# Privacy Policy Version 1.4 · Last updated 9 Nov 2026 · Source: https://eturns.app/policy/privacy/ Eturns Inc. ("Eturns," "we," "us," or "our") makes Eturns, the AI after-sales operator for Shopify. Eturns resolves returns, exchanges, refunds, warranty claims, tracking questions, support tickets, reviews, fraud checks, and recovery offers on behalf of Shopify merchants, within the policies each merchant configures. Privacy matters for an AI agent that takes decisions on a merchant's behalf. This policy explains what we collect at install, what stays in your Shopify store, what can leave when you use a feature, how cookies and sessions work, and how to ask for your data. ## 1. What we process and why Eturns acts as a data processor on behalf of the installing merchant (the controller of their store's customer data). We access order, customer, and product data through the Shopify Admin API solely to resolve after-sales cases the merchant has configured Eturns to handle. We do not sell merchant or customer data. Customer PII in our database is minimized: emails are sha256-hashed where persisted for audit, with narrow AES-256-GCM encrypted fields held only where operational delivery requires them (email-only support threads up to 30 days after close, gift-return verification requests up to 7 days, active 24-hour portal sessions, and pending 7-day draft-order payment links). Order contact fields never enter language-model prompts: structured case facts use sentinel IDs, and free-text customer messages pass through a redaction filter that strips emails, phone numbers, card numbers, street addresses, and known names before any model call. ## 2. Categories of data we process | Category | What it includes | Where it is processed | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | **Merchant install data** | Shop domain, country, currency, installed plan, and the merchant’s policies: return window, confidence threshold, brand voice, dollar caps, and overrides. | Supabase (Singapore) | | **Store data** | Order, customer, product, fulfillment, and return records read via the Shopify Admin API to resolve after-sales cases. | Supabase, AWS ap-southeast-1 (Singapore), under RLS per shop | | **Decision trail** | For every AI decision: the model used, the prompt hash, the retrieved context summary, every tool call, the action taken, the dollar amount affected, and the reasoning trace. Retained 7 years. | Supabase (Singapore) | | **Photo evidence** | Customer-uploaded photos for return and warranty claims. Stored in a private bucket with short-TTL signed URLs. 30 days on declined claims; retained on approved claims. | Supabase Storage (Singapore) | | **Customer emails & portal sessions** | Recipient email for transactional sends via Resend. Persisted audit record is sha256(email); narrow operational fields (email-only ticket reply address up to 30 days post-close, 7-day gift-return verification, 24-hour portal session state, and 7-day draft-order invoice links) are encrypted at rest with AES-256-GCM. | Resend (send/inbound) + Supabase (Singapore) | | **Webhook payloads** | Shopify webhook payloads are HMAC-verified and deduplicated. Body is dropped immediately on success; in-flight or failed bodies are encrypted at rest with AES-256-GCM. Terminal rows are deleted after 30 days. | Supabase (Singapore) | | **Billing & shopper fee invoices** | Shopify App Subscription IDs, plan tier, billing interval, decision usage counters, optional merchant GST/VAT tax header details, and Shopify Draft Order IDs for shopper return fees or uneven exchanges. Processed exclusively via Shopify Billing API and Shopify Draft Orders. | Shopify + Supabase (Singapore) | | **Product analytics** | Anonymous analytics ID, product events, page route, error summaries, feature flags. PostHog scrubs email/name/phone/body/address before send. | PostHog US Cloud | | **Errors** | Stack traces and scrubbed extras for error monitoring. | Sentry US | | **Cost counters** | Per-shop AI-cost counters and session IDs. No PII, derived totals only. 36-hour TTL. | Render Redis (Singapore) | ## 3. AI and automated processing Every AI decision in Eturns is bounded by merchant policy, confidence thresholds, dollar-amount thresholds, fraud checks, and a decision trail. Above a per-merchant dollar amount (set from the merchant's own order values, or chosen by the merchant), no autonomous action executes without merchant approval. All model traffic flows through the Vercel AI Gateway. The model-visible context for any decision can include structured case facts (sentinel IDs and structured fields, never order contact fields), free-text customer messages after automated redaction of emails, phone numbers, card numbers, street addresses, and known names, retrieved policy text, and tool results. We configure third-party model providers with zero-data-retention, no-training, or equivalent settings where the provider supports it. We do not train public models on merchant or customer data. Merchant overrides calibrate future decisions for that merchant only. Asking for a person to review a decision. When Eturns declines a return or warranty claim automatically under the store's policies (for example, a request outside the return window or an item the store sells as final sale), the customer can ask for a person to review that decision instead. On the request's status page in the store's returns portal, choose "Ask a person to review this decision". The request goes back to the store's team, who review it and make the final call. Eturns does not decide it again on its own. The customer gets an email confirming the request, and the outcome shows on the same status page. Customers can also contact the store directly. ## 4. Subprocessors We disclose our subprocessors publicly at /policy/subprocessors. The current list includes Vercel AI Gateway (and the model vendors it routes to), Supabase, Render, Resend, Sentry, PostHog, and Shopify. ## 5. Where your data is stored, and international transfers Personal data that Eturns persists (store data, the decision trail, photo evidence, webhook payloads, and hashed email records) rests in a single Supabase project hosted on AWS ap-southeast-1 in Singapore. The application, its background worker, and its Redis cache also run in Render's Singapore