Returns Engine (Shopify app) privacy policy

1. Provider and scope

Aaron Franke – Werkstoff Digital
Ramsenerstr. 35A
78239 Rielasingen-Worblingen
Germany
Email: info@werkstoff-digital.de

(Details from the legal notice at https://werkstoff-digital.de/impressum/.)

This privacy policy is addressed to merchants who use Returns Engine in their Shopify store and their staff, and to the customers of these merchants (end customers) whose data is processed in connection with a return.

Roles in processing

• Processing on behalf of the merchant: when handling returns, Werkstoff Digital processes personal data of end customers as a processor on behalf of the respective merchant (Art. 28 GDPR). This covers return requests, return shipping, tracking, refunds, store credit, exchanges, the customer portal, emails to end customers and webhooks to the merchant's systems. The merchant is the controller for this processing; for questions about it, the merchant is the primary point of contact.
• Processing under its own responsibility: for operating Returns Engine as software-as-a-service, Werkstoff Digital is itself the controller. This covers managing merchant accounts, billing the subscription and usage, the security of the app, abuse prevention (including in the customer portal), technical logs and their analysis for troubleshooting, and the public demo.

Werkstoff Digital and the merchant are not joint controllers within the meaning of Art. 26 GDPR.

Privacy contact: please send privacy requests to info@werkstoff-digital.de.

A data protection officer is currently not appointed, as according to the current assessment there is no statutory obligation to designate one.

2. Purpose of the app

Returns Engine is an app for Shopify merchants. It helps merchants handle returns: return requests through a customer portal (for customers with an account and for guest orders), review and approval by the merchant, return labels and tracking, refunds, store credit and exchanges. The app books refunds and store credit as refunds through Shopify. Merchants can also set up outbound webhooks to their own systems.

Automatic handling based on merchant rules

Rules configured by the merchant can automatically approve or reject return requests based on predefined criteria and restrict the resolutions offered (refund, store credit, exchange). Possible criteria are the return reason, order and return value, days since the order, shipping country and the number of previous returns. These are fixed if-then rules whose criteria the merchant defines; Returns Engine does not use AI-based assessment or scoring for them. Automatic approval is only active if the merchant turns it on.

A rule may also take into account statistical return characteristics such as the number of previous returns in the respective shop. This evaluates the customer's past behaviour, which is profiling within the meaning of Art. 4(4) GDPR. There is no decision based solely on automated processing within the meaning of Art. 22 GDPR, as the rules, in their intended use, have no legal effect and no similarly significant effect; clarification through the merchant's support remains possible.

The merchant defines the return rules and is responsible for the use of the return history within its rules. Where necessary, the merchant takes the use of such criteria into account in its own privacy policy.

3. Data processed

3.1 Stored for the duration of use (until the shop is deleted, see section 6)

• Shop and merchant data: shop domain, Shopify shop ID, display name, settings, branding, support email entered by the merchant, the merchant's return address (including optional email and phone number), the merchant's receiving address for returns at the shipping carrier and the carrier credentials (encrypted).
• Shopify access data: the shop's admin session issued by Shopify (access token).
• Order and customer references: Shopify IDs of orders and customers, order date, shipping country.
• Return data: return line items (product or variant and quantity), return reasons (as codes), requested resolution, status and timestamps, fees.
• Free text: internal merchant notes and rejection messages to the customer. These can contain personal data if merchants enter it there.
• Resolution data: amounts and status of refunds, store credit (including the Shopify customer ID) and exchange items, and the Shopify reference of the respective refund.
• Shipping and tracking data: tracking number, tracking link, shipment status.
• Billing data: status of the merchant's Shopify subscription (time of last confirmation, billing period, plan) and usage-based billing events (booked returns, amounts).
• History logs (business audit events): history of each return and of a withdrawal, billing and refund reconciliation events, and the handling of privacy requests. A customer reference is stored there only in pseudonymized form (HMAC-SHA256 value instead of the customer ID).
• Statistical return characteristics: statistical return characteristics, such as the number of previous returns of a customer in the respective shop, insofar as they are used to apply the return rules defined by the merchant. The number is determined from the shop's stored returns when a return request is checked.
• Webhook configuration: webhook target URLs configured by the merchant (secret encrypted).

