Privacy policy

Rechange is a Shopify app that automates returns and exchanges for online stores: a return portal for customers, shipping labels, refunds, exchanges and store credit, and status emails. This policy explains which personal data the app processes, why, who it is shared with and how long it is kept.

Who we are

The app is published by Rechange. For any question about your data or to exercise your rights, email us at bonjour@rechange.app.

Our two roles

• For merchant data (the store that installs Rechange and its staff), Rechange is the data controller.
• For the merchants' customers' data (the people who make a return), the merchant is the controller and Rechange acts as a processor under Article 28 GDPR: we process this data only on the merchant's behalf and on their instructions, that is, to handle their returns.

If you are a customer of a store and want to exercise your rights, please contact the store you ordered from first. You can also email us and we will forward your request to the merchant.

Merchant data

When you install Rechange, we receive from Shopify and store:

• store information: name, domain, contact email, currency, language and subscription plan;
• information about the user signed in to the admin, provided by Shopify: first and last name, email, language;
• the Shopify API access tokens the app needs to work;
• your settings: return policy, reasons, portal appearance (logo, colours), email copy, warehouse return address;
• credentials for your carrier accounts (Mondial Relay, Colissimo, Sendcloud) and API keys for the tools you connect (Klaviyo, Brevo), encrypted with AES-256-GCM and never displayed again.

We use this data to provide the service, to contact you about your account (support, incidents, important changes) and to bill usage through Shopify.

Merchants' customer data

When a customer requests a return, the app reads their order from Shopify and stores, only for returns created through Rechange:

• identity and contact details: name, email, postal address and, if present on the order, phone number;
• the order: number, date, delivery date, items and variants, prices;
• the return: returned items, reasons, free-text comment and any photos, chosen outcome (refund, exchange, store credit), status;
• shipping: label or QR code, tracking number and carrier tracking events;
• the history of emails sent to the customer (template, recipient, date).

This data is used only to:

• check which items can be returned under the merchant's policy and French law (14-day withdrawal right);
• create the return in Shopify, then issue the refund, exchange or store credit;
• generate the return label: name, address and phone are printed as the sender and passed to the carrier;
• send the customer transactional emails about their return (request received, label, parcel received, refund or exchange completed);
• let the merchant follow and process their returns in the app.

We do not sync the store's customer list, we do not use this data for advertising or profiling, and we do not sell or rent it. The return portal sets no cookies and contains no trackers.

Legal bases

• Performance of the contract with the merchant: providing the app and support.
• Legal obligation: invoicing, keeping accounting records, handling the withdrawal right and the legal guarantee of conformity.
• Legitimate interest: app security, abuse prevention, improving the service from aggregated statistics.
• For customer data, the legal basis is the merchant's, usually performance of the sales contract and their legal return obligations.

Sub-processors and recipients

We share data only with the providers the service needs:

If the merchant connects Shopify Flow, Klaviyo or Brevo, return milestones (with the customer's email and the return reference) are sent to those tools, on the merchant's account and at their request. Those tools then act on the merchant's behalf.

Some providers belong to groups established outside the European Union (Railway and Resend in the United States, Shopify in Canada). Where a transfer outside the EU may occur, it is covered by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Retention

• Customer data: kept while the return is open, then automatically anonymised 24 months after the return is closed, the length of the legal guarantee of conformity. Anonymisation erases the name, email, address, phone, comments, photos and labels; only non-identifying business data remains (items, amounts, statuses).
• Erasure requests: when Shopify sends us a customer erasure request (customers/redact), that customer's returns are anonymised right away.
• Uninstall: store data is kept for 48 hours in case of reinstallation, then deleted when Shopify sends the store erasure request (shop/redact).
• Backups: encrypted daily copies, stored in the European Union and erased as they rotate.
• Accounting: the subscription is billed by Shopify; our accounting records (payments received) are kept for 10 years, as French commercial law requires.

Security

• Encrypted connections (HTTPS/TLS) between the browser, the app, the database and our providers.
• Carrier credentials and API keys encrypted with AES-256-GCM.
• Signed, time-limited portal links; every return request is re-validated on the server.
• Access to production data limited to the people who need it to run the service, with two-factor authentication on admin accounts.
• Test and production data kept apart: no production data is copied to development environments.
• In the event of a data breach, we inform affected merchants without undue delay and within 72 hours at the latest.

Your rights

Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data. Email us at bonjour@rechange.app; we reply within one month.

Merchants' customers can also go through the store: Shopify forwards access requests to us (customers/data_request), and we give the merchant an export of the customer's return data so they can reply.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with your local supervisory authority.

Changes

We may update this policy, for example when we add a carrier or a provider. The date of the last update is shown at the top of the page; for significant changes, we notify merchants by email.