Privacy Policy
Returbo AB
Last updated: 2026
Version: 2.0
1. Introduction
1.1 Returbo AB, Swedish company registration number 559185-5738 ("Returbo", "we", "us", "our"), provides an app and platform for return management (together, the "Service") to merchants.
1.2 The Service is available in two forms:
- The Shopify app, installed from the Shopify App Store and connected to a merchant's Shopify-supported store.
- A standalone application, custom-built for and made available to a limited number of individual merchants. The standalone application processes the same categories of personal data as the Shopify app and is covered by this Privacy Policy in the same way. Because it does not connect through the Shopify API, it receives order and customer data either through a direct integration with the merchant's own system or through a file transfer or import arranged with the merchant.
1.3 This Privacy Policy explains how personal data is collected, used, shared and retained when you install or use the Service, when you visit our website at returbo.io, and when you otherwise interact with us.
1.4 We may update this Privacy Policy from time to time. The current version is always available at returbo.io. Where changes are material, we will notify merchants in advance through the Service or by email.
2. Our role: controller and processor
Returbo's responsibilities under the GDPR differ depending on whose data is being processed and why. This distinction matters, so it is set out first.
2.1 Where Returbo is a processor
Returbo acts as a processor in relation to the merchant for personal data belonging to the merchant's own customers, processed on the merchant's instructions for the purpose of delivering the Service. This includes end-customer names, contact details, addresses, order data and return data.
The merchant is the controller for this data. Returbo's Data Processing Agreement governs this processing and takes precedence over this Privacy Policy in the event of any conflict. A copy is available on request.
If you are an end customer who has made a return through a merchant using Returbo, the merchant is responsible for your data and you should direct requests to them in the first instance. We will assist the merchant in responding.
2.2 Where Returbo is a controller
Returbo acts as a controller for:
- personal data about merchant staff and store owners used to administer accounts, provide support, invoice and communicate about the Service;
- personal data collected through our website, marketing, newsletters, webinars and social media presence;
- technical and usage data used to secure, maintain and improve the Service;
- personal data processed to comply with our own legal obligations, including accounting.
Sections 4 and 5 describe this controller processing in detail.3. Personal data processed through the Service (processor role)
3.1 Data accessed from a merchant's Shopify store
When the app is installed, Returbo is able to access the following via the Shopify API:
- Customer data: name, email address, phone number, physical address.
- Device and activity data: geolocation, IP address, browser and operating system. Geolocation is received from Shopify as part of the store data; we do not collect location directly from an individual's device.
- Order data: orders belonging to the store, including order date and time, items ordered, and the information required to arrange shipping and to contact the customer.
- Product data: read-only access to products and variants belonging to the store.
Write access to orders is required in order to issue refunds, process exchanges and create return or replacement orders.
For merchants using the standalone application, equivalent data is received through a direct integration with the merchant's own system or through a file transfer or import arranged with the merchant, rather than through the Shopify API. The categories of personal data are the same.
3.2 Data generated by use of the Service
- Return and exchange data: return reasons, requested resolution, return status, exchange selections, and where applicable withdrawal (ångerrätt) declarations.
- Shipping and tracking data: shipping labels, tracking numbers, carrier events and return-to-sender status.
- Usage and analytics data: how merchants and end customers interact with the return portal and the merchant admin interface, including visitor and click statistics, used to deliver the Analytics functionality and to improve the Service.
- Technical data: IP address, browser and device details, and log data generated in the course of providing the Service.
3.3 Shopify-mandated privacy requests
We support Shopify's mandatory privacy webhooks. Where a merchant or Shopify submits a customer data request, customer redaction request or shop redaction request, we respond within the timeframes Shopify requires.
4. Personal data processed as controller
4.1 Visitors to returbo.io and our return portal
Purpose: to operate, secure and improve our website, measure how visitors use it, and enable interactive features such as contact forms.
Data: device type, operating system, browser version, IP address, time zone, cookie identifiers, referral source, pages viewed and interactions.
Legal basis: our legitimate interest in operating and improving our website and ensuring its security (Article 6(1)(f) GDPR); and your consent for non-essential cookies (Article 6(1)(a) GDPR and Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)).
