Not legal advice. Not an official Shopify product.
ReturnAI stores return cases per shop: order name, customer email and name, photos you upload, policy decisions, and (for cash-on-delivery only) a UPI ID if the customer replies with one so the merchant can pay outside Shopify. We do not mix shops. We never store payment cards, bank account numbers, or CVV. App fees are billed to the merchant through Shopify Billing only.
Refunds of the original order stay in Shopify (Admin or Shopify refund APIs). Postage uses the merchant’s carrier account (EasyPost, Shippo, or similar), not a ReturnAI wallet.
Optional tools the merchant turns on may send data to Twilio or Meta (staff SMS/WhatsApp), SMTP (customer email), and photo-check providers (built-in matcher; optional Gemini/OpenAI if the merchant’s host has those keys).
Data is kept while the shop uses ReturnAI. Shopify GDPR webhooks (customers/data_request, customers/redact, shop/redact) export or delete matching personal data. After uninstall we drop the shop access token. Questions: use the support email on the Shopify App Store listing for ReturnAI (not an official Shopify product).
Retention: while the shop has ReturnAI installed. Shopify customers/redact and shop/redact delete matching personal data (including photos and COD UPI). After uninstall the shop access token is cleared. We do not claim a specific at-rest encryption product on Hostinger disks.
Support for the public listing: use the support email you publish on the Shopify App Store listing for ReturnAI. This page is not legal advice.