Legal

Privacy policy

The narrowest data model that still supports an explainable review. No customer identity, no raw payloads, no advertising analytics.

Current public surface · operator details pending launch

Minimal data by design

Return Owl requests only read-only order, return, and product scopes (read_orders, read_products, read_returns) and never reads or stores customer names, emails, phone numbers, postal addresses, or payment credentials.

Information the Shopify app processes

Shop identity, installation sessions, granted scopes and shop settings.
Recent order identifiers, order names and dates, refund amounts and currencies, transaction state, limited gateway/error evidence, normalized return and line quantities, restock evidence, and product/category/reason references.
Scan progress, review cases, merchant review outcomes, distinct-order usage, privacy-safe aggregate counts and deduplicating webhook identifiers.
Merchant-provided alert-recipient email, confirmation/unsubscribe state, constrained rules and delivery bookkeeping when alerts are enabled.

Return Owl does not request customer names, postal addresses, phone numbers, customer email addresses, full payment details or payment credentials. It does not retain raw Shopify or webhook payloads as a secondary data lake, sell personal information, or use commerce data for advertising.

Public contact form

The public contact form collects the name, reply email, optional myshopify.com domain, topic and message you submit. The website sends these fields over a server-to-server request to Return Owl’s contact store and, when configured, a notification email to the support address. The browser never receives the form secret.

Purpose: answering the request and maintaining an operational record of the enquiry.
No marketing use and no addition to an alert or newsletter list.
Messages are removed when the thread is closed or on request, subject to legal retention duties that may apply.
Do not send customer contact details, payment data, secrets or unredacted exports through the form.

How information is used

To refresh and normalize supported Shopify evidence.
To create explainable review cases and identity-free reconciliation aggregates.
To enforce catalog allowances and preserve retry/idempotency state.
To deliver merchant-requested alerts and answer support messages.
To prevent abuse, diagnose safe error states and meet Shopify privacy duties.

Providers and transfer

Shopify supplies commerce records and authentication. Return Owl runs on scalable cloud infrastructure with store-scoped data isolation and uses transactional email delivery services solely to send merchant-requested alerts and support notifications.

Cookies, analytics and trackers

The public website includes no advertising tracker, behavioural analytics tracker or tracking pixel. It stores a colour-theme preference cookie. Shopify authentication and the embedded app may use technically necessary session mechanisms. None of this public-site behavior is used to build an advertising profile.

Retention

Raw operational evidence: up to 180 days.
Cases and outcomes: up to 730 days.
Identity-free daily analytics aggregates: up to 730 days.
Webhook identifiers: up to 7 days.
Notification delivery metadata: up to 90 days.
Billing and distinct-order usage ledgers: up to 24 months.
Contact-form submissions: while the enquiry is open and no longer than needed to answer it, then removed on closure or request.

Valid Shopify customer and shop redaction callbacks remove scoped identifiers according to the product's deletion workflow. Uninstall marks the store pending deletion and purges after a forty-eight-hour grace period; shop redaction deletes immediately and idempotently.

Security and choices

Return Owl verifies Shopify sessions and webhook signatures, scopes records by shop, uses database constraints and idempotency, stores secrets outside source control, and keeps public token material hashed. No storage or transmission method can be guaranteed completely secure.

Merchants can disable alert rules, recipients can unsubscribe independently, and merchants can uninstall. Shopify customer privacy requests normally begin with the merchant.

Contact and changes

Email [email protected] or use the contact form with privacy questions. Do not send payment credentials or unredacted customer exports.