Privacy Policy

Last updated: September 18, 2026

Eturns Inc. ("Eturns," "we," "us," or "our") makes Eturns, the AI after-sales operator for Shopify. Eturns resolves returns, exchanges, refunds, warranty claims, tracking questions, support tickets, reviews, fraud checks, and recovery offers on behalf of Shopify merchants, within the policies each merchant configures.

Privacy matters for an AI agent that takes decisions on a merchant's behalf. This policy explains what we collect at install, what stays in your Shopify store, what can leave when you use a feature, how cookies and sessions work, and how to ask for your data.

1. What we process and why

Eturns acts as a data processor on behalf of the installing merchant (the controller of their store's customer data). We access order, customer, and product data through the Shopify Admin API solely to resolve after-sales cases the merchant has configured Eturns to handle. We do not sell merchant or customer data. Customer PII in our database is minimized — emails are sha256-hashed where persisted for audit. We never send raw PII to the language models that power the agent; case facts use sentinel IDs and structured fields only.

2. Categories of data we process

Category	What it includes	Where it is processed
Merchant install data	Shop domain, country, currency, installed plan, and the merchant constitution — return window, confidence threshold, brand voice, dollar caps, and overrides.	Supabase (Mumbai, India)
Store data	Order, customer, product, fulfillment, and return records read via the Shopify Admin API to resolve after-sales cases.	Supabase — AWS ap-south-1 (Mumbai, India) — under RLS per shop
Decision audit trail	For every AI decision: the model used, the prompt hash, the retrieved context summary, every tool call, the action taken, the dollar amount affected, and the reasoning trace. Retained 7 years.	Supabase (Mumbai, India)
Photo evidence	Customer-uploaded photos for return and warranty claims. Stored in a private bucket with short-TTL signed URLs. 30 days on declined claims; retained on approved claims.	Supabase Storage (Mumbai, India)
Customer emails	Recipient email for transactional sends via Resend. Persisted record is sha256(email); the plaintext is held only for the single send call.	Resend (send only) + Supabase (hash, Mumbai, India)
Webhook payloads	Shopify webhook payloads are HMAC-verified, deduplicated, and encrypted at rest when a payload key is configured. 90-day TTL.	Supabase (Mumbai, India)
Billing	Stripe customer/subscription IDs, plan, billing period, credit balances. Processed via Shopify Billing API.	Shopify + Supabase (Mumbai, India)
Product analytics	Anonymous analytics ID, product events, page route, error summaries, feature flags. PostHog scrubs email/name/phone/body/address before send.	PostHog US Cloud
Errors	Stack traces and scrubbed extras for error monitoring.	Sentry US
Cost counters	Per-shop AI-cost counters and session IDs. No PII — derived totals only. 36-hour TTL.	Render Redis (Singapore)

3. AI and automated processing

Every AI decision in Eturns is bounded by merchant policy, confidence thresholds, dollar-amount thresholds, fraud checks, and an audit trail. Above a per-merchant configured dollar amount (default $200), no autonomous action executes without merchant approval. All model traffic flows through the Vercel AI Gateway. The model-visible context for any decision can include case facts (sentinel IDs and structured fields — never raw email, name, or address), retrieved policy text, and tool results. We configure third-party model providers with zero-data-retention, no-training, or equivalent settings where the provider supports it. We do not train public models on merchant or customer data. Merchant overrides calibrate future decisions for that merchant only.

4. Subprocessors

We disclose our subprocessors publicly at /policy/subprocessors. The current list includes Vercel AI Gateway (and the model vendors it routes to), Supabase, Render, Resend, Sentry, PostHog, and Shopify.

5. Where your data is stored, and international transfers

Personal data that Eturns persists — store data, the decision audit trail, photo evidence, webhook payloads, and hashed email records — rests in a single Supabase project hosted on AWS ap-south-1 in Mumbai, India. The application, its background worker, and its Redis cache run in Render's Singapore region; the Redis tier holds derived counters and session IDs, not personal data. Because our storage region is India and our compute region is Singapore, personal data of merchants and customers located in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those areas when you use Eturns. India is not currently the subject of a European Commission adequacy decision. The terms governing these transfers are set out in our Data Processing Agreement at /policy/dpa and in each subprocessor's own data processing agreement, listed at /policy/subprocessors. Our other subprocessors process data outside India as well: Sentry and PostHog process telemetry in the United States, Resend delivers email from its global infrastructure, and the Vercel AI Gateway routes model traffic to provider infrastructure that is not region-pinned. The data sent to those services is scrubbed of personal data as described in section 2 and section 3.

