Effective 28 October 2026. Applies to the Reflow Returns & Exchanges app for Shopify ("Reflow", "the app"), operated by Value Creatives ("we", "us"), a software company, website valuecreatives.com.
Reflow helps Shopify merchants ("merchants") accept returns and exchanges from their customers ("customers"). This policy explains what personal data the app handles, why, where it goes and for how long. It applies to merchants who install the app and to customers who use a merchant's returns portal.
For customer data, the merchant is the data controller and Value Creatives is a data processor acting on the merchant's instructions through the Shopify platform. For merchant account data (store name, staff email, settings, billing plan), Value Creatives is the controller.
| Data | Source | Purpose |
|---|---|---|
| Order number, items, prices, fulfilment status | Shopify Admin API | Show returnable items, calculate refunds and fees, create the return in Shopify |
| Customer name, email, phone, shipping address | Shopify Admin API | Verify the customer owns the order, email them, create return labels and courier pickups |
| Return reason, notes, chosen resolution, tracking numbers | Entered by the customer or merchant | Process the request and show its status |
| Payment status of exchange invoices | Shopify webhooks | Know when a balance has been paid. We never receive card details. |
| Shipping platform credentials (API keys) | Entered by the merchant | Buy labels on the merchant's own account. Stored encrypted (AES-256-GCM). |
| Store domain, staff email, settings, active plan | Shopify | Run and bill the app |
We do not collect payment card data, passwords for Shopify accounts, or data from the customer's device beyond what the browser sends to load a page. The customer portal sets no tracking cookies.
We process claim photos to let the merchant review damaged, defective or wrong-item requests. Photos are stored in encrypted, private Amazon S3 storage in the United States and accessed through authenticated application links, rather than public Shopify Files. Unsubmitted uploads are scheduled for deletion after 24 hours; linked photos are scheduled for deletion 90 days after completion, refund, decline or cancellation. Verified privacy-deletion requests can trigger earlier deletion.
Store-credit records include the selected refund method, accepted bonus/expiry policy, amounts and Shopify transaction reference. Transactional notification records include recipient, message content and provider acceptance status. Configured email is processed through Amazon SES in India. These notifications are operational and are not marketing emails.
Customer-data exports can include short-lived private photo-download links. The merchant must download and deliver the requested evidence through verified support before marking a data request fulfilled.
We do not sell personal data, use it for advertising, or share it with anyone else.
Reshop/redact request 48
hours later and we delete the store's data, including encrypted credentials, within 30
days.
customers/redact and we anonymise that customer's return records.
customers/data_request;
the merchant can export the records from the app and we assist on request.
Data is encrypted in transit (TLS). Shipping credentials are encrypted at rest. Access to production systems is limited to Value Creatives staff who need it to operate the app. Customers access their request status through signed, expiring links. Merchants access the app through Shopify's authenticated admin.
Depending on where you live (including under the GDPR, UK GDPR, CCPA/CPRA and India's DPDP Act), you may have the right to access, correct, delete or export your personal data, or object to its processing. Customers should contact the merchant they bought from, who controls the data and can instruct us. Merchants and anyone else can contact us directly at info@valuecreatives.com. We respond within 30 days.
The app may be hosted in a region different from yours. Where data moves across borders we rely on the safeguards available under the applicable law, such as standard contractual clauses.
The app is for merchants and their adult customers. We do not knowingly process data about children under 16.
We will post changes on this page and update the effective date. Material changes are also announced inside the app.
Value Creatives Tech Solutions LLP · First Floor, A-38, Sector 36, Noida, Uttar Pradesh 201301, India · +91-8130628030 · info@valuecreatives.com · valuecreatives.com