Privacy Policy

This Privacy Policy describes how Return Regret ("we," "our," or "us"), operated by Akestech, collects, uses, and discloses your information when you use our Shopify application ("the App").

We are committed to protecting your privacy and complying with all applicable data protection laws, including GDPR, CCPA, and Shopify's Partner Program Agreement.

1. Information We Collect

1.1 Merchant Information

When you install our App, we collect:

• Shop domain and Shopify store ID
• Access tokens (encrypted at rest)
• Contact information (email, name)
• Billing information (processed by Shopify)

1.2 Order Data

To provide our services, we access:

• Order details (order ID, order number, total amount)
• Line items and product information
• Order status and fulfillment information
• Financial status of orders

1.3 Customer Data (Protected)

When customers submit return requests, we collect:

• Customer name
• Email address
• Phone number (if provided)
• Order history related to their return request
• Return reasons and preferences

Note: We only access customer data when a customer actively submits a return request. We do not perform bulk customer data operations.

2. How We Use Information

We use the collected information solely to:

• Provide return management services to merchants
• Create discount codes, price rules, and draft orders in your Shopify store
• Send transactional notifications to customers (email and WhatsApp)
• Generate analytics and reports for merchants
• Improve our services and develop new features
• Provide customer support
• Comply with legal obligations
• Prevent fraud and ensure security

3. Data Storage and Security

We implement industry-standard security measures:

• Encryption at Rest: All sensitive data, including access tokens, is encrypted using AES-256 encryption
• Encryption in Transit: All data is transmitted over HTTPS/TLS 1.3
• Access Controls: Strict role-based access to data
• Regular Backups: Encrypted backups stored securely
• Security Audits: Regular security reviews and penetration testing
• Data Centers: Hosted in SOC 2 compliant facilities

4. Data Sharing and Disclosure

We do NOT sell, rent, or trade your data. We share data only with:

• Service Providers: Email delivery (SendGrid), WhatsApp API (Meta), for delivering transactional messages
• Shopify: As required to provide the App functionality
• Legal Compliance: When required by law or valid legal process
• Business Transfers: In case of merger or acquisition (with notice)

All third-party service providers are contractually obligated to protect your data and comply with GDPR and applicable privacy laws.

5. Data Retention

We retain data for the following periods:

• Active Merchants: As long as the App is installed
• Return Request Records: 2 years for analytics purposes
• Customer Data: Deleted upon request or 90 days after last activity
• Backup Data: Purged within 30 days

When you uninstall the App, all merchant data is deleted within 48 hours as required by Shopify's policies.

6. GDPR Rights (EU Users)

If you are located in the European Economic Area, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, email us at privacy@akestech.in.net. We will respond within 30 days.

7. CCPA Rights (California Users)

California residents have the right to:

• Know what personal information we collect
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising these rights

8. Shopify GDPR Webhooks

We implement all mandatory Shopify GDPR webhooks to comply with data privacy requests:

• customers/data_request - Provides customer data on request
• customers/redact - Deletes customer data
• shop/redact - Deletes shop data after uninstallation

9. Cookies and Tracking

Our App uses minimal cookies for:

• Session management
• Security (CSRF protection)
• Basic analytics (aggregated, non-personal)

We do not use third-party advertising trackers or behavioral profiling.

10. Children's Privacy

Our App is not intended for use by anyone under 18 years of age. We do not knowingly collect data from children.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States and India. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the App. The "Last Updated" date at the top indicates when this policy was last revised.

13. Data Breach Notification

In the unlikely event of a data breach that may affect your personal information, we will notify affected users within 72 hours as required by GDPR, and take immediate action to mitigate the impact.

14. Contact Information

15. Data Processing Addendum

For merchants requiring a formal Data Processing Addendum (DPA) for GDPR compliance, please contact us at legal@akestech.in.net. We provide a signed DPA upon request.