Privacy Policy

1. Overview

Pleero (“we,” “us,” “our”) is return and refund abuse protection for Shopify. It scores each return request against the merchant's own order history, explains the score in plain language, and recommends — or, where the merchant has turned it on, takes — an action before money leaves the business.

What Pleero does today. When a customer requests a return, Pleero scores it and shows the result on the order page and the customer page in the merchant's Shopify admin. The merchant chooses what happens for each risk band: approve, add a tag to the customer in Shopify, ask for a photo, hold it for review, or — only if the merchant turns these on, and never for a return the customer has a legal right to — restrict the refund to store credit or decline the return. Pleero also offers a read-only back-test of past orders, a weekly email summary, and a Shopify Flow trigger.

Scoring of delivery (“item not received”) claims and any sharing of signals between merchants are not live. This policy describes what we collect and do today, and will be updated before either is introduced.

2. Data We Collect

About merchants

• Store identifier: your shop domain (e.g. yourstore.myshopify.com)
• Access token: a Shopify access token, encrypted at rest, used to authenticate API requests on your behalf
• Contact email: the email address on your Shopify account, used for service communication and the weekly summary email
• Settings and plan: your risk thresholds, the action chosen for each band, your allow-list (Shopify customer IDs or customer tags), your plan, and a count of scored return requests for billing

About your customers

Pleero reads customer and order data from Shopify through its API, within the access Shopify grants us. We store only what scoring needs, keyed by Shopify's numeric customer ID:

• Derived figures: counts of each customer's orders, returns, and refunds, the amounts involved, and the dates of their first and most recent order and return
• Decision records: for each return Pleero scores — the order and return reference, the return reason the customer gave, the items being returned (product name and ID), the shipping country (used only to decide whether the return is legally protected), the score, its reasons, the rule and policy versions used, the recommended and applied action, who acted, and when, and whether the customer was set to review by a person (section 6). Pleero reads the customer's Shopify tags to check this and to apply tag-based allow-list entries, but does not store the tags.
• Your reviews: your confirm or dismiss decision on a customer Pleero flagged
• Item photos: if you send a customer a Pleero photo-request link and they use it, the single photo they upload

We do not store customer names, email addresses, phone numbers, or street addresses. Customers are shown to you by ID and through Shopify's own pages. Pleero never contacts your customers: a photo-request link is a link you send yourself, through your own email or helpdesk.

About visitors to pleero.app

Our website uses Google Analytics to measure visits, which sets cookies and collects information such as pages viewed, device and browser type, and approximate location. If you gave us your email through an earlier version of this website's sign-up form, we store that email address and the form you used, and nothing else about you.

3. What We Don't Do

• We do not sell personal information to anyone.
• We do not send merchant or customer data to advertising or analytics platforms. Google Analytics runs on our public website only, not inside the Pleero app.
• We do not duplicate your Shopify order, product, or customer records — Shopify remains the source of truth, and we store only what is described above.
• We do not use your customers' data for advertising, and we do not share it with other merchants.
• We never show your customers a score, a risk band, or the reasons behind them.

4. Third-Party Services

Operating Pleero involves these providers:

• Shopify Inc. — the platform Pleero runs inside. If you use Pleero's Shopify Flow trigger, Pleero passes the Shopify customer ID, score, band, and recommended action to your own Flow workflows. Subscription charges are billed through Shopify. See shopify.com/legal/privacy.
• DigitalOcean LLC — hosts our backend and database. See digitalocean.com/legal/privacy-policy.
• Cloudflare Inc. — DNS, CDN, and DDoS protection in front of our infrastructure. See cloudflare.com/privacypolicy.
• Vercel Inc. — hosts the pleero.app website and the pages inside the app. See vercel.com/legal/privacy-policy.
• Resend — delivers our emails to merchants, including the weekly summary, so it receives your contact email and the email's contents. See resend.com/legal/privacy-policy.
• Functional Software, Inc. (Sentry) — error monitoring for our backend, configured not to send personal information. See sentry.io/privacy.
• Google LLC (Google Analytics) — visit measurement on our public website only. See policies.google.com/privacy.

