Privacy and data
ReturnKit processes personal data to handle returns, exchanges and withdrawals, and to keep a record of when each withdrawal arrived. Under GDPR that generally rests on performing the contract with the customer and, for withdrawals, on your legal obligations as a trader. Your own privacy policy should say so. Suggested text is added under Settings → Privacy → Policy guide.
This page describes what the plugin does. It isn't legal advice.
What is stored
| Data | Why | Kept for |
|---|---|---|
| Name, email, order and customer account, items and quantities, reasons and comments | Handling the request and emailing the customer | Until the request is deleted or erased (see below) |
| The withdrawal statement as submitted: name, email, order number, scope, items or description, comments, and the submission time | The record of what was withdrawn and when | Same |
| IP address of the submission, shortened by default | Evidence for withdrawals, and spotting abuse | Same |
| History: every step, who took it (customer, staff user, or ReturnKit), staff notes and messages, emails sent | Audit log | Same |
| Store-credit ledger (Pro): the account, the email of a guest's unclaimed credit, amounts and the order or request they relate to | Customer balances | Until uninstall (amounts stay after an erasure request; the email goes) |
| Return labels (Pro) | Files you upload for the customer | Until you remove them or uninstall |
| A one-hour counter per form and IP, keyed by a hash of the IP | Spam protection rate limit | One hour |
ReturnKit keeps requests until you delete them; it has no automatic retention period. Withdrawal records are evidence you may need for as long as a dispute is possible.
ReturnKit sets no cookies.
IP shortening
With Settings → Notifications and privacy → Shorten IP addresses on (the default), ReturnKit stores IP addresses through WordPress's own wp_privacy_anonymize_ip():
- IPv4: the last part is zeroed,
192.168.1.23→192.168.1.0; - IPv6: everything after the first three blocks is zeroed,
2001:db8:85a3:8d3:1319:8a2e:370:7348→2001:db8:85a3::.
The shortened address is stored on the request and in its history. Turn the setting off only if you need the full address as evidence, and say so in your privacy policy; the suggested policy text changes to match.
The rate limit uses the full IP for one hour, stored only as a hash inside a transient's name.
Which address counts as the visitor's depends on Settings → Spam protection → Visitor IP address from: the connecting address by default, or a proxy header (Cloudflare, X-Forwarded-For, X-Real-IP) if you chose one. Proxy headers are never read otherwise.
External services
ReturnKit only talks to an outside service if you set one up:
| Service | When | What is sent |
|---|---|---|
| Cloudflare Turnstile | Only once you switch it on and enter both keys. | The visitor's browser loads Cloudflare's script on ReturnKit's public forms. When a form is submitted, your server sends the challenge response, your secret key and the visitor's IP to Cloudflare to verify it. Terms · Privacy · Turnstile privacy addendum |
| Freemius | Licensing and updates of the premium version, opt-in usage data, checkout | See Freemius terms and privacy. If you skip the opt-in, nothing is sent until you activate a license or upgrade. |
Emails go through your site's normal WordPress mail setup.
Data-subject requests
ReturnKit registers with WordPress's privacy tools under ReturnKit returns and withdrawals. Both tools cover the requests made with that email address and, if an account uses that email, the requests made with that account.
Tools → Export Personal Data adds, for each request: the request number, type, status, submission time, name, email, IP address, the customer's note and the items. With Pro, it also adds the person's store-credit ledger entries (date, amount, note).
Tools → Erase Personal Data anonymizes each request instead of deleting it, so refunds and stock movements stay explainable in your books:
- the email becomes
deleted-{request id}@anonymized.invalid; - the name, IP address and customer note are cleared;
- in a withdrawal statement, the name, email, comments and the items described in words are cleared;
- the structured data in the request's history (which holds the submitted statement and the IP) is cleared;
- the text of staff notes and messages to the customer is replaced with [erased];
- an uploaded return label (Pro) is deleted, since it carries the customer's address;
- an entry Personal data erased on request is added to the history.
In the store-credit ledger (Pro), the email address and notes are removed from that person's entries; the amounts stay for the books.
What stays: the order link, items, amounts, reasons, statuses, timestamps, the order number and the item list in a withdrawal statement, and the system's own history entries.
Order notes ReturnKit added to WooCommerce orders are part of the order and follow WooCommerce's own privacy settings.
Suggested privacy-policy text
ReturnKit adds this under Settings → Privacy → Policy guide, adapted to the IP setting:
When you request a return, an exchange or withdraw from a purchase, we store your name, email address, the order and items concerned, your reason and comments, the date and time, and a shortened (anonymized) IP address. We use this to handle your request, to send you the confirmations and updates about it, and, for withdrawals, as the record of when your withdrawal was received. These records are kept as long as your order records.
Edit it to match your actual retention and any services you use.
Uninstalling
Deleting the plugin removes:
- its tables: requests, items, history and the Pro credit ledger;
- its settings and transients, and the settings of its five WooCommerce emails;
- the product settings it added (Not returnable, No right of withdrawal);
- the order and order-item data it added (exchange order links, store credit used on an order), with HPOS and legacy order storage;
- the "save my credit" preference on user accounts;
- uploaded return labels.
On a multisite network, this runs on every site.
Order notes and WooCommerce refunds stay with the orders, and the Returns and withdrawal pages stay. Export your requests first if you need to keep withdrawal records.