Privacy policy.

DataGap is an audit tool. We connect to your e-commerce stack with read-only credentials, look at your schema and recent event volumes, and return a report. We do not sell your data, we do not share customer-level data with any third party, and we only keep the minimum we need to produce the audit.

What we read

When you connect Shopify, Klaviyo, Meta, or GA4, we use read-only scopes to fetch tracking-plan metadata, event counts (last 30 days), product / customer / order schemas, and pixel match quality. We never read message bodies, customer PII beyond what’s already attached to an event, or anything that requires write access.

What we store

Encrypted provider access tokens (AES-256-GCM at rest in our Postgres database). The audit results themselves, keyed to your organization. Your email if you complete the lead-capture step.

We do not store full event payloads. We store derived counts and coverage percentages.

What we share with sub-processors

• Anthropic for natural-language prose generation on each gap. We send the deterministic finding (event name, property names, counts) and the evidence block. We do not send raw customer data.
• Stripe for the $167 unlock payment. Stripe handles all card data; we never see it.
• Neon (Postgres) for storage of audit results.
• Inngest for async audit-run orchestration. Events shipped to Inngest contain the audit id and org id; no customer-level data.

Opt-in benchmarks

The “share anonymized gap data” checkbox on the connect flow is opt-in. When checked, your audit’s gap counts (by reference-model key and severity) feed our aggregated /benchmarks view. Your company name, stack details, customer counts, revenue, and specific values are never included.

Retention

Audit results are kept indefinitely so you can revisit them. Provider tokens are revoked from our side the moment you disconnect a source. You can request full deletion at any time by emailing the address on the contact page.

Last updated: APR 21, 2026. This page is a plain-English summary, not a contract. Email us if you need a formal DPA.