Data Processing Addendum (DPA)
Avada ChatGPT Ads · Last updated: November 3, 2026
This Data Processing Addendum ("DPA") supplements and forms part of the Terms of Service or other agreement ("Agreement") between you (the "Customer," "Data Controller") and Avada, the provider of Avada ChatGPT Ads ("Avada ChatGPT Ads," "Data Processor," "we," "us") regarding the processing of personal data under applicable data protection laws.
By using Avada ChatGPT Ads, you agree to the terms of this DPA. Our Privacy policy describes the same processing in more detail.
1. DEFINITIONS
The following terms have the meanings set forth below. Terms not defined here have the meanings given in applicable data protection laws or our Agreement:
- "Data Protection Laws" means all applicable privacy and data protection laws, including the GDPR, UK GDPR, CCPA/CPRA, Singapore PDPA, and similar regulations worldwide.
- "Personal Data" means any information relating to an identified or identifiable individual, as defined under applicable Data Protection Laws.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- "Shopper" means a visitor or customer of your Shopify store.
- "Sub-processor" means any third party engaged by Avada ChatGPT Ads to process Personal Data on your behalf.
- "Data Subject" means the individual to whom Personal Data relates.
- "Personal Data Breach" means unauthorized access, disclosure, alteration, or destruction of Personal Data.
2. ROLES AND SCOPE OF PROCESSING
2.1 Data Controller and Processor Relationship
You act as the Data Controller, determining the purposes and means of processing Shopper Personal Data. Avada ChatGPT Ads acts as your Data Processor, processing that Personal Data solely according to your documented instructions. Your instructions are the settings you choose in the app, such as which events and pages are tracked and whether advanced matching is on.
For your own account information as a merchant (for example your name and email), Avada is the controller, as described in our Privacy policy.
2.2 Purpose of Processing
Avada ChatGPT Ads processes Personal Data only to provide the app's services, including:
- Measuring ad conversions: sending your store's events and purchases to your own ChatGPT Ads account through OpenAI's pixel and Conversions API
- Avoiding counting the same purchase twice
- Reporting your ad results next to your Shopify orders and revenue
- Detecting problems with your tracking, product feed and campaigns, and alerting you
- Providing customer support
2.3 Categories of Data
We may process the following categories of Shopper Personal Data:
- Shopping events: page views, product views, add to cart, checkout started and purchases, with the page address and time
- Order data: order ID and number, totals, currency, line items, discounts, refunds and cancellations
- Matching details, only with marketing consent: email, phone number, first and last name, city, region, postal code and country. Email, phone and name are hashed before they are sent to OpenAI
- Device and connection data, only with marketing consent: IP address and browser user agent
- Identifiers: a visitor ID created by the app, the Shopify customer ID, OpenAI's ad click and browser references, and UTM campaign parameters
- Consent choices recorded on the cart and in checkout
We do not process special categories of Personal Data. Product catalog data sent to OpenAI for your product feed is not Shopper Personal Data.
2.4 Consent
Events are sent to OpenAI only when the Shopper has allowed marketing cookies and has not opted out of the sale or sharing of personal information. When a Shopper withdraws consent, the app tells OpenAI's pixel, which removes its cookies. Orders that arrive without a consent record are withheld from OpenAI in the EEA, the UK, Switzerland and the US states that require opt-in consent.
3. YOUR OBLIGATIONS
As the Data Controller, you must:
- Maintain lawful basis for sharing Personal Data with Avada ChatGPT Ads and OpenAI
- Provide adequate privacy notices to your Shoppers, including that you use ChatGPT Ads measurement
- Run a cookie banner and obtain the consents your laws require
- Not provide sensitive personal data without prior written agreement
- Ensure your instructions comply with applicable Data Protection Laws
4. OUR COMMITMENTS
4.1 Processing Instructions
We will process Personal Data only:
- According to your documented instructions
- As necessary to provide our services
- To comply with applicable legal requirements
- With your prior written consent for any other purpose
We do not sell Personal Data, we do not use Shopper Personal Data for our own advertising, and we do not combine it across stores.
