Privacy Policy

Last updated: July 7, 2026

StoreReturn (“StoreReturn,” “we,” “us,” or “our”) is an AI email returns agent for Shopify, operated by Binary Chakra / Chakril. This Privacy Policy explains what data we access, how we use it, how long we keep it, and the rights you and your customers have. By installing or using StoreReturn, you agree to the practices described below.

1. Data We Access

To process returns on your behalf, StoreReturn accesses the following data through the Shopify API using the scopes you approve at install:

• Orders (read_orders, write_orders) — order details, line items, fulfillment and refund status, needed to locate the order referenced in a return request and to create returns and refunds.
• Customers (read_customers) — customer name, email address, and order history, used to match an inbound email to the correct order and customer.
• Products (read_products) — product and variant details, used to identify the item a customer wants to return and to apply your return policy.
• Inbound customer emails — the content of return- related emails your customers send to your connected inbox, including the message body, subject, and sender address.

We do not access payment card numbers, and we do not sell personal data to third parties.

2. How We Use Your Data

• AI classification — inbound emails are analyzed by an AI model to determine whether they are return requests and to extract the relevant order and item.
• Policy checks & return processing — we compare the request against your configured return policy and, subject to your approval settings, create returns/refunds in Shopify and draft customer replies.
• Merchant notifications — we send you a summary and recommendation (for example, via Telegram) so you can approve or decline with one tap.

We use data only to provide and improve the StoreReturn service for your store. We do not use your customers’ personal data to train third-party foundation models.

3. Storage & Security

Data is stored in our managed database (Supabase) hosted on secured cloud infrastructure. Shopify access tokens and other credentials are encrypted at rest. Access to production systems is restricted and data is transmitted over encrypted (TLS) connections.

4. Data Retention

Inbound customer email content is scrubbed from our systems after 180 days. Return and refund records needed for your account history and reporting are retained for the life of your account and deleted on request or after account closure, subject to any legal retention obligations.

5. Your Rights & GDPR

We support data-subject requests under the GDPR, CCPA, and similar laws, including the right to access, correct, export, or delete personal data. We honor Shopify’s mandatory GDPR webhooks (customer data request, customer redaction, and shop redaction). To make a data-request or redaction request, contact us at the address below and we will action it within the timelines required by applicable law.

6. Sub-processors

We rely on a small set of sub-processors to run the service, including Shopify (platform data), Supabase (database hosting), our AI model provider (email classification), and a messaging provider for merchant notifications. Each is bound by data-processing terms.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to merchants directly.

8. Contact

For any privacy question, data-request, or redaction request, email us at support@storereturn.app.