1. Overview
GoUltra: WhatsApp Marketing ("the App", "we", "us") is a Shopify application that lets a merchant message their customers on WhatsApp: order, payment, shipping, cancellation and refund notifications; abandoned-checkout reminders; marketing campaigns and automated welcome, review-request and win-back messages to customers who opted in; new-order alerts to the store owner; and a two-way inbox for customer replies. The App also provides a hosted opt-in page where customers can subscribe to or unsubscribe from WhatsApp marketing. The App is operated by GoUltra (goultra.ai) and runs inside the Shopify admin.
When a merchant installs the App, the merchant is the data controller for their customers' data and GoUltra acts as a processor on the merchant's behalf. This policy explains what personal data the App processes, why, on what lawful basis, who our sub-processors are, how long data is kept, and how data-subject requests are handled.
GoUltra is an independent service and is not affiliated with, endorsed by, or operated by Meta. WhatsApp is a trademark of Meta Platforms, Inc. Messages are delivered through the WhatsApp Cloud API from Meta.
2. Data we process and why
The App receives store events from Shopify through HMAC-verified webhooks and reads what it needs through Shopify's GraphQL Admin API. It processes:
| Data | Purpose |
|---|---|
| Customer name | Personalize messages (for example the greeting) and show who a conversation is with. |
| Phone number | The WhatsApp delivery target. Without it no message can be sent. |
| Email address and Shopify customer ID | Link a WhatsApp marketing consent record to the right Shopify customer, and find a customer's records when they ask for their data or for erasure. |
| Order details (order number, total, currency, items, status page link, tracking link) | Build the notification the merchant enabled. Order details are passed on to deliver the message and are not stored by the App beyond a short activity-log line. |
| Abandoned-checkout contact (first name, phone, checkout total, currency, checkout link) | Send the reminders the merchant enabled. Stored only for customers who opted in to WhatsApp marketing (see Section 4). |
| WhatsApp marketing consent records (phone, state, source, exact consent text shown, timestamp, a one-way hash of the IP address, never the raw IP) | Decide who may receive marketing messages and prove that consent was given, as consent laws require. |
| Automation records (phone, first name, order reference, dates) | Time the review-request and win-back messages the merchant enabled. |
| Inbox conversations (message text and media exchanged with the store) | Let the merchant read and answer customer replies. Held by GoUltra's messaging service (Section 5). |
| Campaign records and header images the merchant uploads | Send the campaign, show its progress, and serve the image to WhatsApp as the message header. |
| Activity log (event type, short summary with only the last 4 digits of a phone number, timestamp, success flag, recovered revenue) | Power the in-app Analytics and Logs screens and the plan usage count. |
| Shop record (myshopify domain, store name, Shopify access tokens, App settings) | Operate the App for the store: authenticate calls, route events, store configuration. |
We do not sell personal data, we do not use it for advertising, and we do not build
cross-merchant profiles. The App requests only the Shopify access it needs:
read_orders (order notifications and abandoned checkouts),
read_customers (customer name, phone and WhatsApp marketing consent),
read_products (a product image for the order-confirmation header and the
campaign product picker), write_discounts (single-use discount codes for the last
abandoned-checkout reminder) and write_customers, which is used for exactly one
operation: keeping the customer's WhatsApp marketing consent in Shopify in step with the
consent the customer gave or withdrew in the App. The App never edits any other customer field.
3. Lawful basis for processing
- Transactional messages (order, payment, shipping, cancellation and refund notifications). Performance of the contract between the merchant and the customer, and the legitimate interest in accurate order and delivery information.
- Marketing messages (abandoned-checkout reminders, campaigns, welcome, review-request and win-back messages). Only the customer's explicit consent to receive WhatsApp marketing from that store. Consent given for email or SMS marketing is never treated as WhatsApp consent.
- Operating the App (settings, authentication, logs, security). The legitimate interest in providing and securing the service the merchant installed.
4. WhatsApp marketing consent
The App keeps a consent register per store. A customer is added as subscribed only when they explicitly opt in to WhatsApp marketing from that store, in one of two ways:
- on the store's hosted opt-in page, where the customer types their number and taps a button that states they agree to receive WhatsApp marketing messages; or
- through Shopify's own WhatsApp marketing consent (for example the WhatsApp marketing checkbox at checkout or on a Shopify form), which Shopify reports to the App.
