01About this policy
This Privacy Policy explains how ReturnBay (“ReturnBay”, “we”, “us”) collects, uses, shares and protects personal information when you use the ReturnBay Shopify app, the customer returns portal it powers, and our websites (together, the “Services”).
ReturnBay helps Shopify merchants run returns and exchanges. Merchants install the app in their Shopify admin; their customers start returns through a portal on the merchant's own storefront.
Who this policy covers
- Merchants: Shopify store owners and their staff who install and configure ReturnBay.
- Customers: shoppers who request a return or exchange from a store that uses ReturnBay.
- Visitors: people who browse our websites.
Our role
- For merchant account and store information, ReturnBay is the controller.
- For customer information we process on a merchant's behalf, the merchant is the controller and ReturnBay is the processor. We use that information only to provide the Services to that merchant and as the merchant instructs. Customers should read the merchant's own privacy policy, and may send privacy requests to the merchant directly; we will help the merchant respond.
02Information we collect
We collect only the information needed to process returns and exchanges. We never receive Shopify login credentials or card numbers.
From merchants
| Category | Examples | Source |
|---|---|---|
| Store information | Store name, domain, Shopify store ID, owner and contact email, country, city, timezone, currency, Shopify plan | Shopify, on install and each sign-in |
| Settings and content | Return policies, return reasons, notification and reply-to email addresses, sender name, email templates, return addresses and phone numbers, refund and shipping options | Entered by the merchant |
| Integration credentials | API keys for shipping carriers the merchant connects (such as Shippo or EasyPost), stored encrypted | Entered by the merchant |
| Shopify access token | The token Shopify issues so the app can act on the store | Shopify |
| Uploaded files | Return shipping labels (PDF, PNG or JPEG, up to 2 MB) | Uploaded by the merchant |
| Usage information | Install and uninstall dates, request logs including IP address, timestamps and pages requested | Collected automatically |
About customers, on behalf of merchants
| Category | Examples | Source |
|---|---|---|
| Order verification | Order number, plus the order email, phone number or shipping postal code entered to look up the order | Entered by the customer, checked against Shopify |
| Contact and identity | Name, email address, phone number, Shopify customer ID | Shopify order record |
| Address | Shipping address of the order | Shopify order record |
| Order and payment details | Products, prices, quantities, order tags, and payment transaction records (payment method type, status, amount) | Shopify order record |
| Return details | Items selected, reason for each item, refund or exchange choice, exchange products, shipping method | Entered by the customer |
| Bank refund details | Where the merchant offers bank refunds: account holder name, IBAN, bank branch name and address, and optional comments | Entered by the customer |
| Refund and fulfilment records | Refund amounts and method, gift card codes and store credit issued, draft orders, shipping label and tracking number | Created by the Services |
We do not ask customers to create an account, upload photos or provide payment card details.
From website visitors
When you visit our websites we receive standard technical information such as IP address, browser type and pages visited, as part of normal server logging.
03How we use information
We use personal information only to run the Services. We do not sell it, use it for advertising, or use one merchant's data for another merchant.
| Purpose | What it involves | Legal basis (GDPR) |
|---|---|---|
| Provide the returns portal | Verify the customer's order, show eligible items, record return and exchange requests | Contract with the merchant; merchant's instructions |
| Process refunds and exchanges | Issue refunds to the original payment method, gift cards or store credit; create exchange orders; record bank refund details for the merchant to pay out | Contract with the merchant; merchant's instructions |
| Shipping | Generate return labels through the merchant's connected carrier account, or deliver labels the merchant uploads, and track return shipments | Contract with the merchant; merchant's instructions |
| Notifications | Send customers return status emails (submitted, approved, declined, received, refunded, label ready and similar), and send merchants new-return alerts | Contract with the merchant; merchant's instructions |
| Update the merchant's Shopify store | Where the merchant enables it, add return notes and tags to orders | Merchant's instructions |
| Merchant account and support | Set up the store, apply settings, answer support requests | Contract with the merchant |
| Security and reliability | Verify Shopify request signatures, prevent abuse and fraud, diagnose errors | Legitimate interests; legal obligations |
| Legal compliance | Respond to lawful requests and Shopify privacy requests | Legal obligations |
We do not use personal information to train artificial intelligence or machine learning models. We do not make decisions with legal or similarly significant effects based solely on automated processing; return eligibility rules are set by the merchant.
