Privacy policy

Who we are

Return OS is a returns and exchanges service for online stores. Merchants who use it are the controllers of their customers' data; Return OS processes it on their behalf. For this website, Return OS is the controller of what you send us. Legal entity and address: [to be added].

What we store when a customer returns an item

• Contact details already on the order (name, email, phone, address) so we can reach the customer and arrange the pickup.
• Order and item data, the reason for the return, the decision and the money movements.
• Photos the customer uploads as evidence. They are private and shown only through short-lived signed links.
• Payout details when a cash on delivery refund is paid by wallet, bank transfer or InstaPay.

What we store for analytics

• Not the customer's Shopify ID: a one-way keyed hash that includes the store, so it cannot be reversed or linked across stores.

Campaign visit counts on this website

• When you arrive from a campaign link (one with utm values in the address), this website counts the landing: the utm values, the page and the language, added to a daily total. We set no cookie, we store no IP address, browser details or personal data, and we do not link the count to you.

Staff accounts

• Name, email, role, sign-in records and, where required, two-step sign-in. Owner, Admin and Finance must use two-step sign-in.
• An audit log of sensitive actions, which cannot be edited by the application.
• Sign-in with Google (optional, currently in testing): when a team member chooses it, Google tells us their name, email address and Google account ID. We use them only to sign that person in to an account that already exists in Return OS, or to accept an invitation sent to that email; we keep the account ID and a masked copy of the email to recognise the same person next time. We do not read anything else from the Google account (no mail, files, contacts or calendar), we do not use it for advertising and we do not share it. A member can disconnect Google from their account page at any time.

What we do not do

• We do not store card numbers.
• We do not build marketing profiles of customers.
• We do not use advertising trackers, and this website sets no tracking cookies and loads no third-party scripts or fonts.

This website's contact form

• We use the name, store, email, phone (optional) and message you send only to reply to you. We send one automatic confirmation to your email.
• Email is delivered through Resend, our email provider.

Who else sees the data

• Shopify (the store platform), the courier that collects the parcel, Resend (email) and, for team members who choose to sign in with it, Google. Each receives only what its job needs.

Your rights and contact

• To see, correct or delete your data, contact the store you ordered from; they can also reach us. You can also write to us from the contact page.