Privacy policy

Returo is a returns app for Shopify stores and the websites returo.io and support.returo.io. It is operated by Returo Labs, a product of Flowett AB (org. no. 559518-8029), Sweden (“Returo”, “we”). This policy explains what personal data we process, why, and what rights you have. Questions and requests: support@returo.io.

Who is responsible for your data

If you are a customer of a store that uses Returo, the store is the data controller and we process your data on the store’s behalf to handle your return. Send requests about your data to the store first; Shopify’s standard data request and deletion mechanisms reach us automatically and we act on them.

If you are a merchant, a visitor to our websites, or someone we contact about Returo, we are the controller for the data described below.

The Returo app: data we process for a store’s customers

Data	Why	How long
Email address and Shopify customer ID	Find your order, identify your return, send return updates	Kept with the return record for the store’s accounting; identifiers are anonymised when the store or Shopify asks us to erase you, and deleted when the store uninstalls Returo
Order details (order number, items, amounts)	Build and process the return, exchange, gift card or refund	Same as above
Name, address and, for customs labels outside the EU, phone number	Create the return shipping label with the carrier the store uses, and find drop-off points near you	Printed on the label, which Returo keeps with the return so you can open it again; removed when the store or Shopify asks us to erase you, and deleted when the store uninstalls Returo
The note you write about why you return	Show the store your reason	Same as the return record
Where your order came from (campaign, referring site)	Show the store which marketing brings returns	Same as the return record
Draft return in progress	Let you finish a return you started	Deleted when you submit it, or automatically when abandoned
IP address (rate limiting only)	Protect the order lookup from abuse	Deleted within the hour once its 15-minute window ends

We use this data only to process returns and exchanges and to show the store its own return statistics. No profiling, no advertising, no selling of data. Customer identifiers are excluded from our logs.

Legal basis (GDPR art. 6): performance of the contract between you and the store, and the store’s legitimate interest in handling returns efficiently.

Merchants: data we process about you

Your name, work email, store domain and the settings you configure in the app, so the app can run and we can support you. Support conversations at support.returo.io are kept so we can follow up. If you connect Google Ads or Meta in the app, we store an encrypted access token and the names of the ad accounts it can read, and read ad spend per account and campaign to show next to your returns. We send no customer data to Google or Meta. The token is revoked and deleted when you disconnect, or when you uninstall Returo. Legal basis: the contract with you, and our legitimate interest in supporting the product.

Website visitors

• Contact form and calculator: the email, store URL and the numbers you enter, with the page’s language and currency, are stored so we can contact you about Returo and go through the numbers with you. Legal basis: your request (contract preparation). We delete them when you ask or when they are no longer needed.
• Support chat: messages and the email you leave are kept so we can reply.
• Cookies and browser storage: no advertising trackers. Nothing is stored on your device until you ask for something: clicking EN or SV sets a lang cookie that remembers your choice (one year), and starting a support chat stores the conversation’s key and the chat’s settings in your browser’s local storage so you can continue it. None of it is shared with anyone, and no consent banner is needed for it.

Business outreach

We sometimes contact people in their professional role at online stores that may benefit from Returo. Contact details come from public sources and business databases (for example the store’s own website, company registries such as allabolag.se, LinkedIn, Store Leads and Apollo). Legal basis: our legitimate interest in marketing to businesses (GDPR art. 6.1.f). Every message tells you how to opt out, and one reply is enough; we then stop and keep only a suppression entry so we do not contact you again. We do not email sole traders without consent.

Where data is stored and who receives it

• Shopify: the app runs inside Shopify and reads and writes order, customer, gift card and return data through Shopify’s APIs under Shopify’s terms.
• Hosting: our servers and database run on Google Cloud in the EU (Finland region). The websites run on Cloudflare.
• Carriers: PostNord, Shipmondo and Shopify Shipping receive the name, address, email and, for customs labels, phone number needed to produce a return label, under the store’s own carrier agreement.
• Transactional email: Resend sends return receipts and status emails to you and notifications to the store, from its EU region (Ireland). Resend is a US company; any access from outside the EU is covered by the EU Standard Contractual Clauses.
• Email and calendar: Google Workspace for correspondence; Calendly if you book a call.

We do not sell personal data. We share it only with the processors above, or when the law requires. Stores using Returo can read how we process their customers’ data on their behalf in our data processing agreement.

Security

All traffic is encrypted in transit. Databases are encrypted at rest and backed up. Access to production data is limited to the founders and logged. We have an incident response procedure and will notify affected stores without undue delay if a breach affects their customers’ data.

Your rights

You can ask for access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interest. Write to support@returo.io. If you are a store’s customer, contact the store; we act on the store’s instructions. You can also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Changes

We update this page when our processing changes. The date at the top tells you when it was last revised.