Privacy Policy

Last updated: November 10, 2026

ReturnRoom ("the app") is a returns and exchanges app for Shopify stores, operated by Fulfil-It ("we", "us"). This policy explains what information the app handles when a merchant installs it and when a merchant's customer uses the returns portal, and what we do with it.

Who is responsible for the data

For customer data handled through the app, the merchant (the store that installed ReturnRoom) is the data controller and we act as a processor on the merchant's behalf. For information about merchants themselves (store details and staff accounts), we are the controller.

Information we collect

From the merchant's Shopify store

Store details: store name, myshopify domain, primary domain, contact email, country, currency, timezone and address.
Staff identity for the people who open the app (name and email, as provided by Shopify), used to authenticate them.
Orders that a return is opened for: order number, line items, prices, discounts, fulfilment dates, payment method name, and shipping and billing address.
Products, variants, inventory levels and locations, to offer exchanges and restock returned items.

From the merchant's customers, through the returns portal

Order number and email address, to find the order.
Name, address and phone number for the return.
The items being returned, the reason, any comments and any photos the customer uploads.
Tracking number and carrier, if the customer provides them.
Bank details (bank name, account holder, account number), only when the merchant refunds by bank transfer and the customer chooses to provide them. Account numbers are encrypted at rest.
IP address, used briefly for rate limiting and abuse prevention; it is not stored with the return.

The app does not use tracking or advertising cookies, and the returns portal sets no cookies.

How we use information

To let customers request returns and follow their status.
To let merchants review, approve, receive and complete returns, including creating refunds, store credit and exchanges in Shopify on the merchant's instruction.
To send return-related emails to customers and alerts to the merchant.
To show the merchant reports about their own returns.
To bill the merchant through Shopify and to provide support.
To keep the service secure and to fix problems.

We do not sell personal information, we do not use customer data for advertising, and we do not use it to train machine-learning models.

Who we share it with

We use a small number of service providers to run the app. They process data only on our instructions:

Provider	Purpose	Data
Shopify	The platform the app runs on; orders, refunds, store credit, billing	Order and customer data already held by Shopify
Google Cloud Platform	Application and database hosting	All app data
Cloudflare R2	File storage	Photos customers upload and shipping labels merchants attach
Resend	Sending email	Recipient email address, name and the content of return emails

We may also disclose information where the law requires it.

Where data is stored

The app's servers and database are hosted in Singapore. Files are stored with Cloudflare and email is sent through Resend, which may process data in other countries. Where data is transferred internationally we rely on our providers' standard contractual safeguards.

How long we keep it

Return records are kept while the merchant has the app installed, so the merchant has a history of their returns.
Customer photos are deleted automatically after the retention period the merchant sets (120 days by default) once a return is completed or cancelled. Uploads that never became part of a return are deleted after two days.
When a merchant uninstalls the app, all of that store's data — returns, photos, labels and settings — is deleted within 48 hours, when Shopify sends the shop redaction request.
When Shopify sends a customer redaction request, that customer's name, contact details, address, bank details, photos and labels are erased from the store's returns.

Security

All traffic is encrypted in transit (HTTPS).
Bank account numbers are encrypted at rest with AES-256-GCM.
Uploaded files are private; they are only reachable through short-lived signed links.
Each store's data is separated from every other store's, and access to production systems is limited to the people who need it.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to or restrict how it is used (for example under the GDPR, UK GDPR or CCPA).

Customers of a store: please contact the store you bought from. They control your data and can act on your request; we help them do so and respond to the requests Shopify forwards to us.
Merchants: contact us at hello@fulfil-it.com.

You also have the right to complain to your local data protection authority.

Children

The app is a business tool and is not directed at children.

Changes to this policy

If we change this policy we will update the date above, and tell merchants in the app or by email when a change is significant.

Contact

Fulfil-It — hello@fulfil-it.com