Privacy policy

Last updated: October 19, 2026

Introduction

ZenReturn ("we", "us", "our") operates a return management platform for Shopify merchants. This Privacy Policy explains what personal data we collect, how we use and share it, and your rights regarding that data. By using ZenReturn, you agree to the collection and use of information in accordance with this policy.

Information we collect

From Merchants: When you install ZenReturn, we collect your Shopify store name, store domain, and email address. Through Shopify OAuth, we access store data necessary for return processing, including orders, products, and customer information. Your subscription and any shipping label charges are billed by Shopify on your Shopify invoice; we never see or store your payment details.

From End Customers: When a customer submits a return request through a merchant's return portal, we collect their name, email address, order details, return reason, shipping address, and any photographs uploaded as part of the return request.

Automatically Collected Information: We automatically collect certain technical information when you visit our platform, including your IP address, browser type and version, device information, pages visited, and access timestamps.

How we use your information

We use the information we collect for the following purposes:

• Providing and operating the return management service
• Processing returns, exchanges, and refunds on behalf of merchants
• Generating shipping labels for return shipments
• Sending email notifications about return status updates
• Billing merchant subscriptions and shipping label usage through Shopify
• Improving, maintaining, and developing the service
• Complying with applicable legal obligations

Third-party services

We share data only as necessary with the following third-party service providers:

• Shopify — We access store and order data through the Shopify API to facilitate return processing, and Shopify bills merchants for the service.
• Railway — Hosts the ZenReturn application and its database in the United States.
• Cloudflare — Stores encrypted backups of the ZenReturn database.
• EasyPost and shipping carriers — We share the customer's name, shipping address and phone number with EasyPost and the chosen carrier to create return labels and track packages.
• Resend — Sends return confirmation and status emails to customers and merchants.
• Gorgias — Only for merchants who connect it: return details and the customer's notes are posted to the merchant's Gorgias helpdesk.

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

Data retention

We retain merchant and customer return data while the merchant has ZenReturn installed. When a merchant uninstalls the app, we stop accessing their store at once, and we delete all of their store's data — including their customers' return data — when Shopify sends us its shop redaction request, 48 hours after the uninstall. When Shopify sends a customer redaction request on a merchant's behalf, we delete or anonymize that customer's return data and photos. You may request deletion of your data at any time by contacting us at support@zenreturn.app. Encrypted database backups are kept for up to 14 days and then deleted.

Data security

We implement industry-standard security measures to protect your data, including:

• All data is transmitted via HTTPS/TLS encryption
• Shopify access tokens and connected-service credentials are encrypted at rest
• Staff access to customers' personal data in the merchant dashboard is recorded in an audit log
• Shopify OAuth scopes are limited to the minimum required for service operation
• Access controls and authentication are enforced for all internal systems
• Regular security reviews and vulnerability assessments

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

Your rights

GDPR (European Union): If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation: the right to access your personal data, the right to rectify inaccurate data, the right to erasure (right to be forgotten), the right to restrict processing, the right to data portability, and the right to object to processing of your personal data.

CCPA (California): If you are a California resident, you have the following rights under the California Consumer Privacy Act: the right to know what personal data is collected about you, the right to request deletion of your personal data, the right to opt-out of the sale of your personal data (note: we do not sell personal data), and the right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, please contact us at support@zenreturn.app. We will respond to your request within 30 days.

Cookies

We use essential session cookies for authentication and maintaining your session while using ZenReturn. These cookies are strictly necessary for the operation of the service. We do not use third-party tracking cookies or advertising cookies. Because we only use strictly necessary cookies, no cookie consent banner is required.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date at the top. For significant changes, we will notify registered merchants via email at least 30 days before the changes take effect.

Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@zenreturn.app.