Privacy Policy

Last updated: 2 October 2026

AppSaaz Returns & Exchanges ("the App", "we", "us") is a returns and exchanges application for Shopify stores, operated by Saaz. This policy explains what information the App processes, why, and the choices available to merchants and their customers. By installing or using the App you agree to this policy.

Who the data belongs to

The App processes data on behalf of the Shopify merchant who installs it (the "Merchant"). The Merchant is the controller of their store and customer data; we act as a processor providing the returns service.

Information we process

• Store data (via the Shopify API): order details, products and variants, and the customer's name, email, phone number and shipping address — used to look up orders, process returns, exchanges, refunds and store credit, book courier pickups from the customer's address, and ship replacement orders. Phone numbers and addresses are read from Shopify when needed and are not stored by the App.
• Return portal submissions: the order number, email, selected items, reason, optional comments, any photos a customer uploads, and product-usage information the customer provides.
• Bank details for Cash-on-Delivery refunds: when a Merchant offers refunds to a bank account for Cash-on-Delivery orders (which have no card payment to refund), the customer's account holder name, account number and bank code. These are encrypted before they are stored (AES-256-GCM) and shown only to the Merchant.
• Store staff: the name and email of staff members a Merchant adds under Users, to apply their roles and send them new-request alerts.
• Verification codes: one-time email verification codes, when a Merchant enables identity verification.
• Support chat: messages a Merchant's staff send us through the in-app chat, and our replies — used only to answer them. When a reply arrives while the chat isn't open, we email it to the store's contact address. Deleted with the rest of the store's data on shop redaction.
• Operational data: request status, timestamps, and logs needed to run and secure the service.

We do not collect payment card numbers. Refunds and payments are handled by Shopify.

How we use it

• To operate the returns and exchanges workflow you requested.
• To verify a customer's identity before showing order details (when enabled).
• To send transactional emails (verification codes and status updates) on the Merchant's behalf.
• To prevent fraud and abuse, and to secure and improve the service.

We do not sell personal information, and we do not use it for advertising.

Service providers

We share data only with providers that help us run the App:

• Shopify — the platform the App runs on and the source of store data.
• Fly.io — application hosting.
• Resend — transactional email delivery.
• Tigris — encrypted storage for database backups.
• Courier partners the Merchant connects (Shiprocket, Delhivery, Blue Dart) — only when the Merchant books a reverse pickup, and only the customer's name, phone number and pickup address needed for that pickup, sent using the Merchant's own courier account.

Uploaded photos are stored in the Merchant's own Shopify Files.

Data retention and deletion

We retain return-request data for as long as the App is installed and the data is needed to provide the service. We honour Shopify's mandatory data-privacy webhooks: on a customer redaction request we remove that customer's personal details (name, email, bank details, photos and store-credit codes) and keep only anonymous amounts and items the Merchant needs for its accounts; on shop redaction (after uninstall) we delete all of the store's data. Database backups are kept for a short period for disaster recovery and are replaced automatically. Merchants and customers may also request deletion by contacting us.

Security

Data is transmitted over encrypted connections (HTTPS) and access is limited to what is needed to run the service. Staff access to customers' personal data inside the App is logged. See our Security & Incident Response page for details. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data.

International transfers

Our providers may process data in regions outside your own. Where required, we rely on appropriate safeguards for such transfers.

Children

The App is for store operators and their adult customers and is not directed at children.

Changes

We may update this policy from time to time; the "last updated" date above reflects the latest version.

Contact

Questions or requests about this policy: support@getsaaz.app.