3.2 Stored temporarily

The times given are the validity or retention period. Once expired, the data can no longer be used; it is physically deleted in the next daily cleanup run.

• Technical logs: summaries of the daily background jobs, failures when sending sign-in links and when recording webhook events, results of creating returns in Shopify, and connection events of the shipping carrier: 30 days.
• Webhook events and delivery attempts: event contents contain IDs only (return, order, resolution type), no names or email addresses. Completed delivery attempts (delivered, finally failed or skipped): 30 days. An event is deleted after 30 days once no delivery attempt for it is stored any more; delivery attempts still in progress are kept until they are completed.
• Return labels (PDF) and QR codes: only when a real shipping carrier is connected. A label contains the sender's (customer's) name and address. Deleted after 90 days. In the current production configuration no real carrier is active; no label PDFs are created there.
• Label download links sent by email: valid for 30 days.
• Customer portal sign-in and session data:
  • Sign-in step via Shopify customer accounts: 10 minutes.
  • Session after signing in with a Shopify customer account: until the token issued by Shopify expires. The customer account access token issued by Shopify for this is stored encrypted.
  • Magic-link token for guest orders: 20 minutes (only a hash of the token is stored).
  • Guest session: 45 minutes. Session after order lookup: 45 minutes.
  • Draft return request: 1 hour.
• Abuse protection (rate limiting): for order lookups and sign-in link requests, return requests and creating the public demo, hashed values are stored (of the order number, email address, order or customer account, and IP address). Deleted after 24 hours.
• Data access exports (Shopify request customers/data_request): 7 days.
• Demo environment: demo shops are deleted after 4 hours; the demo contains no real customer data.

3.3 Loaded from Shopify when needed, not stored

The customer's name, email address and shipping address, the order number, order line items and prices are retrieved at runtime through Shopify's APIs, displayed or used for a specific operation (for example sending an email or creating a label) and are not written to the app's database.

3.4 Hashed or pseudonymized

• Customer reference in logs: HMAC-SHA256.
• Rate-limit keys (order number, email, order or customer account): SHA-256.
• IP address for rate limiting: SHA-256 of the IP address without an additional key. This is pseudonymization, not anonymization.
• Magic-link token: only the hash is stored.

4. Emails

The app sends transactional emails to the merchant's customers: sign-in link for guest orders (magic link), return label or return information and, if the merchant has enabled the statutory right of withdrawal, a confirmation of receipt. For this, the email address, shop name and the respective links are passed to the email service. Depending on the type of email, the customer's first name and order, return, shipping, contact or return-address information of the merchant may also be part of the message.

Brevo is used for transactional emails. Open and click events may be recorded in aggregated form. Anonymous tracking is enabled for transactional emails so that these events are not associated with a specific recipient or contact for future emails. Links in the emails are routed through Brevo redirect addresses.

Brevo keeps the sending logs of transactional emails for one month; older logs are deleted automatically once this period has expired. Previews of email contents are not stored for new emails.

5. Recipients and services used

DHL is not active in the current production configuration and only becomes relevant once the carrier is enabled. Webhook targets are set up exclusively by the merchant.

Until 23 October 2026, transactional emails were sent through Resend (Resend, Inc., USA). Resend is no longer an active service provider; sending data from that period may still be stored there for a limited time.

Transfers to third countries

Processing outside the European Economic Area (EEA) can take place, even though the services are operated in Frankfurt, in particular by providers, group companies or subprocessors in the United States. Transfers to the United States are based on the EU-U.S. Data Privacy Framework where the respective recipient is certified under it, and otherwise on EU Standard Contractual Clauses where these have been agreed contractually. According to the providers:

• Render: primarily the EU-U.S. Data Privacy Framework, as a fallback EU Standard Contractual Clauses.
• Neon: Neon refers to the EU-U.S. Data Privacy Framework.
• Brevo: depending on the recipient, EU Standard Contractual Clauses with supplementary measures and, for the United States, also the EU-U.S. Data Privacy Framework. Brevo sends the emails on our behalf; the safeguards follow Brevo's data processing agreement and transfer arrangements.
• Shopify: processing by Shopify follows Shopify's contractual and data processing framework; processing outside the EEA is possible.

