Privacy Policy: Returns Flow for Shopify

Returns Flow for Shopify is a Shopify app for booking customer returns in the warehouse: scan the order, scan the returned items, choose a reason, and Returns Flow restocks the units and issues the refund in Shopify. It is operated by Smartcode Ltd, a company registered in the United Kingdom. Questions about this policy: .

Who is responsible

For data about a merchant's store, orders and customers, the merchant is the data controller and Smartcode Ltd processes it on the merchant's behalf. For the merchant's own account details (store name and contact email), Smartcode Ltd is the controller.

What the app reads from Shopify

With the merchant's permission, granted at install, Returns Flow reads through Shopify's Admin API:

• orders: order number, line items (title, SKU, quantity, price), fulfilments and status
• returns, refunds and payment transactions on those orders
• products, store locations and return reasons
• the customer's name and shipping address, shown on the order screen so staff can check they have the right parcel.

Returns Flow does not read customer email addresses or phone numbers.

What we store

• The store's Shopify domain, store name and contact email.
• Access tokens that let the app call Shopify for the store.
• The store's Returns Flow settings.
• A record of each return booked: order number, return number, unit counts, restock location, refund amount and currency, status and timestamps.

We do not store customer names, addresses or any other customer personal data. The customer's name and address are fetched from Shopify when an order is opened, shown on screen, and not saved or written to logs.

Why we use it

Only to provide the app: finding orders, booking returns, restocking and refunding in Shopify, plus support, troubleshooting and keeping the service secure. We do not use store or customer data for advertising or profiling, and we do not sell or rent it.

Who we share it with

• Shopify, which holds the source data the app reads and writes.
• DigitalOcean, which hosts the app and its databases in London, United Kingdom.
• Better Stack, which receives application logs. Logs contain store identifiers and order numbers, not customer personal data.

We share data with nobody else unless the law requires it.

How long we keep it

• Access tokens are deleted when the app is uninstalled.
• All data for a store, including return records, is deleted when Shopify sends its shop deletion request, 48 hours after uninstall.
• Application logs are kept for a limited period and then deleted automatically.
• Customer personal data is never retained.

Security

All connections are encrypted with TLS: between the merchant's browser, the app, Shopify and our databases. Databases and backups are encrypted at rest. Only Smartcode staff who need access to run and support the service have it.

Customer privacy requests

Returns Flow handles Shopify's customer data request and customer deletion request. Because the app stores no customer personal data, there is nothing for it to return or delete. Customers should contact the store they bought from about their data.

Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of personal data we hold about you, and you can object to how it is used. Email . You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy, the date at the top changes too. Significant changes are emailed to the store's contact address.