Loopback

Privacy Policy

Last updated August 23, 2026

Loopback is a returns app for Shopify stores. This page describes exactly what data the app touches. It is written to be specific rather than broad — if something is not listed here, the app does not collect it.

What we store about a merchant

  • Your .myshopify.com domain, store name, contact email, and currency
  • An access token issued by Shopify so the app can look up orders on your behalf
  • Your selected plan

What we store about your customers

Only when a customer submits a return request through your returns page:

  • Order number and order total
  • The email address they entered
  • The return reason they selected and any note they wrote
  • The status of the request and your decision note

What we deliberately do not do

  • We never read customer names, addresses, or phone numbers from Shopify. Order lookup is matched by Shopify on its side — the app sends the order number and email together and receives only a match or no match.
  • We do not sell, rent, or share data with advertisers or data brokers.
  • We do not use your data to train machine-learning models.
  • We do not track customers across sites, and set no advertising cookies.

Abuse prevention

To stop attackers guessing real order numbers, the app records a one-way hash of the IP address for each lookup attempt. The raw IP is never written to the database, the hash cannot be reversed, and these records are deleted automatically after 24 hours.

Cookies

One cookie is set: a signed session cookie identifying your store so the merchant dashboard knows who you are. It contains no personal data and is not used for tracking.

Sub-processors

  • Supabase — database hosting (EU region, Frankfurt)
  • Cloudflare — application hosting and edge network
  • Brevo — delivery of return status emails
  • Shopify — order data and billing

Retention and deletion

  • Return requests are kept while the app is installed, so you have a record of decisions.
  • Uninstalling the app immediately invalidates your access token.
  • The app implements Shopify’s mandatory privacy webhooks. On acustomers/redact request the customer’s email and notes are erased from your store’s records; on shop/redact all data for your store is deleted.
  • Lookup-attempt hashes are purged after 24 hours.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your data. Email returnloopback@gmail.com and we will respond within 30 days. Customers should contact the store they bought from — the merchant controls that data and we act on their instructions.

Changes

If this policy changes in a way that affects what we collect, we will update the date above and notify installed merchants by email before the change takes effect.