Effective date: 13 September 2026
Returova provides return and margin analytics inside the merchant's authenticated Shopify Admin. This notice explains the app's handling of personal data, including for merchants in the European Economic Area, European Union, United Kingdom, and Switzerland.
The merchant determines why Shopify order data is processed and ordinarily acts as controller. Returova acts as processor only to provide the analysis requested by the merchant. Questions and data-protection requests can be sent to prabmurthy@gmail.com.
The app processes the minimum order totals, line-item and variant details, refund quantities and values, structured return reasons, product details, and inventory unit costs needed to calculate refund rates, estimated return loss, product risk signals, and recommended merchant actions. It does not request customer names, email addresses, phone numbers, postal addresses, payment credentials, or customer profiles.
Processing is performed on the merchant's documented instruction to provide the contracted app service. The merchant is responsible for identifying its lawful basis and providing any notices required to its customers.
Raw order, refund, return, product, and inventory data is processed within the authenticated Shopify experience and is not retained in an external Returova database. Merchant-entered assumptions and checklist progress are stored as an app-owned metafield in the merchant's Shopify store until the merchant changes them or removes the app. Removing the app ends Returova's access. Authenticated Shopify privacy webhooks are acknowledged without retaining their payloads.
Shopify hosts the merchant data and embedded app experience. Cloudflare serves only the public legal, support, health, reviewer-media, and mandatory privacy-webhook endpoints. Returova does not send order data to Cloudflare, advertising networks, analytics providers, or external AI providers. Cloudflare may process ordinary network metadata such as IP address, request URL, and timestamp under its own data-processing terms. Shopify and Cloudflare may process data internationally using the safeguards described in their applicable privacy and data-processing terms, including approved transfer mechanisms where required.
Returova does not set advertising or analytics cookies on its public pages. Product risk signals support merchant decisions only; they do not make decisions about individuals with legal or similarly significant effects.
The app uses Shopify authorization, least-privilege read scopes, HTTPS, authenticated webhook signatures, and no external merchant-data store. Individuals should normally exercise access, correction, deletion, restriction, objection, and portability rights through the merchant that controls their data. Returova will assist the merchant with verified requests and will cooperate with applicable supervisory authorities. Individuals may also lodge a complaint with their local data-protection authority.
Material changes will be published on this page with a revised effective date.