Privacy Policy — Easy Returns

Last updated: 19 July 2026

This Privacy Policy explains how Advera LLC FZ ("Advera", "we", "us") processes personal data in connection with the Easy Returns Shopify application ("App"). It applies to two groups: (i) Shopify merchants who install the App ("Merchants") and (ii) end-customers of those merchants who use the public withdrawal portal ("End-customers").

Contact: support@easyreturns.dk

---

1. Controller and roles

• Merchant account data (shop domain, admin email, billing status, settings): Advera is the controller.
• End-customer data processed through a Merchant's portal (order number, email, withdrawal reason, selected line items): the Merchant is the controller and Advera is the processor, acting on the Merchant's documented instructions as reflected in these terms and in the App's configuration.

2. Data we process

• From Merchants (on install and use):
• Shop domain and Shopify shop ID
• Shopify OAuth access token (encrypted at rest)
• Admin user identifier and email
• Billing plan, trial status, and usage counters
• Branding and cancellation-rule settings you configure

• From End-customers (via the portal):
• Order number and email address (used to verify the order)
• Optional reason for withdrawal
• Selected line items and quantities
• The status of the resulting cancellation or return request

• Technical data (automatically):
• IP address, user-agent, and request timestamps — used only for security, rate-limiting, and abuse prevention
• Application logs and error identifiers

We do not process payment card data. All billing is handled by Shopify.

3. Purposes and legal bases (GDPR Art. 6)

| Purpose | Legal basis | |---|---| | Providing the App to the Merchant | Contract (Art. 6(1)(b)) | | Processing End-customer withdrawal requests | Contract with Merchant / processor role (Art. 28) | | Security, fraud prevention, rate-limiting | Legitimate interest (Art. 6(1)(f)) | | Billing and record-keeping via Shopify | Legal obligation (Art. 6(1)(c)) | | Product improvement (aggregated logs) | Legitimate interest (Art. 6(1)(f)) |

4. Sub-processors

We use only the platforms strictly required to run the service:

| Sub-processor | Purpose | Region | |---|---|---| | Shopify (Shopify Inc.) | Source of order data; handles billing and payment | Global (per Shopify's DPA) | | Lovable Cloud / Supabase | Application hosting and database | EU | | Cloudflare | Edge network and DDoS protection | Global edge |

No other third parties receive personal data.

5. International transfers

Application data is stored in the EU. Advera LLC FZ is established in the United Arab Emirates; where personal data is accessed by our staff from outside the EEA, transfers are covered by the European Commission's Standard Contractual Clauses and appropriate supplementary measures. Shopify and Cloudflare rely on their own transfer mechanisms as described in their public DPAs.

6. Retention

• Merchant and End-customer data is retained for as long as the App is installed on the Merchant's Shopify store.
• On uninstall, Shopify sends a `shop/redact` webhook after 48 hours; all shop data is then hard-deleted from our database.
• On a `customers/redact` webhook from Shopify, we anonymize matching End-customer records (email replaced, reason cleared) within 30 days.
• Security logs are retained for up to 90 days.

7. Security

• All traffic is encrypted in transit (TLS).
• Database access is protected by row-level security policies scoped to the owning shop.
• Shopify webhooks are verified via HMAC before any write.
• Secrets and OAuth tokens are stored server-side only and never exposed to the browser.
• Access to production data is restricted to authorised Advera personnel.

8. Your rights

Data subjects have the following rights under the GDPR: access, rectification, erasure, restriction, portability, and objection, as well as the right to lodge a complaint with a supervisory authority (in Denmark: Datatilsynet).

• End-customers should send requests to the Merchant they purchased from; the Merchant is the controller. Advera will assist Merchants in fulfilling verified requests.
• Merchants can contact us directly at support@easyreturns.dk.

Shopify's built-in `customers/data_request` and `customers/redact` webhooks are honoured automatically.

9. Cookies and similar technologies

The public withdrawal portal does not use tracking cookies. The embedded merchant admin uses only strictly necessary session storage required by Shopify App Bridge. No advertising or analytics cookies are set.

10. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects on data subjects.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be notified via the App admin or by email.

12. Contact

Advera LLC FZ Email: support@easyreturns.dk Website: https://easyreturns.dk