Privacy and GDPR
ReturnDesk stores personal data about your customers, and it hooks into the WordPress privacy tools so you can export and erase it. This page lists what is stored, where it goes, and how the export and erase tools behave. It is not legal advice: check the rules that apply to your store.
What ReturnDesk storesโ
| Data | Where | Notes |
|---|---|---|
| The return: RMA number, order id, customer id and email, status, resolution, return method, amounts, reason summary, customer note, internal note, a random access token, dates | Table tsre_returns | Guests have customer id 0. The email is kept so the customer can follow the return. The token opens the page of that one return for a guest (Pro), while the return is open and for 30 days after it reached a final status. |
| The items: product, quantities, reason code, the customer's reason text, condition, amounts | Table tsre_return_items | |
| The timeline: who did what and when, notes, label and refund events | Table tsre_return_events | The actor is a user id, never a name. |
| Photos | Media library files in wp-content/uploads/tsre/{return id}/ | Private, random file names, served only through signed links. See Labels and carriers. |
| Labels: provider, tracking number, cost, PDF file | Table tsre_labels and wp-content/uploads/tsre/ | The label PDF holds the customer's address. |
| Store credit ledger (Pro): customer id and email, amounts, notes, expiry | Table tsre_credits | |
| Settings, including carrier credentials (encrypted) | Option tsre_settings | |
| Rate limit counters (Pro portal) | Short-lived transients | Keyed by a hash of the IP address or the order number, for 15 minutes. |
The order link that a guest receives from the portal (Pro) is not stored. It is signed on the fly from the order id and an expiry date, so there is no table of those links to clean up.
The logs of ReturnDesk (WooCommerce > Status > Logs, source returndesk) never contain the payload of a carrier webhook or a secret. They hold the last four characters of a tracking number.
Third partiesโ
ReturnDesk sends nothing anywhere by itself. If you buy return labels with EasyPost (Pro), the customer's name, shipping address, phone and email, your return address and the parcel size and weight are sent to that carrier service, because the label needs them. Name them in your privacy policy.
Privacy policy textโ
ReturnDesk adds a suggested paragraph to Settings > Privacy > Policy Guide, under the name ReturnDesk. It says that your store keeps the email address, the order and items, the reasons and notes, and uploaded photos to handle the request and as part of the order records, and that photos are stored privately and shown only to the customer and the store team. Add the sentence about carrier services if you use them.
Exportโ
Tools > Export Personal Data includes a ReturnDesk group. For every return that belongs to the email address or to the account with that email it lists: return number, order number, email, status, dates, customer note, resolution, return method, refund, store credit and fee totals, every item with its reason and reason details, and the names of the photo files.
With the Pro edition there is also a Store credit group with the balance per currency and every ledger entry (date, amount, type, return number).
Eraseโ
Tools > Erase Personal Data has a ReturnDesk eraser. What it does follows the WooCommerce setting Remove personal data from orders, under WooCommerce > Settings > Accounts and Privacy (in the section about account erasure requests). Returns are part of your order records, so they follow the same rule.
| WooCommerce setting | What the eraser does to a return |
|---|---|
| Off (the default) | The return is kept with the order records. Only the uploaded photos are deleted, because they are not order records. |
| On | The return is anonymised: the email address is replaced, the customer note, the free text of the items and the notes the customer wrote on the timeline are blanked, the photos are deleted, the return is marked as erased and the timeline gets a "Personal data erased" entry without any personal data. Amounts, dates and statuses stay. |
An erased return is skipped when the eraser runs again, so repeating it changes nothing.
For the Pro store credit ledger, the amounts, dates and sources are financial records and are always kept, and the eraser reports them as retained. When WooCommerce is set to remove personal data from orders, the free text notes of the ledger are blanked. Otherwise the whole ledger is kept with the order records.
Retentionโ
ReturnDesk deletes nothing on its own, apart from temporary photo uploads that were never submitted (removed after a day) and expired store credit (the balance is reduced, the entries stay). Decide how long to keep returns for your tax and consumer law needs, and anonymise or remove them with the tools above. To remove everything when you uninstall the plugin, see Uninstall.