Skip to content

Privacy policy

Effective November 3, 2026

Who we are

TagGap.com and the TagGap Shopify app ("TagGap") are operated by Wells Software Consulting LLC ("we", "us"). Contact: privacy@taggap.com.

For order data from your Shopify store, the merchant is the controller and we act as a processor (a "service provider" under US state privacy laws), under our Data Processing Addendum. For our own website, account and billing contacts, we are the controller.

What TagGap does

TagGap compares a store's Shopify orders with the purchases its analytics and ad platforms recorded (Google Analytics 4 and Meta today), and explains the differences. It is read-only: it never changes your store, tags, campaigns or ad accounts.

Data we process

From your Shopify store (app installed)

  • Order records: order id and number, created/processed/updated/cancelled times, test flag, financial status, sales channel and source, payment gateway names, currency, totals and refunded amounts, landing page URL, and order note attributes used for attribution (for example click ids such as gclid or fbclid).
  • Store profile: store domain, name, currency and time zone.
  • An access token for your store, issued by Shopify, stored encrypted.

We do not request or store customer names, email addresses, phone numbers, postal addresses or IP addresses. Order notifications from Shopify are reduced to the fields above before they are stored.

From destinations you connect (Google, Meta)

  • Google Analytics 4 (scope analytics.readonly): for the property you select, purchase counts, transaction ids, revenue and dates. No user-level or visitor-level data is requested.
  • Meta (permission ads_read): for the ad account you select, daily purchase counts, purchase value and spend.
  • The access tokens these platforms issue, stored encrypted.

Free scanner and ad link checker on TagGap.com

  • The store or link address you enter, and what that public page loads (tag and pixel ids, consent defaults, redirects).
  • Your email address, only if you ask us to email you a report (with your consent).
  • A keyed hash of your IP address, used only for rate limits and cleared after 24 hours. The IP address itself is never stored.

Alerts and support

The email address you enter in Settings for alerts, and what you send us when you contact support.

How we use it

Only to provide TagGap to you: match orders, score each destination, detect changes, send the alerts and reports you set up, bill through Shopify, keep the service secure, and answer support requests. We do not sell or share personal information, use it for advertising, or combine it across merchants.

Google API data: Limited Use

TagGap's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google Analytics data only to show you how GA4 compares with your Shopify orders; we do not transfer it to others except as needed to provide that feature, to comply with law, or as part of a merger or acquisition; we do not use it for advertising; and no person reads it unless you ask us to for support, it is needed for security or to comply with law.

Retention

  • Order records, platform purchase data and match results: 13 months, then deleted automatically.
  • Order notifications from Shopify (already reduced as above): 14 days.
  • Scans: 180 days. Report emails: 90 days. IP hashes: 24 hours.
  • Daily scores and alerts: while the app is installed.
  • On uninstall, access tokens are deleted and processing stops immediately. Shopify then sends a shop/redact request 48 hours later, and we delete all remaining data for the store. Disconnecting Google or Meta in the app deletes that platform's token.
  • Backups are encrypted and roll over within 30 days, so deleted data leaves backups within 30 days.

Security

Data is encrypted in transit (TLS) and at rest (encrypted disks; access tokens additionally encrypted per record with XChaCha20-Poly1305). The service runs in the United States on dedicated infrastructure with no public inbound ports; access is limited to the operator and logged.

Subprocessors and transfers

We use a small set of providers to run TagGap, listed on our subprocessors page. Data is stored in the United States. For personal data from the EEA, UK or Switzerland, transfers rely on the Standard Contractual Clauses in our DPA.

Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal information, to object to or restrict processing, and to withdraw consent. Merchants can delete all store data by uninstalling the app. Shoppers' requests are handled through the merchant: Shopify forwards them to us (customers/data_request, customers/redact) and we complete them within 30 days. For anything else email privacy@taggap.com; we respond within 30 days. You may also complain to your local data protection authority. See also how to delete your data.

Cookies

TagGap.com sets no advertising or analytics cookies. The scanner uses Cloudflare Turnstile to block abuse, which may set a strictly necessary security cookie. The embedded app uses Shopify session tokens, not cookies.

Children

TagGap is a business tool and is not directed to children under 16.

Changes

We will post changes here and, for material changes, notify installed merchants by email or in the app before they take effect.