event content for that customer’s orders, and the customer ID link described above.
  • When a merchant uninstalls the app, sending stops immediately. Shopify asks us to erase the store’s data 48 hours later, and we then delete all data for that store, including the Google refresh token.
  • A merchant can disconnect Google at any time in the app’s Settings page. When they do, we revoke the refresh token at Google, delete it from our database, and delete the Measurement Protocol API secret that GapFill created. A merchant can also remove GapFill’s access in their Google account settings.
  • The email address for product updates is deleted when the merchant turns “Email updates” off, and with the rest of the store’s data after uninstall.
  • Data already sent to GA4 is stored by Google under the merchant’s GA4 settings, and GapFill cannot delete it.

7. How we protect data

This section describes the safeguards we apply to all data in GapFill, including the sensitive data we receive from Google APIs (the OAuth refresh token, the Google account email address, and Google Analytics property and report data).

  • Encryption in transit. All connections between the merchant’s browser, GapFill, Google, Shopify and our hosting provider use HTTPS (TLS).
  • Encryption at rest. The Google refresh token, the Measurement Protocol API secret and all other stored data are kept in a managed database at Cloudflare, which encrypts stored data at rest. Application credentials, such as the Google OAuth client secret, are stored as encrypted secrets in the hosting platform and are never included in the app’s source code or sent to the browser.
  • Short-lived access tokens. Google access tokens are held in memory only for as long as they are valid (about one hour) and are never written to the database or to logs.
  • Data minimisation. We request only the Google scopes the features need, read only the report fields listed in section 2, and store only the result of the comparison for the connected property. Google Analytics data is never sent to the merchant’s browser beyond the report shown in the app, and is never shared between stores.
  • Access control. Each request to the app is authenticated with a session token issued by Shopify, so a merchant can see only their own store’s data. Access to the production database and hosting account is limited to the ULTRO personnel who operate the app. No person at ULTRO reads Google user data unless the merchant asks us to for support, it is needed to investigate a security incident, or the law requires it.
  • Integrity of incoming requests. Webhooks from Shopify are verified with their HMAC signature, and the Google sign-in flow uses a signed state value to prevent forged requests.
  • Logging. Application logs record what the app did and any errors. They do not contain tokens, API secrets or the content of Google Analytics reports.
  • Deletion. Google data is deleted when the merchant disconnects Google or uninstalls the app, as described in section 6.
  • Incidents. If we become aware of unauthorised access to merchant or Google user data, we will notify the affected merchants by email without undue delay and take steps to contain it, including revoking the affected tokens.

8. Your rights

Merchants can request access to, correction of, or deletion of their data by emailing us. Customers of a store should contact that store; the store can ask us to act on the request, and customer data requests sent through Shopify are handled automatically as described above. Depending on where you live (for example under the GDPR, UK GDPR, CCPA or Japan’s Act on the Protection of Personal Information), you may have further rights, which we will respect.

9. Changes

We will update this page when the way GapFill handles data changes, and change the date at the top. If a change affects how merchant or customer data is used, we will tell merchants by email before it takes effect.

10. Contact

ULTRO Inc., 2-19-15 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan (Miyamasuzaka Building 609)
Email: [email protected]