We will add to this list, and provide Data Processing Agreements on request, before any new sub-processor handles your data — not after.

5. Security

• Shopify access tokens are encrypted at rest (Fernet/AES-256), never stored in plain text.
• All traffic uses HTTPS.
• Every webhook Shopify sends us is cryptographically verified (HMAC) before we act on it.
• Our database and cache are never exposed outside our private network.
• Photo-request links use long random tokens, so one customer's link cannot be used to find another's.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Automated Decisions and Human Review

Pleero scores returns using a fixed set of readable rules based only on what a customer has done at the merchant's store — never on who they are. It does not use machine learning. Every score comes with the reasons behind it, and every decision is recorded so it can be explained later.

• A score is a recommendation. An action happens automatically only for a risk band the merchant has set to “Run automatically”; otherwise it waits for the merchant.
• Out of the box, nothing is declined automatically. Restricting a refund to store credit or declining a return happens only if the merchant explicitly turns it on, after a warning that their published return policy must support it.
• Pleero never restricts or declines a return where the customer has a legal right to a refund — for example a defective or not-as-described item, or a return inside a statutory withdrawal period. Those are held for a person to review instead. Where Pleero is unsure, it treats the return as protected.
• The merchant can override any decision; an override is recorded, never hidden.

The merchant decides what happens to a return and is responsible for their return policy. A customer who disagrees with a decision should contact the merchant, who can review and reverse it.

Review by a person instead. A customer can ask the merchant to have their returns reviewed by a person rather than automatically. The merchant turns this on by adding the tag pleero-manual-review to that customer in Shopify. From then on, Pleero takes no automatic action on that customer's returns, including through the merchant's Shopify Flow workflows. Each return waits in the merchant's review queue for a person to decide. If Pleero cannot check a customer's tags, it treats the return the same way.

7. Data Retention

Your shop domain, access token, contact email, and settings are kept while you have Pleero installed. Uninstalling triggers Shopify's mandatory shop/redact webhook roughly 48 hours later, at which point we delete your merchant record and everything held under it, including derived figures, decision records, reviews, and item photos. An email submitted through our website is kept until we reach out or you ask us to remove it.

When Shopify tells us a customer has asked for their data to be erased (customers/redact), we delete that customer's derived figures, your reviews of them, and any photo they uploaded, and strip the customer identifier from their decision records, which we keep only as an anonymous record of what was calculated.

If no one has opened Pleero for your store for 13 months, a scheduled job deletes the derived figures, back-test results, and your reviews automatically. If you open the app again, Pleero re-reads your order history and rebuilds what it needs.

Decision records are kept for 24 months after Pleero records them, so you have a record of what happened. After that, the same daily job strips the customer identifier, the return reference, and the scoring inputs, exactly as for an erasure request above. What remains is an anonymous record of the score, reasons, and action. Any photo-request link for that return is deleted with it.

A photo a customer uploads through a photo-request link is deleted 90 days after they upload it.

8. Your Rights

You can ask us what data we hold about you, request its correction, or request its deletion, by emailing privacy@pleero.app. We will respond within 30 days. If you are a customer of a store that uses Pleero, the store is responsible for your data and the quickest route is to ask the store; Shopify forwards erasure requests to us, and we act on them as described above. Depending on where you live, you may have additional rights under laws such as the GDPR, UK GDPR, or CCPA — we intend to honor them, and we will publish a jurisdiction-by-jurisdiction breakdown once we have taken the legal advice necessary to state it accurately rather than guess.

9. Changes to This Policy

We will update this page as Pleero's actual capabilities change, and update the date above when we do. This document is product context, not a substitute for professional legal advice, and nothing here should be read as a permanent legal commitment beyond what the current version states.

10. Contact

Email privacy@pleero.app with any question about this policy or your data.