Legal
Privacy Policy
Effective date: January 1, 2026
1. Overview
This Privacy Policy explains how ReturnXchange ("we", "us") collects, uses, stores, and protects information when a Salla merchant installs our app and when that merchant's customers use the self-serve returns portal. By installing the app or submitting a return request, you agree to the practices described here.
2. Information we collect
From merchants, we collect store information and OAuth credentials granted through Salla during installation, configured return rules, and account/contact details for support. From customers, we collect order-verification details (such as order number and the email or phone associated with the order), the items and reasons selected for a return, any evidence uploaded (such as photos), and, where relevant to a refund method, banking details such as an IBAN.
3. How we use information
We use collected information to operate the returns and exchanges flow: verifying customer orders, applying merchant-configured rules, tracking a request through its lifecycle, executing refund, exchange, or store-credit outcomes against Salla where permissions allow, and maintaining the audit trail described in our product. We do not sell personal information.
4. Data security
OAuth tokens and other sensitive fields, including refund IBANs, are encrypted at rest using AES-256-GCM. Access to merchant and customer data is scoped to what is required to operate the app, and every approval, rejection, and resolution action is logged with who performed it and when.
5. Data retention
We retain return records and associated evidence for as long as a merchant's account remains active and as needed to satisfy audit, legal, and dispute-resolution obligations. Merchants may request deletion of their store's data after uninstalling the app, subject to any retention required by law.
6. Third-party sharing
We share data with Salla to the extent required to execute refund, exchange, and store-credit actions the merchant has authorized. We do not share personal information with other third parties except as required by law or to provide the service itself (for example, infrastructure and hosting providers under standard confidentiality obligations).
7. Your rights
Customers may contact the merchant they purchased from, or reach us directly via our contact page, to ask about the data held about a specific return request. Merchants may access, export, or request deletion of their store's data by contacting us.
8. Changes to this policy
We may update this policy as the product evolves. Material changes will be reflected on this page with an updated effective date.
9. Contact
Questions about this policy can be sent through our contact page.