For every consent change the App stores the phone number, the action, the source, the exact consent text shown and a timestamp, as proof of consent. The current state is kept in step with the customer's WhatsApp marketing consent in Shopify. Consent is checked again immediately before every marketing message, including each abandoned-checkout reminder. An unsubscribe always wins: it applies to every format of the same phone number, and no marketing message is sent to that number afterwards. Customers can unsubscribe at any time on the same opt-in page, by replying to a message, or by asking the store. Order and shipping notifications are separate and are not affected by marketing consent.
5. Sub-processors
We share data with the following sub-processors strictly to operate the service:
| Sub-processor | Role |
|---|---|
| Cloudflare, Inc. | Application hosting (Cloudflare Workers) and the App's database (Cloudflare D1): settings, consent records, abandoned-checkout and automation records, campaign records, the activity log and data-request files. |
| GoUltra messaging service (goultra.ai) | Message orchestration: WhatsApp template management, building and queuing messages, delivery status, and storage of inbox conversations. |
| Meta Platforms, Inc. (WhatsApp Cloud API) | Delivery of the WhatsApp messages and receipt of customer replies. |
Shopify, Inc. is the platform the merchant uses and the source of the store events; the merchant's relationship with Shopify is governed by Shopify's own terms and privacy policy.
6. Data retention and deletion
| Data | Kept for |
|---|---|
| Abandoned-checkout contact data | Deleted 7 days after the checkout, whether or not it was recovered. |
| Review-request records | Deleted 30 days after the request is sent, and in any case after 100 days. |
| Win-back records | Deleted once the customer's last order is more than 180 days old. |
| Campaign header images | Deleted after 60 days. |
| Customer data-request files | Deleted after 90 days. |
| Duplicate-prevention records (no personal data) | Deleted after 120 days. |
| Consent register and proof of consent | Kept while the store uses the App, because the merchant must be able to prove consent; erased on a customer's erasure request and when the store's data is deleted. |
| Activity log, settings and shop record | Kept while the store uses the App; deleted with the store's data. |
- On uninstall. The store's Shopify access tokens are cleared and all sending stops immediately, including scheduled reminders and automations.
-
On
shop/redact. When Shopify sends the store-deletion request (about 48 hours after uninstall), the App deletes everything it holds for that store. If the store reinstalled the App within that window, its data is kept, because it is in use again.
We do not keep backups of customer personal data beyond Cloudflare's standard infrastructure-level durability for the live database.
7. Data-subject rights and Shopify compliance webhooks
Customers have the right to access, rectify, erase, restrict and object to the processing of their personal data, and the right to data portability, as provided by the GDPR and comparable laws. Because the merchant is the controller, requests are normally made to the merchant. The App implements Shopify's mandatory compliance webhooks, each verified by HMAC:
-
customers/data_request: the App collects every record it holds about the customer (consent records and proof, abandoned-checkout and automation records) into a file that the merchant downloads in the App, under Logs, to send to the customer. -
customers/redact: the App erases the customer's records everywhere it holds them, matched by phone number (in any format), email address and Shopify customer ID, including any data-request file made for them, and asks GoUltra's messaging service to erase the customer's conversation history. -
shop/redact: the App erases all data it holds for the store.
Erasure requests are completed within 30 days. To exercise a right directly, or if a merchant needs help responding to a request, contact info@goultra.ai.
8. Security
- All data is encrypted in transit using TLS, and data in Cloudflare D1 is encrypted at rest.
- Inbound Shopify webhooks are verified with an HMAC signature; an invalid signature is rejected.
- The embedded admin is protected by Shopify session tokens, and it can only be displayed inside the store's own Shopify admin.
- The App's credential for the messaging service is created and kept on the server; it is never shown to merchants or sent to the browser.
- The opt-in page is rate-limited and stores only a one-way hash of the visitor's IP address.
9. International data transfers
Our sub-processors (Cloudflare, the GoUltra messaging service and Meta) operate global infrastructure, so personal data may be processed in countries other than the customer's own, including the United States. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent recognized transfer mechanism offered by the relevant provider.
10. Children
The App is intended for use by merchants and their adult customers. It is not directed at children, and we do not knowingly process the personal data of children.
11. Changes to this policy
We may update this policy as the App or applicable law changes. Material changes are reflected by updating the "Last updated" date above.
12. Contact
For any privacy question or to exercise a data-subject right, contact us at info@goultra.ai.