Privacy Policy

Last updated: 9 July 2026

Yoyo (“we”, “us”, or “our”) operates the Yoyo returns platform at yoyoreturns.com and the associated Shopify application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our service.

1. Information We Collect

1.1 Information You Provide

  • Account data: When you install our Shopify app, we receive your Shopify store name, store URL, email address, and OAuth access tokens necessary to operate the service.
  • Contact data: If you email us, subscribe to our newsletter, or submit a support request, we collect your name and email address.
  • Payment data: Billing is handled entirely by Shopify. We do not directly collect or store credit card numbers.

1.2 Information We Collect Automatically

  • Shopify store data: To provide our service, we access order data, product data, customer data, and fulfilment data from your Shopify store via the Shopify API. This data is processed solely to facilitate the returns and exchanges functionality you configure.
  • End-customer data: When a customer of your store uses the Yoyo returns portal, we process their name, email address, order number, return reason, and shipping information. This data is processed on your behalf as a data processor.
  • Usage data: We collect anonymised analytics (page views, feature usage) via Plausible Analytics, which does not use cookies and does not track individuals.
  • Log data: Our servers automatically record IP addresses, browser type, and request timestamps for security and debugging purposes. These logs are retained for 30 days.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Yoyo service
  • Process returns, exchanges, and refunds on your behalf
  • Generate shipping labels and communicate tracking updates
  • Send you service-related communications (e.g. onboarding emails, status updates)
  • Respond to your enquiries and provide customer support
  • Detect and prevent fraud, abuse, or security incidents
  • Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising or profiling beyond what is necessary to provide the service.

3. AI Processing

Yoyo uses AI (powered by Anthropic’s Claude) to categorise return reasons, suggest exchanges, and evaluate return eligibility. When AI features are enabled by the merchant:

  • Return reason text, the customer’s name, and order metadata (items, order value, purchase date, and return history) may be sent to Anthropic’s API for processing
  • Photos uploaded by the customer (for example, of damaged items) are analysed by the AI provider when photo-based features are enabled
  • The customer’s email address, postal address, and phone number are never sent to the AI provider
  • AI inputs are not used to train third-party models (per Anthropic’s commercial API terms)
  • Merchants can disable AI features at any time from the Yoyo settings page

4. Data Sharing

We share your data only with the following categories of third parties, and only as necessary to provide the service:

  • Shopify: As a Shopify app, we operate within the Shopify platform and exchange data via the Shopify API.
  • Shipping carriers: When you generate return labels, we share the necessary shipping details (addresses, parcel dimensions) with the selected carrier (PostNord, Bring, Quiqup, Aramex, or Sendcloud, depending on your carrier configuration and the customer’s region).
  • AI provider: Return data as described in Section 3 (including the customer’s name and any photos they upload) may be processed by Anthropic (Claude) when AI features are enabled.
  • Communications providers: Where return status emails or WhatsApp notifications are enabled, we share the customer’s contact details and message content with our email provider (Klaviyo) or WhatsApp provider (Twilio), solely to deliver those messages.
  • Infrastructure providers: We use industry-standard hosting and database providers to run the service. All providers are bound by data processing agreements.

We do not share data with advertisers, data brokers, or any other third parties.

5. Data Retention

  • Account data: Retained for the duration of your subscription, plus 30 days after cancellation to allow for reactivation.
  • Return and order data: Automatically deleted 12 months after the return is closed (refunded, denied, or cancelled), unless a longer period is required by applicable law.
  • Log data: Retained for 30 days.
  • Newsletter subscriptions: Retained until you unsubscribe.

You may request deletion of your data at any time by emailing hello@yoyoreturns.com.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption in transit (TLS 1.2+) and at rest
  • Access controls and authentication for all internal systems
  • Regular security reviews and dependency auditing
  • Shopify OAuth 2.0 for secure API access (we never store your Shopify password)

7. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict certain processing
  • Data portability
  • Withdraw consent (where processing is based on consent)

To exercise any of these rights, contact us at hello@yoyoreturns.com.

8. Cookies

The Yoyo marketing website (yoyoreturns.com) does not use tracking cookies. We use Plausible Analytics, which is cookie-free and does not collect personal data.

The Yoyo app (embedded in Shopify admin) uses session cookies strictly necessary for authentication. These are first-party, httpOnly, and expire when you close the browser.

9. International Transfers

Your data may be processed in the United Kingdom and the European Economic Area. Where data is transferred outside these regions (e.g. to US-based infrastructure providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children

Yoyo is a business-to-business service and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Yoyo
Email: hello@yoyoreturns.com
Stow-on-the-Wold, United Kingdom