Privacy Policy — WeRefund

1Who we are

1.1The company responsible

WeRefund is operated by WEREFUND LTD, a company registered in England and Wales under number 17484620, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“WeRefund”, “we”, “us”). We decide why and how the personal data described in this policy is used: we are its controller under the UK GDPR and, for people in the European Union, the EU GDPR.

For anything about this policy or your data, write to support@werefund.com. Postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

1.2What WeRefund does, in short

WeRefund checks that an online store's return policy is published and clearly written, and keeps watching it. For each order placed with a verified store, it keeps a record of the exact policy that was published at that moment — the Policy Record — free for the shopper. It follows, read-only, the refunds a store issues through its own payment provider, carries return requests between shoppers and stores, and collects a review once a return is closed.

That is why we hold data about two kinds of people: the merchants who use WeRefund, and the shoppers who buy from them.

2Who this policy covers

This policy applies to you if you:

visit werefund.com;
use WeRefund as a merchant — as the owner of a store's account, or as a member of its team;
buy from a store that uses WeRefund — as a shopper, whether or not you ever create a WeRefund account;
write to us.

Stores that use WeRefund have their own privacy notice, which covers what they do with your data. This policy covers what WeRefund does.

3The data we collect

3.1When you visit werefund.com

No cookies, no audience measurement, no advertising or social trackers. Every page, font and image comes from our own server.
Server logs. Like any web server, ours records each request: your IP address, the date and time, the page asked for and your browser type. We use them to keep the site running and to stop abuse, and delete them after 30 days.
The sign-up demonstration. The sign-up walkthrough on werefund.com keeps what you type in your own browser (local storage), so that a reload does not lose it. It is never sent to us, and the password field is never stored.
The contact page opens your own e-mail application. Nothing reaches us until you send that e-mail.

3.2When you use WeRefund as a merchant

Your account: your e-mail address, a display name if you give one, your role (owner or member), your password — stored only as an argon2id hash, which we cannot read back — your two-step verification device and recovery codes, the date of your last sign-in, and failed sign-in attempts, so that we can lock an account under attack.
Your store: its name, web address, logo, contact and support e-mail addresses, the addresses of your return policy, terms of sale and privacy notice, your return formula, and the country of your parent company. If you record a return address, it is shown only to a shopper whose return you have accepted.
Acceptances: when you accept our terms, we record the document, its version and fingerprint, the time, your IP address and your browser type. That record is evidence, and it is never edited.
Connections: the credentials that let us read your store platform and your payment provider. They are kept encrypted, and they are used to read, never to write.
Billing: to settle the fees you owe us, a payment method registered with our payment provider. We keep a reference to it, its brand and its last four digits — never the full card or account number.
Activity: a trail of the actions taken in your account — who did what, and when — which never contains the text of a message.
An unfinished sign-up: the addresses you enter while signing up are kept in a draft. A draft that is never completed is deleted seven days after it expires.

The pages of your store that we read are public pages you have given us. We never read a page that needs a sign-in, and we never look for pages you have not given us.

3.3When you buy from a store that uses WeRefund

When you place an order with a store that uses WeRefund, the store sends us the details of that order. You may not have heard of us before; this is why every such store must name WeRefund in its own privacy notice.

Your order: its number and date; its amount, currency, shipping and tax; the items (product name, reference, quantity, price); its payment status; its shipping and delivery dates; and your e-mail address, when the store's platform provides it.
The WeRefund option, if you added it to your order.
Refunds: the refund events the store's payment provider reports on your order — amount, date, status and a transaction reference. No card details.
Your account, if you create one: your e-mail address; your password (an argon2id hash) or sign-in by e-mail link; and, only if you give them, a display name and a country. You also choose whether your name appears on your reviews.
Return requests: the items, the reason you choose, anything you write, whether you had already contacted the store, the messages exchanged with the store, the photos and videos you add, and the carrier and tracking number you give us.
Reviews: your rating, title and text; and, set when the review is published, the outcome of your return, the label it is published under, your country if you gave one, and the number of returns recorded on your account.
E-mails and notifications: a record that an e-mail was sent to you — its type, time and delivery status. We never keep the body of an e-mail.

How your e-mail address is kept. Never in plain text. We keep a keyed fingerprint of it (HMAC-SHA256) to find your orders, and an encrypted copy (AES-256-GCM) under a key that belongs to your address alone, used only to send you e-mails. Destroying that key makes every copy unreadable at once.

3.4When you write to us

Your e-mail address, your message, and our reply.

4How we use it, and why we may

The UK GDPR and the EU GDPR ask us to name a legal basis for each use. Ours are these:

What we do	With which data	Legal basis
Provide merchant accounts: verification, monitoring, the badge and banners, statements	merchant account, store and billing data	Contract
Create the Policy Record of each order, and show a shopper the policy that applied to it	order data	Legitimate interests: giving shoppers evidence of what was promised, and stores a record they can produce. The store informs you in its privacy notice.
Send you the e-mail after you add the WeRefund option, and follow your return window	e-mail address, order data	Contract — the option you bought
Run your shopper account, your return requests and your messages	account and return data	Contract
Follow the refunds the store issues through its payment provider	refund events	Legitimate interests: showing you and the store where a refund stands
Publish your review on the store's public profile	review	Legitimate interests: helping shoppers see how a store handles returns
Keep WeRefund secure: logs, sign-in limits, the activity trail	technical and sign-in data	Legitimate interests: security
Keep accounting records for the fees merchants owe us	billing data, statements	Legal obligation
Answer your messages	contact data	Legitimate interests
Respond to lawful requests, and establish or defend legal claims	what the request or claim concerns	Legal obligation; legitimate interests

Where we rely on legitimate interests, you can object: see Your rights. We do not rely on consent for any of the uses above.