4.2 Security Measures
We implement appropriate technical and organizational security measures, including:
- Encryption in transit (HTTPS) and at rest
- Additional encryption of stored credentials (AES-256-GCM)
- Hashing of email, phone number and name before they are sent to OpenAI
- Signature checks on Shopify webhooks and storefront requests
- Access controls: only staff who operate and support the app can access its systems
- Incident response procedures
4.3 Data Protection Principles
We adhere to core data protection principles:
- Purpose limitation and data minimization. Matching details read from an order are held only in a short-lived processing queue while the purchase is sent, and are not stored in our database
- Accuracy and timely updates
- Storage limitation
- Confidentiality and integrity
5. SUB-PROCESSORS
5.1 Authorized Sub-processors
We use the following third-party Sub-processors to deliver our services:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Infrastructure, processing queues and logs | United States |
| Firebase | Database and backend services | United States |
| Email delivery provider | Sending alert and weekly emails to you. No Shopper data | United States |
| Crisp | In-app support chat. No Shopper data | European Union |
| Microsoft Clarity | Usage analytics of the app's admin pages, when enabled. No Shopper data | United States |
| Anthropic | AI suggestions for ad copy and feed titles, from one product's details. No Shopper data | United States |
5.2 OpenAI
OpenAI is not our Sub-processor. Events and purchases go to your own ChatGPT Ads account, on your instruction, under your agreement with OpenAI. OpenAI's privacy policy (opens in a new tab) applies to what OpenAI receives.
5.3 Sub-processor Changes
We will notify you at least 30 days before adding new Sub-processors. You may object on reasonable data protection grounds within 14 days of notice.
5.4 Sub-processor Obligations
All Sub-processors are contractually required to provide equivalent data protection as outlined in this DPA.
6. DATA SUBJECT RIGHTS
6.1 Assistance with Rights Requests
We will assist you in responding to Data Subject requests, including:
- Access to Personal Data
- Correction of inaccurate data
- Deletion of Personal Data
- Data portability
- Restriction of processing
The app handles Shopify's mandatory privacy requests (customer data request, customer redact and shop redact).
6.2 Request Handling
If we receive direct requests from Data Subjects, we will promptly redirect them to you unless legally required to respond directly.
7. DATA BREACH NOTIFICATION
7.1 Notification Timeline
We will notify you within 24 hours of becoming aware of any Personal Data Breach affecting your data.
7.2 Breach Information
Our notification will include:
- Nature and scope of the breach
- Categories and number of affected individuals
- Likely consequences and impact
- Measures taken to address and mitigate the breach
7.3 Cooperation
We will provide reasonable assistance with breach assessment, regulatory notifications, and communication to affected individuals as required by law.
8. INTERNATIONAL DATA TRANSFERS
8.1 Transfer Safeguards
When Personal Data is transferred outside your jurisdiction, we ensure appropriate safeguards through:
- Standard Contractual Clauses (SCCs) where required
- Adequacy decisions by relevant authorities
- Additional security measures as necessary
8.2 Current Transfers
The app runs on Google Cloud in the United States. Avada's team in Vietnam can access the app's systems to operate and support it.
9. DATA RETENTION AND DELETION
9.1 Data Retention
- Event records, order records and daily statistics follow your Data retention setting in the app: 30, 60 or 90 days (90 by default). They are then deleted automatically.
- Checkout consent records are kept for 30 days.
- Counts with no personal information may be kept while the app is installed.
9.2 Data Return or Deletion
When you uninstall the app, it deletes the stored OpenAI credentials and the app's feed, pixel and campaign data. Store details, order records and statistics are deleted when Shopify sends its shop redact request, 48 hours after uninstall.
Upon termination of our Agreement or your written request, we will:
- Delete or return all Personal Data within 30 days
- Provide written confirmation of deletion upon request
- Retain data longer only if required by applicable law
10. COMPLIANCE AND AUDITS
10.1 Documentation
We maintain records demonstrating compliance with this DPA and applicable Data Protection Laws.
10.2 Audit Rights
You may audit our compliance with this DPA upon reasonable notice, subject to confidentiality obligations and operational limitations.
10.3 Certifications
We may satisfy audit requirements through relevant third-party certifications and compliance reports.
11. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)
When applicable, Avada ChatGPT Ads acts as a Service Provider under California privacy laws and commits to:
- Not selling or sharing Personal Information
- Processing data only for agreed-upon business purposes
- Not retaining or using Personal Information outside our service relationship
- Providing the same level of privacy protection as required under California law
A Shopper's opt-out of the sale or sharing of personal information stops their events from being sent to OpenAI.
12. LIABILITY
Our liability under this DPA is subject to the limitation of liability provisions in our main Agreement. We will indemnify you against claims arising from our material breach of this DPA, subject to prompt notification and reasonable cooperation.
13. UPDATES TO THIS DPA
We may update this DPA from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes and post the updated version on our website. Continued use of our services constitutes acceptance of the revised DPA.
14. GOVERNING LAW
This DPA is governed by the laws of Singapore. However, where Data Protection Laws require specific governing law or jurisdiction, those requirements will take precedence.
15. CONTACT INFORMATION
For questions about this DPA or our data processing practices, contact us at:
Avada ChatGPT Ads Privacy Team
Email: [email protected] or [email protected]