Privacy policy

Avada ChatGPT Ads · Last updated: November 3, 2026

This policy explains how Avada ("Avada", "we", "us") collects, uses, shares and deletes information through Avada ChatGPT Ads (the "App"). The App connects a Shopify store to the merchant's own ChatGPT Ads account. It covers merchants who install the App ("Merchants") and the visitors and customers of their stores ("Shoppers").

Avada ChatGPT Ads is built by Avada. It is not made, endorsed or sponsored by OpenAI. ChatGPT and OpenAI are trademarks of OpenAI.

1. Our role

• For Shopper information, the Merchant decides why it is processed and Avada processes it on the Merchant's behalf, as a processor or service provider. Shoppers can contact the store they visited, and the store can contact us.
• For Merchant account information, Avada is the controller.

2. Information we collect

From Merchants

• Store details from Shopify: shop domain, store name, owner name, email, phone, address, plan, currency and time zone.
• Shopify access tokens, stored encrypted.
• Credentials: the ChatGPT Ads Advertiser API key the Merchant enters, the Conversions API key the App creates with it, and the SFTP key for the product feed. They are stored encrypted (AES-256-GCM) and never shown again in the App.
• Ad account information read from OpenAI: account name, currency, time zone, account and campaign status, campaign settings and reported results.
• Product catalog data from Shopify, used to build the product feed: titles, descriptions, images, prices, stock, brand and product identifiers such as GTIN.
• Settings, the email addresses that receive alerts, and support conversations.

From Shoppers, on the Merchant's behalf

The App's code in the store (a theme app embed) and in checkout (a Shopify Web Pixel) records shopping events: page views, product views, add to cart, checkout started and purchases, with product IDs, names, quantities, prices, order value, currency, the page address and the time of the event.

Only when the Shopper has allowed marketing cookies and has not opted out of the sale or sharing of personal information, the App also processes:

• Details used to match conversions: email, phone number, first and last name, and the Shopify customer ID or a visitor ID created by the App. These are normalized and hashed with SHA-256 before they are sent to OpenAI. City, region, postal code and country are sent as they are.
• IP address and browser user agent.
• OpenAI's ad click and browser references (the oppref link parameter and OpenAI's __oppref and __obref cookies) and UTM campaign parameters.
• Cookies the App sets in the store: _avada_chatgpt_eid (visitor ID, 90 days), _avada_chatgpt_oppref (30 days) and _avada_chatgpt_utm (28 days). Cart attributes starting with _avada_cga_ carry the visitor ID, OpenAI's references, UTM values and the Shopper's consent choice onto the order.

Order data comes from Shopify webhooks and the Shopify Admin API: order ID and number, totals, currency, line items, discounts, refunds, cancellations and the order's source. To send a purchase to OpenAI, the App reads the customer's email, phone, name, city, region, postal code, country, IP address and user agent from the order. These details are held only in a short-lived processing queue while the purchase is sent, and are not stored in our database.

With analytics consent alone, the App counts an event for the Merchant's own reports without any of these details and does not send it to OpenAI.

3. How we use information

• To send the store's events and purchases to the Merchant's ChatGPT Ads account (OpenAI's pixel and Conversions API), so the Merchant can measure ad conversions, and to avoid counting a purchase twice.
• To build and update the Merchant's product feed at OpenAI.
• To create and manage campaigns when the Merchant asks. New campaigns are created paused and start only when the Merchant activates them.
• To show reports that compare OpenAI's results with the Merchant's Shopify orders and revenue.
• To send alert emails and, if the Merchant subscribes, a weekly email.
• To run, secure, troubleshoot and support the App.

We do not sell personal information. We do not use Shopper information for our own advertising, and we do not combine it across stores.

4. Consent and choices

• The App follows Shopify's customer privacy settings. OpenAI's pixel loads only after the Shopper allows marketing cookies. The checkout Web Pixel runs only with analytics and marketing consent and without a sale-of-data opt-out.
• When a Shopper opts out of the sale or sharing of personal information, the App does not send their events to OpenAI. When a Shopper withdraws consent, the App tells OpenAI's pixel, which removes its cookies.
• When an order arrives without a consent record (for example, a purchase that skipped the cart), the App withholds it from OpenAI in the EEA, the UK, Switzerland and the US states that require opt-in consent. Elsewhere it sends the purchase.
• Merchants can turn off advanced matching (the hashed customer details) and choose which events and pages are tracked. Merchants are responsible for their cookie banner and for the consent their laws require.

5. Who we share information with

Recipient	What it receives	Why
OpenAI	Store events and purchases with the details in section 2, through the Conversions API and OpenAI's pixel in the Shopper's browser; the product catalog; campaign settings.	They go to the Merchant's own ChatGPT Ads account. OpenAI's privacy policy (opens in a new tab) applies to what OpenAI receives.
Shopify	Store, product and order data comes from Shopify.	The App runs on Shopify. Shopify Privacy Policy (opens in a new tab)
Google Cloud and Firebase	Everything the App stores and processes, in the United States.	Hosting, database, processing queues and logs.
Our email delivery provider	The Merchant's alert email addresses and the email content.	Sending alert and weekly emails. No Shopper information.
Anthropic	One product's title, description, vendor, type and price, when the Merchant asks for a suggestion.	AI suggestions for ad copy and feed titles. No Shopper information.
Crisp	The Merchant's name, email, phone, store name and domain, plan, country, install dates and App setup status.	In-app support chat. No Shopper information.
Microsoft Clarity	How Merchants use the App's admin pages, with the store's domain, when enabled.	Improving the App. No Shopper information is sent on purpose.

We may also disclose information when the law requires it.

6. How long we keep information

• Event records, order records and daily statistics follow the Merchant's Data retention setting: 30, 60 or 90 days (90 by default). Then they are deleted automatically. Order records imported in the background are kept for 120 days when the Merchant has never saved that setting.
• Checkout consent records: 30 days. Email logs: 60 to 90 days. Autopilot action history: 180 days. Rate-limit records that contain an IP address: a few minutes.
• Counts with no personal information may be kept while the App is installed.
• Credentials and settings: until the App is uninstalled.

When a Merchant uninstalls the App, it deletes the stored OpenAI credentials and the App's feed, pixel and campaign data. Store details, order records and statistics are deleted when Shopify sends its shop/redact request, 48 hours after uninstall. A Merchant can ask us at [email protected] to delete the sign-in record the App keeps for them (email and name).

7. Privacy requests

The App handles Shopify's mandatory privacy webhooks (customers/data_request, customers/redact and shop/redact). The records the App keeps for an order contain no name, email, phone number or address, and they are deleted with the retention period above.

Shoppers in regions with privacy rights (for example the GDPR or the CCPA) can ask the store to access or delete their information. The store can contact us at [email protected] for help.

8. Security

• All traffic uses HTTPS. Google Cloud encrypts stored data.
• Credentials are additionally encrypted by the App. Email, phone number and name are hashed before they are sent to OpenAI.
• The database cannot be read from a browser. Shopify webhooks and storefront requests are checked with Shopify's signatures.
• Only staff who operate and support the App can access its systems.

9. International transfers

The App runs on Google Cloud in the United States, and OpenAI processes what it receives under its own terms. Avada's team in Vietnam can access the App's systems to operate and support it. Where the law requires, we rely on appropriate safeguards for these transfers.

10. Children

The App is not directed to children, and we do not knowingly collect their data.

11. Changes

We may update this policy. We will change the date at the top when we do, and tell Merchants in the App about material changes.

12. Contact

Email [email protected], or write to Avada, 102 Tran Phu, Ha Dong, Hanoi, Vietnam.