05Data retention and deletion
We keep return records for as long as the merchant uses ReturnBay, and delete all of a store's data after the merchant uninstalls the app.
| Data | How long we keep it |
|---|---|
| Unfinished return sessions (items selected, bank details entered before submitting) | Deleted automatically 3 days after the session expires |
| Submitted returns, refunds, exchanges and labels | While the app is installed, so the merchant can manage returns and keep records, unless deleted earlier on request |
| Shopify access token | Deleted when the app is uninstalled |
| All store data, customer data and uploaded files | Permanently deleted when Shopify sends its store deletion request, 48 hours after uninstall |
| Server logs | A limited period set by our hosting provider |
Uninstalling. When a merchant uninstalls ReturnBay, we stop accessing the store immediately and delete its access token. Remaining data is kept for 48 hours so a reinstall can pick up where it left off, then permanently deleted, including files in storage.
Customer deletion requests. When Shopify forwards a customer's request to erase their data, we remove that customer's name, email, phone number, street address, bank details and gift card codes from their returns, and delete their shipping labels and unfinished return sessions. We keep the non-identifying record of the return (items, amounts, order reference) so the merchant's accounting stays accurate.
Customer access requests. When Shopify forwards a customer's request for their data, we send the data we hold about that customer to the merchant, who provides it to the customer.
Information that ReturnBay writes into the merchant's Shopify store, such as refunds, gift cards, store credit, order notes and tags, stays in Shopify under the merchant's control after uninstall.
06Security, transfers and cookies
Security
We protect information with technical and organisational measures appropriate to its sensitivity, including:
- encryption of all data in transit (HTTPS/TLS);
- verification of Shopify's signature on every portal request and webhook;
- separation of each store's data, so one merchant can never see another's;
- encryption of carrier API keys with AES-256;
- private file storage, reachable only through links that expire after one hour;
- logs that exclude customer contact details, bank details and access tokens.
No system is perfectly secure. If we become aware of a breach affecting personal information, we will notify affected merchants and authorities as the law requires.
International transfers
ReturnBay is hosted in the United States. If you are outside the United States, your information will be transferred to and processed there. Where the law requires, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Cookies and browser storage
The ReturnBay app and returns portal do not use advertising or analytics cookies, and we do not use third-party tracking.
The returns portal stores a small amount of information in the customer's browser (local and session storage) so a return can continue if the page reloads: the return session reference, the store's portal settings, the order looked up and the items selected. Bank details are never stored in the browser. This storage is strictly necessary for the portal to work, and the customer can clear it at any time through their browser settings.
The merchant's storefront and Shopify itself may set their own cookies, which are covered by the merchant's and Shopify's privacy policies.
07Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing;
- receive your information in a portable format;
- withdraw consent where processing relies on it;
- complain to your local data protection authority.
Customers should send requests to the store they bought from, since the merchant controls their return data. Customers can also ask Shopify to forward a data request, which reaches us automatically. If you contact us directly, we will pass your request to the merchant and help them respond.
Merchants can contact us using the details below. Uninstalling the app deletes your store's data as described in section 5.
California residents. Under the CCPA/CPRA you have the right to know, delete and correct your personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
We respond to requests within 30 days, or sooner where the law requires, and may need to verify your identity first.
08Children
The Services are not directed at children under 16, and we do not knowingly collect their personal information. If we learn that we have, we will delete it.
09Changes to this policy
We may update this policy as the Services change. We will post the new version here with a new “Last updated” date, and notify merchants by email or in the app before material changes take effect.
10Contact us
For questions or privacy requests, email support@returnbay.io.
Email support@returnbay.io. We reply within two business days.