Skip to content
Policy

Compliance

Eturns treats compliance as an operational substrate, not a marketing checkbox. This page summarizes our posture across GDPR, CCPA, the Indian DPDP Act, and the Shopify App Store privacy requirements.

Last updated · version 1.3

GDPR (European Union & UK)

Eturns acts as a data processor on behalf of the installing merchant. The merchant is the controller of their store’s customer data. We process personal data only for the after-sales purposes the merchant configured Eturns to handle.

  • Mandatory GDPR webhooks (customers/data_request, customers/redact, shop/redact) are implemented with HMAC verification and idempotency.
  • Right to erasure is satisfied via the customers/redact webhook cascading through return requests, tickets, embeddings, and photo storage within 48 hours.
  • Article 22 (automated decision-making): a customer can ask a person to review any automatic decline from the request’s status page; the store reviews it and makes the final call. Every agent decision also has a merchant override path, and the decision trail records both.
  • AI disclosure is present on every AI-generated customer email and on the DSR portal.
  • Personal data we persist is stored in Singapore (AWS ap-southeast-1), and the application and queue also run in Singapore. Singapore is not currently covered by a general European Commission adequacy decision; see section 5 of the Privacy Policy and the Data Processing Agreement at /policy/dpa for the transfer disclosure.

CCPA (California)

California residents have the right to know, access, delete, correct, opt out of certain sales or sharing, and not be discriminated against for exercising privacy rights. We do not sell personal information for money. Where required, we honor Global Privacy Control signals.

DPDP Act (India)

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the installing merchant acts as the Data Fiduciary for their store’s customer data and Eturns acts as a Data Processor on the merchant’s instructions (and as a Data Fiduciary solely for our own merchant account and direct inquiry records). A Grievance Officer is available per the DPDP Act; see /policy/india-grievance.

Shopify App Store privacy (PCD)

Our Protected Customer Data (PCD) questionnaire answers are filed in Shopify Partners and mirrored in our internal compliance binder. In summary:

  • We access order, customer, and product data via the Shopify Admin API to resolve after-sales cases.
  • We do not sell merchant or customer data.
  • Customer PII is minimized in our database; emails are sha256-hashed for audit, and narrow operational session/reply fields are encrypted at rest with AES-256-GCM.
  • Order contact fields never enter language-model prompts; structured case facts use sentinel IDs and free-text messages pass through automated PII redaction.
  • All model traffic goes through the Vercel AI Gateway. Subprocessors are disclosed at /policy/subprocessors.
  • Mandatory GDPR webhooks are implemented with HMAC + idempotency; bodies are dropped immediately on success, in-flight or failed bodies are encrypted at rest with AES-256-GCM, and terminal rows expire after 30 days.

EU AI Act transparency

AI involvement is disclosed on every AI-generated customer email and on every AI-mediated customer surface. The disclosure is never removed by white-labeling; merchants can adjust the wording but cannot remove it.

Tax compliance

Shopify Billing handles sales tax for US merchants and VAT for EU merchants. For Indian merchants we register for GST and issue compliant invoices in INR with the CGST/SGST or IGST breakdown, unless the merchant opts for the reverse-charge mechanism. See /pricing for tier details.

Questions about this policy? Write to us at contact@eturns.app, and a person on our team will reply.