region; the Redis tier holds derived counters and session IDs, not personal data. Because our storage and compute region is Singapore, personal data of merchants and customers located in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those areas when you use Eturns. Singapore is not currently the subject of a general European Commission adequacy decision. The terms governing these transfers are set out in our Data Processing Agreement at /policy/dpa and in each subprocessor's own data processing agreement, listed at /policy/subprocessors. Our other subprocessors process data outside Singapore as well: Sentry and PostHog process telemetry in the United States, Resend delivers email from its global infrastructure, and the Vercel AI Gateway routes model traffic to provider infrastructure that is not region-pinned. The data sent to those services is scrubbed of personal data as described in section 2 and section 3. ## 6. Cookies, sessions, and analytics The merchant admin uses Shopify session tokens. The customer portal uses a short-lived session after OTP or Customer Account verification. Redis in Singapore holds session IDs and derived counters, not names, emails, or addresses. The marketing site and the app may set cookies or similar identifiers for load balancing and anonymous product analytics (PostHog). PostHog events are scrubbed of email, name, phone, message body, and address before send. Where a customer has set customer_privacy_optout, we honor that signal on the customer surfaces that read it. We do not use cookies to advertise or to build marketing profiles. ## 7. How we disclose information - We do not sell personal information for money. - We disclose to subprocessors that help run the Services, listed at /policy/subprocessors. - Third-party websites, models, and services have their own privacy policies that apply when you direct Eturns to use them. - We may disclose information during a merger, acquisition, financing, reorganization, or sale of assets. - We may disclose to law enforcement, regulators, or courts when we believe the law requires it or when disclosure is needed to protect rights, safety, or the integrity of the Services. ## 8. Retention | Data | Retention | Trigger | | ---------------------------------------------- | ------------------------------------------------------ | -------------------------------------------------- | | Closed return requests & warranty claims | 7 years (financial record) | Nightly retention worker | | Declined return requests | 30 days from final state | Same job | | Resolved/closed tickets & reviews | 2 years | Same job | | Agent decisions | 7 years (decision trail) | Manual archival / shop redact | | Activity log entries (who did what in the app) | 7 years (append-only) | Shop redact / legal retention | | Webhook events | 30 days | Body dropped on success; row deleted after 30 days | | Photo evidence | 30 days on declined; retained on approved until redact | Nightly retention worker + customer/shop redact | | Cost counters (Redis) | 36 hours | INCRBY first-write | ## 9. Security We use reasonable administrative, technical, and physical safeguards: TLS 1.2+ on every external connection, AES-256-GCM at-rest encryption, Row-Level Security enforced on every shop-scoped Postgres table, HMAC verification on every Shopify webhook, constant-time compare, session-token verification before customer actions, an audit log of every state transition, per-shop rate limits, per-shop AI cost caps, and a CSP per surface with violation reporting. No method of transmission or storage is completely secure. If you believe you have discovered a vulnerability, contact contact@eturns.app. We will provide notices of security incidents as required by applicable law. ## 10. Your rights and choices | Right | How Eturns satisfies it | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Access (GDPR Art. 15) | Merchant exports store data via Shopify admin or the customers/data_request webhook. Customers can also request a copy at https://app.eturns.app/customer/my-data (alias /customer/dsr), or ask the merchant. | | Rectification (Art. 16) | Customer Account → edit profile (Shopify-managed) | | Erasure (Art. 17) | Shopify customers/redact webhook → cascade delete within 48h | | Restriction (Art. 18) | Merchant pauses autonomy via Policies → Who decides | | Portability (Art. 20) | DSR export is JSON; structured and machine-readable | | Objection (Art. 21) | DSR + erasure cover this | | Automated decisions (Art. 22) | A customer can ask a person to review any automatic decline: "Ask a person to review this decision" on the request’s status page sends it back to the store, which makes the final call (see section 3). Every agent decision also has a merchant override path; the decision trail records both. | ## 11. California Privacy Notice California residents have the right to know, access, delete, correct, opt out of certain sales or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. We do not knowingly sell personal information for money. Where required, we honor Global Privacy Control signals. ## 12. India (DPDP Act) Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the installing merchant acts as the Data Fiduciary for their store's customer data, and Eturns acts as a Data Processor acting on the merchant's documented instructions (and as a Data Fiduciary solely for our own merchant account, billing, and direct inquiry records). Data principals may exercise access, correction, erasure, and grievance rights through the merchant, through https://app.eturns.app/customer/my-data, or through our Grievance Officer listed at /policy/india-grievance. We process personal data only for the after-sales purposes configured by the merchant and retain it per the schedule in section 8. Personal data we persist is stored in Singapore, as described in section 5. ## 13. Children Eturns is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we may delete the information and suspend the account. ## 14. Changes to this policy We may update this Privacy Policy. If we make material changes, we will provide notice by posting the updated policy, sending an email, providing an in-product notice, or using another reasonable method. ## 15. Contact Send questions or requests about this Privacy Policy to contact@eturns.app.