Retention: web analytics data is retained for 14 months. Cookie durations are set out in our cookie policy.
4.2 Prospective customers who contact us, book a demo or start a trial
Purpose: to respond to your enquiry, deliver a demonstration of the Service, and evaluate whether Returbo is suitable for your business.
Data: name, email address, phone number, company name, role, store platform and store details, and the content of your enquiry.
Legal basis: our legitimate interest in responding to enquiries about our Service and in marketing to businesses (Article 6(1)(f) GDPR); steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Retention: we retain enquiry and lead data until you ask us to delete it or object to the processing.
4.3 Merchant account holders and users
Purpose: to create and administer merchant accounts, authenticate users, provide support, invoice for the Service, manage subscriptions and communicate about changes to the Service.
Data: name, business email address, phone number, business address, role, account and subscription details, and correspondence with us.
Legal basis: performance of our contract with the merchant (Article 6(1)(b) GDPR); compliance with legal obligations, in particular bookkeeping obligations under the Swedish Accounting Act (1999:1078) (Article 6(1)(c) GDPR); our legitimate interest in administering and securing the Service (Article 6(1)(f) GDPR).
Retention: for the duration of the merchant relationship and thereafter as set out in section 7.
4.4 Support correspondence
Purpose: to receive, investigate and resolve support requests, and to improve our documentation and the Service.
Data: name, email address, the content of your messages and any attachments, and information about the store and the issue reported.
Legal basis: performance of our contract with the merchant (Article 6(1)(b) GDPR); our legitimate interest in maintaining a record of support issues and improving the Service (Article 6(1)(f) GDPR).
Retention: support conversations are deleted after four (4) years without engagement.
4.5 Newsletter subscribers
Purpose: to send newsletters, product updates and marketing communications, and to tailor those communications to your role and business.
Data: name, email address, company and role, and email engagement data such as opens and link clicks.
Legal basis: your consent (Article 6(1)(a) GDPR); or our legitimate interest in marketing to existing customers about similar services (Article 6(1)(f) GDPR), subject to the Swedish Marketing Act (2008:486).You can withdraw consent at any time using the unsubscribe link in any message or by contacting us.
Retention: until you unsubscribe. We may retain a record of your unsubscribe request, and documentation of consent for up to two (2) years after the last communication, in order to demonstrate that marketing was lawfully sent.
4.6 Webinar and event registrants
Purpose: to register you for a webinar or event, deliver it, send related communications, and follow up afterwards. Some events are run jointly with partners.
Data: name, email address, company, role, registration and attendance data, and engagement with related emails.
Legal basis: performance of your registration request (Article 6(1)(b) GDPR); your consent for subsequent marketing (Article 6(1)(a) GDPR); our legitimate interest in marketing our Service (Article 6(1)(f) GDPR).
Retention: two (2) years after the webinar or event, or until you unsubscribe or object, whichever is earlier.
4.7 Visitors to our social media profiles
Purpose: to maintain a presence on third-party platforms and to respond to comments and messages.
Data: your profile name, contact details you choose to share, your professional information, and your interactions with our content.
Legal basis: our legitimate interest in presenting relevant content and responding to enquiries (Article 6(1)(f) GDPR).
Social media platforms are operated by third parties and process your data for their own purposes, which are outside our control and not covered by this Privacy Policy. Please review the relevant platform's own privacy policy.
5. Sub-processors and other recipients
5.1 Sub-processors
We use the following service providers, which act as sub-processors in relation to the merchant. By using the Service, the merchant provides a general authorisation for us to engage sub-processors necessary to provide the Service. We will inform merchants of intended changes to this list and give them the opportunity to object.
Google Cloud EMEA Limited
Type of service: Infrastructure, hosting and error monitoring
Place of processing: EU
Google Ireland Limited (Google Workspace)
Type of service: Sending return, exchange and withdrawal emails
Place of processing: EU
Intercom
Type of service: Merchant and end-customer support
Place of processing: EU
HubSpot
Type of service: Merchant communications and marketing
Place of processing: EU
Sentry (Functional Software, Inc.)
