Privacy Policy

Last updated: July 17, 2026

This Privacy Policy explains how ReturnFlow ("ReturnFlow", "we", "us", or "our") — the returns and exchange application for Shopify (the "Application") — collects, uses, shares, and protects information when a merchant installs and uses the Application on their Shopify store, and when that store's customers use the returns experience we provide. By installing or using the Application, you agree to the practices described in this Policy.

ReturnFlow processes personal data on behalf of the merchant. The merchant operating the Shopify store is the data controller of its customers' personal data; ReturnFlow acts as a data processor and processes that data only to provide the returns and exchange services described below.

Information We Collect

Merchant and store information. When you install ReturnFlow, we access and store information about your Shopify store, including your store name and domain, store owner and contact details, currency and locale, locations and shipping settings, plan and billing status, and the API access token needed to call the Shopify API on your behalf.

Order and customer information. To process returns and exchanges, we access and store data from your store, including orders and line items, products and variants, fulfillment and shipping details, and customer information such as name, email address, phone number, and shipping/billing address associated with orders that are eligible for return.

Return request information. When a customer submits a return or exchange, we collect the order identifier, the items selected, the return reason, the requested resolution (refund to original payment, store credit, or exchange), any comments, and any images the customer uploads to support the request.

Usage information. We automatically collect limited technical data — such as IP address, browser type, and pages accessed within the Application — to operate, secure, and improve the service.

How We Collect Information

• Through the Shopify Admin API, using the permissions you grant when you install the Application.
• Through the storefront returns page and app proxy, when a customer looks up an order and submits a return or exchange.
• Through Shopify webhooks (for example, order, product, and customer updates, and app uninstall).

How We Use Information

• To provide the core service: look up orders, create and manage return and exchange requests, and process refunds, store credit, and exchange (draft) orders.
• To generate return shipping labels and packing slips, and to route returns to the correct location.
• To send return-related notifications to customers and store staff.
• To display analytics and reporting to the merchant.
• To operate billing, provide support, maintain security, and improve the Application.

How We Share Information

We do not sell your personal information or that of your customers. We share information only as needed to provide the service:

• Shopify: to read and write orders, returns, refunds, draft orders, products, customers, store credit, and billing on your store.
• Service providers / subprocessors: hosting, database, and shipping-carrier providers used to run the Application and generate return labels, acting on our instructions.
• Legal reasons: when required to comply with applicable law, or to protect the rights, property, or safety of ReturnFlow, our merchants, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Data Retention and Deletion

We retain personal data only as long as necessary to provide the service or as required by law. ReturnFlow supports Shopify's mandatory privacy (GDPR) webhooks:

• customers/data_request: we provide the customer data we hold when a store customer requests it.
• customers/redact: we delete a customer's personal data on request.
• shop/redact: we delete the store's data 48 hours after the Application is uninstalled.

When you uninstall the Application, we stop accessing your store's data and delete or anonymize stored personal data in accordance with the above.

Data Security

We use industry-standard technical and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on your location, you or your customers may have rights to access, correct, delete, or restrict the processing of personal data. Store customers should direct such requests to the merchant (the data controller); merchants may contact us to help fulfil them.

Children

The Application is not directed to children under the age of 13, and we do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. Your continued use of the Application after changes take effect constitutes acceptance of the revised Policy.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, contact us at support@return-flow.tlxapps.com. We will make every effort to resolve your concerns.