4.1Decisions made without a person

Verification is automated. An AI model reads a store's public return policy page, then a fixed checklist makes the decision; no person reviews it. The result is one of three states — Verified, Reviewing changes, or Verification unavailable. The merchant is shown what blocks, with the exact passage, and can correct the page and ask for a new check.

Two things also happen on their own: a return request is closed when a refund covering the requested items is observed, and a request the store has not closed thirty days after being told of it is marked “no response”. None of this profiles you, and none of it is used for marketing.

5What we never do

Sell, rent or trade personal data.
Show advertising, or track you across other websites.
Send personal data to the AI model: it reads public web pages only.
Keep a shopper's e-mail address in plain text, or keep the body of an e-mail we send.
Give a store your e-mail address, your country, or the list of other stores you have bought from.
Read a page of a store that needs a sign-in, or write anything on a store's website or accounts.

7Transfers outside the UK and the EU

Our servers are in the European Union. Some of the service providers that help us run WeRefund are in other countries, including the United States. When personal data leaves the United Kingdom or the European Economic Area, we rely on an adequacy decision where one applies, or on the standard contractual clauses approved for that purpose, with the UK addendum. Ask us at support@werefund.com for a copy of the safeguards.

8How long we keep it

We keep data for as long as it serves the purpose it was collected for, and then delete it or make it anonymous. In practice:

Data	How long
Merchant account	While the account is open. When it is closed, the e-mail address is replaced and the credentials are destroyed; the records below stay for their own period.
An unfinished merchant sign-up	7 days after the draft expires
Orders, their items, payments and refunds	24 months after the order date, then archived
A shopper's e-mail address, on an order and on an account	Until 36 months after your last activity, then the key is destroyed and the address can no longer be read
Policy Records	As long as the order can be looked up — including after the store leaves WeRefund: they are the evidence of what applied
Messages of a return request	24 months
Published reviews	While they are published; they stay when an account is deleted (see Deleting your account)
Sign-in sessions	30 days after they expire
Record of e-mails sent, and notifications you have read	12 months
Server and application logs	30 days
Your requests about your rights	3 years after we answer; an export file, 30 days
Statements, fees and payments	10 years (accounting records)
Acceptance records and the trail of actions on accounts	10 years
Versions of stores' policy pages	10 years — public pages, without personal data

9Your rights

You can ask us to:

give you a copy of the personal data we hold about you (access), in a format you can reuse (portability);
correct data that is wrong (rectification);
delete it (erasure);
limit how we use it (restriction), or stop a use based on our legitimate interests (objection).

Write to support@werefund.com, from the e-mail address concerned if you can. We answer within one month, and we may ask you to confirm your identity first. There is no charge. You can use these rights wherever you live.

9.1Deleting your account

If you are a shopper, deletion makes your e-mail address unreadable everywhere by destroying its key; removes your name, country and password; ends your sessions; and erases the text of your return requests and your messages. Your published reviews stay on the store's profile, under the label they were published with — ask us if you want the text of a review removed. The Policy Records of your orders stay, without your e-mail address, as evidence for the store.

If a return request is still open, your request is recorded at once and carried out when the last one closes — and never later than one month after you asked.

If you are a merchant, an owner can close the account. The account's e-mail addresses and credentials are then removed; the Policy Records of past orders and the accounting records stay for the periods above.

9.2Complaints

If you are unhappy with how we handle your data, tell us first at support@werefund.com. You can also complain to the Information Commissioner's Office in the United Kingdom (ico.org.uk) or, in the European Union, to the supervisory authority of the country where you live or work.

10Cookies and similar technologies

Where	What it stores on your device	Why
werefund.com	No cookies. The sign-up demonstration keeps what you type in local storage.	So that a reload does not lose your answers
app.werefund.com	A session cookie and a security cookie, both our own. During a merchant sign-up, a draft token in the tab's session storage, gone when the tab closes.	To keep you signed in, and to block requests forged by another site
The WeRefund badge on a store's website	Nothing. It reads no cookie and writes nothing.	—

These are all strictly necessary for the service you ask for, so they need no consent banner. We use no advertising, analytics or social media cookies. The badge is loaded from js.werefund.com and calls only api.werefund.com, which receive your IP address like any web request.

11How we keep it secure

Every connection to WeRefund is encrypted (HTTPS).
A shopper's e-mail address is encrypted under a key of its own, and the messages of a return request under a key per conversation.
Passwords are stored as argon2id hashes; merchant accounts require two-step verification, and repeated failed sign-ins lock them for a while.
The credentials of a store's connections are kept encrypted in a separate vault.
The service that reads stores' web pages runs apart from the rest, with no access to our database.
Access by our staff is limited to what their work needs, and every change they make is recorded.

No system is free of risk. If a breach is likely to affect you, we will tell you and the authority concerned, as the law requires.

12Children

WeRefund is not aimed at children, and we do not knowingly create accounts for them. If you believe a child has given us personal data, write to support@werefund.com and we will delete it.

13Changes to this policy

When this policy changes, we publish the new version here with its date. If a change matters to how your data is used, we tell account holders by e-mail before it applies.

14Contact

support@werefund.com
WEREFUND LTD, a company registered in England and Wales under number 17484620, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.