Privacy Policy

Last updated: April 4, 2026

Radrly sp. z o.o. ("we", "us", or "our") operates the SafeRadar AI Shopify application (the "App"). This Privacy Policy describes how we collect, use, and share information when you install and use the App on your Shopify store.

By installing the App, you agree to the collection and use of information in accordance with this policy. For complete terms governing use of the App, please refer to our Terms of Service.

1.1 Store and Merchant Data

When you install the App, we collect the following information from your Shopify store:

• Store domain and Shopify store identifier
• Store owner name and email address
• Store currency and plan information
• OAuth access token required to authenticate API requests

1.2 Customer Withdrawal Requests

When a customer submits a withdrawal request through the App's storefront widget or when you submit one manually on a customer's behalf, we collect:

• Customer email address
• Order identifier (order number)
• Date and time of the submission
• Source of the request (storefront widget or manual entry)

This data is stored solely to allow you to fulfil your obligations under EU Directive 2011/83/EU (Consumer Rights Directive) and for audit purposes.

1.3 Email Configuration Data

Merchants may configure email sender settings within the App, including a custom subject-line prefix and footer text appended to automated customer emails. These settings are stored per store and contain no personal data unless you choose to include it (e.g., a contact email address in your footer).

We use the information collected to:

• Provide, operate, and maintain the App and its features
• Process and log withdrawal requests submitted by your customers
• Display your store's compliance dashboard and request history
• Send transactional communications related to the App (e.g., error alerts)
• Improve, personalize, and expand the App's functionality
• Comply with applicable legal obligations

We do not sell, rent, or trade your data or your customers' data to any third party.

SafeRadar uses OpenAI as an external AI service provider to power the AI Summaryand AI Support Chat features. When these features are used, we may share a limited subset of store-level and request-level metrics (e.g., counts, trends, and product aggregates) or specific support queries with the AI provider solely to generate the feature output.

We use AI-generated responses to help merchants understand return activity more quickly and to provide instant support for application features and compliance regulations. These summaries and chat responses are informational and operational only and are not intended to replace your own review of the underlying data.

The external AI provider acts as a service provider / sub-processor for these features. Its own terms and privacy practices apply to the data it processes on our behalf.

If you are located in the EU or EEA, our legal basis for processing personal data is as follows:

• Contract performance — processing is necessary to provide the App service you have installed.
• Legitimate interests — improving the App, ensuring security, and preventing fraud.
• Legal obligation — storing withdrawal request records to help you comply with EU Directive 2011/83/EU.

We do not share personal data with third parties except in the following limited circumstances:

• Service providers and sub-processors: We use the following services to operate the App:
  • Supabase, Inc. — Database, authentication, and edge function hosting (EU: Frankfurt, Germany)
  • SMTP provider (configurable per installation) — Transactional email delivery (withdrawal confirmations, status updates)
  • Cloudflare, Inc. — CDN and DDoS protection (EU / Global with Standard Contractual Clauses)
  These processors are contractually bound to protect your data and process it only on our behalf.
• AI features provider (OpenAI, LLC): When the AI Summary or AI Support Chat features are used, we may share a limited subset of store-level and request-level metrics or queries with OpenAI solely to generate the feature output. We aim to minimize the data sent and to avoid unnecessary personal data sharing.
• Shopify: The App integrates with Shopify's APIs. Shopify's own privacy practices are governed by the Shopify Privacy Policy.
• Legal requirements: We may disclose data if required to do so by law, or in response to valid legal process (e.g., a court order or government request).

We retain different categories of data for different periods, depending on legal obligations:

• Store and merchant account data: Retained for as long as your store has the App installed, plus a maximum of 30 days after uninstallation (to allow reinstallation without data loss).
• Withdrawal request records: Retained for 5 years from the date of submission to satisfy EU audit obligations under Directive 2011/83/EU, unless you request earlier deletion and no legal retention obligation applies.
• Email templates and customization settings: Retained during your subscription and deleted within 30 days of app uninstallation.
• Transactional email logs: Retained for 90 days for delivery verification and customer support inquiries.
• Usage and error logs: Retained for 12 months for performance analysis and security investigations.

Upon receiving a verified store deletion webhook from Shopify, we permanently delete all data associated with your store within 30 days.

We implement industry-standard security measures to protect your data, including:

• Encryption in transit: All communication uses TLS 1.2+ (HTTPS)
• Encryption at rest: Sensitive data is encrypted at the database level (AES-256) via Supabase
• Access controls: Role-based access limits who can view production data
• API authentication: Shopify Session Tokens for secure API communication
• Audit logging: All access to and modifications of withdrawal requests are logged
• Regular security reviews: We conduct periodic security assessments of our infrastructure
• Breach notification: In the event of a data breach, we will notify you within 72 hours (GDPR Article 33)

AI Summary requests are processed using the minimum data needed to generate the feature output. We do not use the summary feature to intentionally collect sensitive personal data, and you should avoid entering unnecessary personal information into free-text fields whenever possible.

Note: No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data, subject to legal retention requirements.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — request that we restrict processing of your data.

To exercise any of these rights, contact us at privacy@radrly.com. We will respond within 30 days.

In compliance with Shopify's Partner Program requirements, the App processes the following mandatory privacy webhooks:

• customers/data_request — we provide all data held about a customer upon request.
• customers/redact — we delete all personal data associated with a customer upon request.
• shop/redact — we delete all data associated with a store within 30 days of receiving this webhook.

The App is embedded in the Shopify Admin and uses session tokens (not third-party cookies) for authentication, in accordance with Shopify's App Bridge requirements.

The App uses browser localStorage solely to store your UI preferences (e.g., whether you have dismissed the widget installation guide). No personal data is stored in localStorage.

The App is intended for use by merchants operating Shopify stores and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days. For urgent matters, contact our support team directly.