Type of service: Error and performance monitoring
Place of processing: EU and US
Google Ireland Limited (Google Analytics)
Type of service: Website analytics
Place of processing: EU
5.2 Artificial intelligence
We do not use artificial intelligence or machine learning vendors to process merchant or end-customer personal data as part of the Service, and we do not use such data to train AI models.
5.3 Carriers
Where the Service is used to generate return shipping labels, the personal data necessary for shipment (name, address, contact details, parcel details) is transmitted to the relevant carrier, including PostNord, DHL, FedEx, UPS and others depending on configuration.
Labels may be generated either under Returbo's own carrier agreements or under the merchant's, depending on how the merchant has configured the Service.
In both cases, carriers determine the purposes and means of their own processing of shipment data, in order to carry out transport, meet customs and tax obligations and comply with their own legal retention requirements. Carriers therefore act as independent controllers in respect of that data, and their own privacy policies apply to it. Where a label is generated under Returbo's carrier agreement, Returbo is responsible for transmitting the necessary shipment data to the carrier.
5.4 Other recipients
We may disclose personal data to professional advisers, auditors and authorities where required by law, and to a successor entity in connection with a merger, acquisition or sale of assets.
We do not sell personal data.
6. Transfers outside the EU/EEA
Our own infrastructure is hosted within the EU, and the personal data we process to deliver the Service is stored in the EU.
Where the Service is connected to a merchant's Shopify store, personal data is also processed by Shopify, which may process data outside the EEA. Shopify is engaged directly by the merchant under the merchant's own agreement with Shopify, not by Returbo, and that processing is governed by that agreement rather than by this Privacy Policy. Returbo reads data from, and writes data to, the merchant's Shopify store on the merchant's instructions.
Our error and performance monitoring provider, Sentry, processes data in both the EU and the United States. Where personal data is transferred to the United States, that transfer is made on the basis of Standard Contractual Clauses approved by the European Commission, together with supplementary technical and organisational measures. All other providers listed in section 5.1 process personal data within the EU.
You may request a copy of the relevant transfer documentation by contacting us.
7. Retention
7.1 We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or for as long as required by law.
7.2 On uninstallation or termination. If you uninstall the app or discontinue use of the Service, we delete your account and the personal data processed on your behalf within seven (7) days.
7.3 Backups. Personal data may persist in encrypted backups after deletion from live systems. Backups are overwritten on a rolling cycle of three (3) months, after which the data is no longer recoverable.
7.4 Accounting records. Invoicing and transaction records are retained for seven (7) years from the end of the financial year to which they relate, as required by the Swedish Accounting Act (1999:1078).
7.5 Aggregated data. We do not retain aggregated or anonymised statistics derived from a merchant's use of the Service after the merchant relationship ends.
8. Security
8.1 We maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
8.2 These measures include, but are not limited to, encryption, access controls on a least-privilege basis, staff confidentiality undertakings, and regular review.
8.3 In the event of a personal data breach, we will notify the relevant supervisory authority and affected controllers without undue delay, and in any case within the timeframes required by the GDPR and our Data Processing Agreement.
9. Your rights
Under the GDPR and the Swedish Data Protection Act (2018:218) you have the right to:
- Access the personal data we hold about you and receive information about how it is processed.
- Rectification of inaccurate or incomplete personal data.
- Erasure of your personal data in certain circumstances.
- Restriction of processing in certain circumstances.
- Object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
- Data portability: to receive personal data you have provided in a structured, commonly used and machine-readable format and to transmit it to another controller.
- Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise these rights, contact us using the details in section 11. Where we act as a processor on behalf of a merchant, we will forward your request to that merchant and assist them in responding.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, or with the supervisory authority in your country of residence.
10. Minors
The Service is provided to businesses and is not directed at children. We do not knowingly collect personal data directly from children.
Where an end customer of a merchant is a minor, any personal data relating to them is processed by us solely on the merchant's instructions and under the merchant's responsibility as controller.
11. Contact
Returbo AB
Company registration number: 559185-5738
Drottning Kristinas Väg 53
114 28 Stockholm
Sweden
Email: hello@returbo.io
