Privacy policy

Who we are

Easyback is a Shopify app operated by Kronomondo ("we", "us"). This policy explains what information the app collects when a merchant installs it, and what information it processes about the merchant's customers. Questions can be sent to [email protected].

Information about merchants

• Store details provided by Shopify at installation: shop domain, store name and the store's contact email.
• An access token issued by Shopify, used only to call the Shopify APIs on the store's behalf.
• The settings you configure in the app, such as return windows, eligibility rules and notification preferences.

Information about your customers

When a customer looks up an order or submits a return request, Easyback processes:

• The order number and the email address entered to find the order.
• Order details read from Shopify: the order's email address and the ordered items.
• Return request details: selected items, return reason, comments and requested resolution.

The app reads orders and creates returns through the Shopify Admin API with the permissions granted at installation (read orders, read and write returns, read products).

How we use information

Information is used only to provide the app: to show customers their eligible items, to create and track returns and exchanges in your store, to send the notifications you enable, and to support you when you contact us. We do not sell personal information, use it for advertising, or contact your customers for our own purposes.

Sharing and storage

Data is stored on servers located in the European Union (Germany). It is shared only with Shopify, as needed to operate the app, with infrastructure providers that host the service on our behalf, and with our email delivery provider for notifications you enable. We may disclose information if required by law.

Retention and deletion

• When you uninstall Easyback, Shopify notifies us and all data stored for your store is deleted within 48 hours of that notice.
• When Shopify forwards a customer's data deletion request, that customer's return data is deleted.
• Customer data access requests forwarded by Shopify are answered with the data we hold about that customer.

Security

All traffic is encrypted with HTTPS, access tokens and credentials are stored server-side only, and access to production systems is restricted to authorised personnel.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information (for example under the GDPR or KVKK). Merchants can contact us directly; customers should contact the store they purchased from, which can forward the request to us through Shopify.

Changes

We may update this policy as the app changes. The date at the top shows when it was last revised. If this translation differs from the English version, the English version applies.