Privacy policy

Last updated: April 5, 2026

the MA walls ("we," "us," or "our"), operated by ULTRO Inc., operates the website themawalls.com and the associated online store (the "Site"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit or make a purchase from our Site.

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and Japan's Act on the Protection of Personal Information (APPI).

Data Controller

ULTRO Inc. (the MA walls)
Miyamasuzaka Building 609, 2-19-15 Shibuya, Shibuya-ku, Tokyo, Japan
Email: hello@themawalls.com

Personal Information We Collect

Information You Provide Directly

  • Order information: Name, email address, shipping address, billing address, phone number, payment information (processed securely by Shopify Payments / PayPal — we do not store your full credit card details)
  • Account information: Email address and name if you create an account
  • Communications: Information you provide when contacting us via email or contact forms
  • Marketing preferences: Email address and consent status when you subscribe to our newsletter via Klaviyo

Information Collected Automatically

When you visit our Site, we and our third-party partners automatically collect certain information using cookies, pixels, and similar tracking technologies:

  • Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, language preference
  • Usage data: Pages visited, time spent on pages, click patterns, scroll depth, referring URLs, exit pages
  • Location data: Approximate geographic location derived from your IP address

Third-Party Services and Tracking Technologies

We use the following third-party services that may collect information about your activity on our Site:

Service Provider Purpose Data Collected
Google Analytics 4 (GA4) Google LLC Website analytics and audience insights Page views, events, conversions, device/browser data, approximate location
Google Tag Manager (GTM) Google LLC Tag management and deployment Manages deployment of other tracking scripts
Google Ads Google LLC Advertising, remarketing, conversion tracking Ad interactions, conversion events, audience segments
Meta Pixel (Facebook/Instagram) Meta Platforms, Inc. Advertising, remarketing, conversion tracking Page views, purchases, add-to-cart events, ad interactions
Pinterest Tag Pinterest, Inc. Advertising and conversion tracking Page views, conversions, audience data
X (Twitter) Pixel X Corp. Advertising and conversion tracking Page views, conversions, audience data
Criteo Criteo SA Retargeting and display advertising Browsing behavior, product views, purchase events
Microsoft Clarity Microsoft Corporation User behavior analytics (heatmaps, session recordings) Click patterns, scroll behavior, mouse movements, session recordings
Klaviyo Klaviyo, Inc. Email marketing and automation Email address, purchase history, browsing behavior, email engagement
Shopify Shopify Inc. E-commerce platform, payment processing, order fulfillment Order data, payment data, customer data

How We Use Your Personal Information

  • Order fulfillment: Processing, shipping, and delivering your orders through our print-on-demand partner (Printful, Inc.)
  • Customer service: Responding to inquiries, resolving issues, providing support
  • Marketing communications: Sending promotional emails, newsletters, and product updates (with your consent)
  • Advertising: Delivering targeted advertisements on third-party platforms based on your interests and browsing behavior
  • Analytics: Understanding how visitors use our Site to improve products, services, and user experience
  • Security and fraud prevention: Detecting and preventing fraudulent transactions
  • Legal compliance: Meeting our obligations under applicable laws and regulations

Legal Basis for Processing (EEA/UK Visitors)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal information based on the following legal grounds under the GDPR:

  • Performance of a contract (Art. 6(1)(b)): Processing necessary to fulfill your order — e.g., shipping address, payment processing, order communication
  • Consent (Art. 6(1)(a)): Marketing emails via Klaviyo, non-essential cookies and tracking technologies (Google Ads remarketing, Meta Pixel, Criteo retargeting, Pinterest Tag, X Pixel, Microsoft Clarity session recordings). You may withdraw consent at any time.
  • Legitimate interests (Art. 6(1)(f)): Website analytics (GA4 with anonymized IP), fraud prevention, improving our services. We balance our interests against your rights and freedoms.
  • Legal obligation (Art. 6(1)(c)): Tax records, compliance with consumer protection laws (including EU GPSR)

Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to provide, protect, and improve our services.