6. Cookies, sessions, and analytics

The merchant admin uses Shopify session tokens. The customer portal uses a short-lived session after OTP or Customer Account verification. Redis in Singapore holds session IDs and derived counters — not names, emails, or addresses. The marketing site and the app may set cookies or similar identifiers for load balancing and anonymous product analytics (PostHog). PostHog events are scrubbed of email, name, phone, message body, and address before send. Where a customer has set customer_privacy_optout, we honor that signal on the customer surfaces that read it. We do not use cookies to advertise or to build marketing profiles.

7. How we disclose information

We do not sell personal information for money.
We disclose to subprocessors that help run the Services, listed at /policy/subprocessors.
Third-party websites, models, and services have their own privacy policies that apply when you direct Eturns to use them.
We may disclose information during a merger, acquisition, financing, reorganization, or sale of assets.
We may disclose to law enforcement, regulators, or courts when we believe the law requires it or when disclosure is needed to protect rights, safety, or the integrity of the Services.

8. Retention

Data	Retention	Trigger
Closed return requests	7 years (financial record)	Time-based archival job
Declined return requests	30 days	Same job
Resolved/closed tickets	2 years	Same job
Agent decisions	7 years (audit)	Same job
Audit log entries	7 years	Same job
Webhook events	90 days	TTL on shop_id
Photo evidence	30 days on declined; permanent on approved	Customer + shop redact
Cost counters (Redis)	36 hours	INCRBY first-write

9. Security

We use reasonable administrative, technical, and physical safeguards: TLS 1.2+ on every external connection, AES-256-GCM at-rest encryption, Row-Level Security enforced on every shop-scoped Postgres table, HMAC verification on every Shopify webhook, constant-time compare, session-token verification before customer actions, an audit log of every state transition, per-shop rate limits, per-shop AI cost caps, and a CSP per surface with violation reporting. No method of transmission or storage is completely secure. If you believe you have discovered a vulnerability, contact contact@eturns.app. We will provide notices of security incidents as required by applicable law.

10. Your rights and choices

Right	How Eturns satisfies it
Access (GDPR Art. 15)	Merchant exports store data via Shopify admin or the customers/data_request webhook. Customers can also request a copy at https://app.eturns.app/customer/my-data (alias /customer/dsr), or ask the merchant.
Rectification (Art. 16)	Customer Account → edit profile (Shopify-managed)
Erasure (Art. 17)	Shopify customers/redact webhook → cascade delete within 48h
Restriction (Art. 18)	Merchant pauses autonomy via the Constitution → Decide settings
Portability (Art. 20)	DSR export is JSON; structured and machine-readable
Objection (Art. 21)	DSR + erasure cover this
Automated decisions (Art. 22)	Every agent decision has a merchant override path; audit trail records it

11. California Privacy Notice

California residents have the right to know, access, delete, correct, opt out of certain sales or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. We do not knowingly sell personal information for money. Where required, we honor Global Privacy Control signals.

12. India (DPDP Act)

For Indian data principals, Eturns acts as a Significant Data Fiduciary for the after-sales processing it performs. Consent is collected at merchant onboarding. Data principals may exercise access, correction, erasure, and grievance rights through the merchant, through https://app.eturns.app/customer/my-data, or through our Grievance Officer listed at /policy/india-grievance. We process personal data only for the after-sales purposes consented to and retain it per the schedule in section 8. Personal data we persist is stored in India, as described in section 5.

13. Children

Eturns is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we may delete the information and suspend the account.

14. Changes to this policy

We may update this Privacy Policy. If we make material changes, we will provide notice by posting the updated policy, sending an email, providing an in-product notice, or using another reasonable method.

15. Contact

Send questions or requests about this Privacy Policy to contact@eturns.app.

Questions about this policy? Email contact@eturns.app.