Privacy Policy
Last updated: August 12, 2026
Eturns Inc. ("Eturns," "we," "us," or "our") makes Eturns, the AI after-sales operator for Shopify. Eturns resolves returns, exchanges, refunds, warranty claims, tracking questions, support tickets, reviews, fraud checks, and recovery offers on behalf of Shopify merchants, within the policies each merchant configures.
Privacy matters for an AI agent that takes decisions on a merchant's behalf. This policy explains what data we collect, what stays in your Shopify store, what can leave when you use a feature, and when we disclose information.
1. What we process and why
Eturns acts as a data processor on behalf of the installing merchant (the controller of their store's customer data). We access order, customer, and product data through the Shopify Admin API solely to resolve after-sales cases the merchant has configured Eturns to handle. We do not sell merchant or customer data. Customer PII in our database is minimized — emails are sha256-hashed where persisted for audit. We never send raw PII to the language models that power the agent; case facts use sentinel IDs and structured fields only.
2. Categories of data we process
| Category | What it includes | Where it is processed |
|---|---|---|
| Store data | Order, customer, product, fulfillment, and return records read via the Shopify Admin API to resolve after-sales cases. | Supabase (EU + US) under RLS per shop |
| Decision audit trail | For every AI decision: the model used, the prompt hash, the retrieved context summary, every tool call, the action taken, the dollar amount affected, and the reasoning trace. Retained 7 years. | Supabase |
| Photo evidence | Customer-uploaded photos for return and warranty claims. Stored in a private bucket with short-TTL signed URLs. 30 days on declined claims; retained on approved claims. | Supabase Storage |
| Customer emails | Recipient email for transactional sends via Resend. Persisted record is sha256(email); the plaintext is held only for the single send call. | Resend (send only) + Supabase (hash) |
| Webhook payloads | Shopify webhook payloads are HMAC-verified, deduplicated, and encrypted at rest when a payload key is configured. 90-day TTL. | Supabase |
| Billing | Stripe customer/subscription IDs, plan, billing period, credit balances. Processed via Shopify Billing API. | Shopify + Supabase |
| Product analytics | Anonymous analytics ID, product events, page route, error summaries, feature flags. PostHog scrubs email/name/phone/body/address before send. | PostHog (EU or US) |
| Errors | Stack traces and scrubbed extras for error monitoring. | Sentry (EU + US) |
| Cost counters | Per-shop AI-cost counters and session IDs. No PII — derived totals only. 36-hour TTL. | Render Redis (Singapore) |
3. AI and automated processing
Every AI decision in Eturns is bounded by merchant policy, confidence thresholds, dollar-amount thresholds, fraud checks, and an audit trail. Above a per-merchant configured dollar amount (default $200), no autonomous action executes without merchant approval. All model traffic flows through the Vercel AI Gateway. The model-visible context for any decision can include case facts (sentinel IDs and structured fields — never raw email, name, or address), retrieved policy text, and tool results. We configure third-party model providers with zero-data-retention, no-training, or equivalent settings where the provider supports it. We do not train public models on merchant or customer data. Merchant overrides calibrate future decisions for that merchant only.
4. Subprocessors
We disclose our subprocessors publicly at /policy/subprocessors. The current list includes Vercel AI Gateway (and the model vendors it routes to), Supabase, Render, Resend, Sentry, PostHog, and Shopify.
5. How we disclose information
- We do not sell personal information for money.
- We disclose to subprocessors that help run the Services, listed at /policy/subprocessors.
- Third-party websites, models, and services have their own privacy policies that apply when you direct Eturns to use them.
- We may disclose information during a merger, acquisition, financing, reorganization, or sale of assets.
- We may disclose to law enforcement, regulators, or courts when we believe the law requires it or when disclosure is needed to protect rights, safety, or the integrity of the Services.
6. Retention
| Data | Retention | Trigger |
|---|---|---|
| Closed return requests | 7 years (financial record) | Time-based archival job |
| Declined return requests | 30 days | Same job |
| Resolved/closed tickets | 2 years | Same job |
| Agent decisions | 7 years (audit) | Same job |
| Audit log entries | 7 years | Same job |
| Webhook events | 90 days | TTL on shop_id |
| Photo evidence | 30 days on declined; permanent on approved | Customer + shop redact |
| Cost counters (Redis) | 36 hours | INCRBY first-write |
7. Security
We use reasonable administrative, technical, and physical safeguards: TLS 1.2+ on every external connection, AES-256-GCM at-rest encryption, Row-Level Security enforced on every shop-scoped Postgres table, HMAC verification on every Shopify webhook, constant-time compare, session-token verification before customer actions, an audit log of every state transition, per-shop rate limits, per-shop AI cost caps, and a CSP per surface with violation reporting. No method of transmission or storage is completely secure. If you believe you have discovered a vulnerability, contact security@eturns.app. We will provide notices of security incidents as required by applicable law.
8. Your rights and choices
| Right | How Eturns satisfies it |
|---|---|
| Access (GDPR Art. 15) | Merchant exports store data via Shopify admin; customers request access via the merchant |
| Rectification (Art. 16) | Customer Account → edit profile (Shopify-managed) |
| Erasure (Art. 17) | Shopify customers/redact webhook → cascade delete within 48h |
| Restriction (Art. 18) | Merchant pauses autonomy via the Constitution → Decide settings |
| Portability (Art. 20) | DSR export is JSON; structured and machine-readable |
| Objection (Art. 21) | DSR + erasure cover this |
| Automated decisions (Art. 22) | Every agent decision has a merchant override path; audit trail records it |
9. California Privacy Notice
California residents have the right to know, access, delete, correct, opt out of certain sales or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. We do not knowingly sell personal information for money. Where required, we honor Global Privacy Control signals.
10. India (DPDP Act)
For Indian data principals, Eturns acts as a Significant Data Fiduciary for the after-sales processing it performs. Consent is collected at merchant onboarding. Data principals may exercise access, correction, erasure, and grievance rights through the merchant or through our Grievance Officer listed at /policy/india-grievance. We process personal data only for the after-sales purposes consented to and retain it per the schedule in section 6.
11. Children
Eturns is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we may delete the information and suspend the account.
12. Changes to this policy
We may update this Privacy Policy. If we make material changes, we will provide notice by posting the updated policy, sending an email, providing an in-product notice, or using another reasonable method.
13. Contact
Send questions or requests about this Privacy Policy to support@eturns.app.
Questions about this policy? Email support@eturns.app.