Types of Cookies We Use

  • Strictly necessary cookies: Required for the Site to function (shopping cart, checkout, security). These cannot be disabled.
  • Analytics cookies: Help us understand how visitors use our Site (GA4, Clarity). Set only with your consent in the EEA/UK.
  • Marketing/advertising cookies: Used to deliver relevant ads and measure campaign effectiveness (Google Ads, Meta Pixel, Criteo, Pinterest, X). Set only with your consent in the EEA/UK.
  • Functional cookies: Remember your preferences (language, currency). Set only with your consent in the EEA/UK.

You can manage your cookie preferences through our cookie consent banner. You may also configure your browser to refuse cookies, though this may limit Site functionality.

How We Share Your Personal Information

  • Fulfillment partner: Printful, Inc. (Riga, Latvia / USA) — receives your name, shipping address, and order details to produce and ship your products
  • Payment processors: Shopify Payments (Stripe), PayPal — process your payment securely
  • Advertising partners: Google, Meta, Pinterest, X, Criteo — receive pseudonymized data via pixels/tags for ad targeting and measurement
  • Analytics providers: Google (GA4), Microsoft (Clarity) — receive anonymized/pseudonymized usage data
  • Email marketing: Klaviyo — receives email address and purchase data for marketing automation
  • Hosting: Shopify Inc. — hosts our Site and stores customer/order data

We do not sell your personal information to third parties for monetary consideration. See the "Your Rights" section for details on "sale" under CCPA.

International Data Transfers

Your personal information may be transferred to and processed in countries outside your jurisdiction, including the United States, Canada, and Latvia, where our service providers operate. When we transfer personal data outside the EEA/UK, we rely on:

  • European Commission adequacy decisions
  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • The service provider's compliance with applicable data protection frameworks

Data Retention

  • Order data: Retained for the duration required by tax and accounting laws (typically 7 years)
  • Marketing data: Until you unsubscribe or withdraw consent
  • Analytics data: GA4 retains data for 14 months by default; Clarity retains session data for 30 days
  • Cookie data: Varies by cookie type and provider

Your Rights

All Customers

  • Unsubscribe from marketing emails at any time via the link in each email
  • Request information about what personal data we hold about you

EEA and UK Residents (GDPR / UK GDPR)

  • Right of access (Art. 15): Obtain a copy of your personal data
  • Right to rectification (Art. 16): Correct inaccurate or incomplete personal data
  • Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
  • Right to restrict processing (Art. 18): Limit how we use your data
  • Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
  • Right to object (Art. 21): Object to processing based on legitimate interests, including profiling for direct marketing
  • Right to withdraw consent (Art. 7): Withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal
  • Right related to automated decision-making (Art. 22): We do not engage in solely automated decision-making that produces legal effects. Our advertising platforms use automated profiling for ad targeting, which you can opt out of via cookie consent settings.

To exercise these rights, contact us using the details in the "Contact" section. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

California Residents (CCPA/CPRA)

  • Right to know: What personal information we collect, use, and disclose
  • Right to delete: Request deletion of personal information we hold
  • Right to correct: Request correction of inaccurate personal information
  • Right to opt out of "sale" or "sharing": Sharing personal information with advertising partners for cross-context behavioral advertising may be considered a "sale" or "sharing" under CCPA. You may opt out via our cookie consent banner or by contacting us.
  • Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

In the preceding 12 months, we may have "shared" identifiers, internet activity, and commercial information with advertising partners (Google, Meta, Criteo, Pinterest, X) for targeted advertising purposes.

To exercise your rights, contact us at the email below or use our Your Privacy Choices page.

Japanese Residents (APPI)

If you are a resident of Japan, you have the right to request disclosure, correction, or deletion of your personal information, and to request cessation of its use or provision to third parties where required by the Act on the Protection of Personal Information.

Children's Privacy

Our Site is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

Security

We implement reasonable technical and organizational measures to protect your personal information, including SSL/TLS encryption, secure payment processing, and access controls. However, no method of transmission over the Internet is 100% secure.

Do Not Track

Some browsers have a "Do Not Track" (DNT) feature. We currently do not respond to DNT signals, as there is no industry standard for compliance. However, you can manage tracking via our cookie consent settings.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

Contact

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal information, please contact us:

the MA walls (operated by ULTRO Inc.)
Miyamasuzaka Building 609, 2-19-15 Shibuya, Shibuya-ku, Tokyo, Japan
Email: hello@themawalls.com

For EU/EEA residents: You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not adequately addressed your concerns.