A data processing agreement is in place with each of Render, Neon and Brevo: with Render through the DPA provided in the account, with Neon through the DPA incorporated into its terms, and with Brevo through acceptance of the data processing agreement at registration.

6. Retention and deletion

• Data with a fixed retention period is deleted daily by a cleanup job (periods see section 3.2). This also applies to technical logs and to webhook events and delivery attempts, which are deleted after 30 days.
• Sending logs at the email service Brevo: 1 month (see section 4).
• Return, resolution and shipping data, history logs and webhook configuration (section 3.1) are stored for as long as the merchant uses the app, because they are needed to handle the returns and to document them towards the merchant. They are deleted when the shop is deleted (section 7, shop/redact). Data of individual end customers is removed earlier upon their deletion request (section 7, customers/redact).
• Billing data in the app is likewise deleted together with the shop.
• Own invoices and accounting records of Werkstoff Digital are stored outside the app in a local digital archive. They are not part of the app's database, are not deleted by shop/redact, and are kept insofar as Werkstoff Digital is subject to commercial and tax retention obligations.
• Hosting server logs (Render): 7 days.
• Backups: deletion applies to the active database. The restore and history period visible in the database account (Neon) is 6 hours. Beyond that, data may still be contained in the service providers' backups until the retention periods applicable there expire.

7. Shopify privacy webhooks

The app handles Shopify's three privacy webhooks:

• customers/data_request (access): the app builds an export of the data stored for this customer (returns with line items, resolution, shipping, order references, portal sessions, drafts) and keeps it for 7 days.
• customers/redact (customer deletion): the app deletes return labels and label emails of the affected returns, clears free text and rejection messages, removes the Shopify customer ID from returns, store credit and order references, and deletes this customer's portal sessions, drafts, guest sign-in data and data access exports.
• shop/redact (shop deletion): Shopify sends this request after the app is uninstalled. Upon receipt of the request, the app immediately deletes the Shopify sessions and the shop with all data attached to it from the active database, including return, resolution, shipping, log, webhook and billing data and the settings.

8. Cookies and local storage

In the customer portal and the demo, the app sets functional cookies only, each HttpOnly, over HTTPS only in production (Secure), SameSite=Lax. The lifetime of a cookie in the browser and the validity of the related session on the server are separate: a cookie can remain in the browser for longer than the session is valid on the server.

In the embedded merchant view, Shopify uses its own session mechanisms.

The app itself does not use any analytics, tracking or marketing tools and no pixels. For the recording of opens and clicks of transactional emails by the email service, see section 4. The font is loaded from Shopify's CDN.

9. Legal bases

For processing under Werkstoff Digital's own responsibility (section 1):

• Providing the app, managing merchant accounts, billing the subscription and usage: Art. 6(1)(b) GDPR (contract with the merchant).
• Security of the app, abuse prevention (rate limiting, including in the customer portal and the demo) and technical logs for troubleshooting: Art. 6(1)(f) GDPR. The legitimate interest lies in operating the app securely, reliably and protected against abuse.
• Compliance with statutory retention obligations: Art. 6(1)(c) GDPR.

For processing on behalf of the merchant (section 1), Werkstoff Digital does not rely on a legal basis of its own. The legal basis lies with the merchant as controller; typically this is the performance of the purchase contract with the end customer (Art. 6(1)(b) GDPR).

10. Data subject rights

Under the GDPR, data subjects have the following rights, subject to the respective statutory conditions:

• access to the data processed about them (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing, in particular to processing based on Art. 6(1)(f) GDPR, on grounds relating to their particular situation (Art. 21 GDPR),
• complaint to a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of their habitual residence, place of work or place of the alleged infringement. The authority competent for Werkstoff Digital is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

Whom to contact:

• Return data (processing on behalf of the merchant): primarily the merchant you ordered from, as the merchant is the controller. If Werkstoff Digital receives such a request directly, Werkstoff Digital supports the merchant in responding to it.
• Merchant account, billing, security and operational data (processing under its own responsibility): Werkstoff Digital, info@werkstoff-digital.de.

Access and deletion requests that Shopify forwards to the app on behalf of a customer or shop are processed as described in section 7.

11. Changes

Version 1.0, as of 23 October 2026.

If the app, the services used or the legal situation change, this privacy policy will be updated and published with a new version and date.