Privacy policy
Effective 15 October 2026
RebutCase is a Shopify app that helps merchants answer chargebacks on Shopify Payments. It is made and run by Zoviotech (Zovio Technologies), a software business based in Pakistan. In this policy "we" means Zoviotech, "you" means the merchant who installs the app, and "customers" means your store's customers.
Our role
For your own account details, such as your store name and the alert email addresses you choose, we decide how the data is used, so we are the controller. For your customers' data, we act only on your behalf and on your instructions, to build responses to your disputes. You are the controller of that data and we are your processor (a service provider under US state privacy laws). Our data processing addendum sets out those terms.
Data we process
- Your store: its name, email address, currency, timezone and plan, the alert email addresses you choose, and the business contact details you enter for the evidence pack cover (name, email, phone, website).
- Disputes: type, status, reason, amount and dates, from Shopify.
- For each disputed order only: the order number, items, totals and dates; payment check results (address and security code checks); fulfillment and tracking details; refunds and cancellation; the customer's name, email address, and billing and shipping addresses; how many earlier paid orders the customer has with your store; your published store policies and the descriptions of the products in the order.
- Notes and file descriptions you add to a dispute, the bank's stated reason if you paste it in, and the responses you build and edit.
- Repeat disputer alerts: the Shopify customer ID of each disputed order (an ID, not a name or email), and the order numbers of new orders from that customer, so we can tell you before you ship.
- Evidence vault: a copy of each product's title and description and of your published store policies, with a new copy when one changes. This is your store's own content, not customer data. It lets a response show what a customer saw on the order date.
- Support: what you write to us when you contact support, and our replies.
We read customer and order data only for disputes, to build that dispute's response. We do not copy whole orders or customer records, we do not store PDFs (they are made on demand), and we never see or store card numbers. We do not use the data for analytics, advertising, profiling or training AI models.
Why we use it
We use your data to provide the app you installed: syncing disputes, collecting and checking evidence, writing and saving responses, and sending the alerts you asked for. Under the GDPR and similar laws, our legal basis is the contract with you (our terms of service). We also keep limited records where the law requires it, and we use your contact details to answer support requests and to tell you about important changes to the app, which is our legitimate interest. We never send marketing to your customers.
Writing the response with AI
When an AI model helps write a response, it receives only short sentences built from the evidence, with customer names, email addresses and postal addresses replaced by placeholders, and with your notes replaced by placeholders. The real values are put back by RebutCase after the model replies. When a dispute arrives, a draft is prepared this way automatically, unless you turn this off in Settings. Our AI provider does not use this data to train its models. Every sentence is then checked against the evidence, and you review the response before anything is saved to Shopify. RebutCase makes no decisions about your customers: you decide what to send, and the bank decides the dispute.
Who processes data for us
| Provider | Data | Purpose |
|---|---|---|
| Railway (United States) | All app data in transit | Hosting |
| Neon (United States, AWS) | Stored app data | Database |
| OpenAI (United States) | Masked evidence sentences, without names, emails or addresses | Writing the response text |
| Resend (United States) | Your alert email addresses; deadline alerts hold dispute summaries without customer data; a customer data request email holds the data we keep for that customer and goes only to you | Sending emails to you |
| Cloudflare (United States) | What you send to our support address, passed through | Forwarding support email |
| Google, Gmail (United States) | What you send to our support address | Support inbox |
Shopify provides the data to us under its own terms and privacy policy. We do not sell data, share it for advertising, or give it to anyone else, unless the law requires us to. If we add or replace a provider, we update this table first.
Where data is stored
Our servers and providers are in the United States. If you or your customers are in the European Economic Area, the United Kingdom or Switzerland, data is transferred to the United States under our providers' data processing terms, which include the European Commission's Standard Contractual Clauses.
How long we keep it
- Evidence, notes and responses: until 90 days after the dispute closes, then deleted.
- Records of dispute outcomes (reason, amount, won or lost, no customer data): 24 months.
- Repeat disputer alerts: flagged orders for 30 days; a disputed order's customer ID until 12 months after the dispute closes.
- Evidence vault copies: while the app is installed, so older orders stay covered.
- When you uninstall the app, Shopify sends us a deletion request 48 hours later and we then delete all of your store's data. You can also delete everything at any time in the app, under Settings, Delete all my app data.
- Our database provider keeps a short restore history (6 hours on our plan, never more than 7 days), so deleted data leaves those backups within 7 days.
- Support emails: up to 24 months after the conversation ends, then deleted.
Security
Data travels over HTTPS. The database is encrypted at rest, and customer names, email addresses, postal addresses and your notes are also encrypted field by field. Logs never contain customer details. Only the developer has access to production systems, with two-factor sign-in on every account. If a security incident affects your data, we will tell you and Shopify without undue delay, and within 72 hours of confirming it.
Your rights
You can see, correct, export or delete your data, object to how we use it, or ask us to limit it. Most of this you can do in the app: Settings holds your details, and Delete all my app data removes everything. For anything else, email support@zoviotech.com from the address on your Shopify store, and we will answer within 30 days. If you are in the EEA or the UK you can also complain to your local data protection authority.
Customer requests
Customers who want to see or delete their data should contact your store. When Shopify sends us a customer data request, we email you the data we hold for that customer's orders. When Shopify sends a redaction request, we delete that customer's evidence and do not collect it again. If a customer contacts us directly, we pass the request to you.
Cookies
The public pages use no cookies, analytics or trackers. Inside your Shopify admin the app uses Shopify's session tokens to keep you signed in.
Children
RebutCase is a business tool for Shopify merchants. It is not meant for anyone under 18, and we do not knowingly collect data from children.
Changes and contact
We post changes here with a new effective date. For important changes we also tell you in the app or by email at least 14 days before they apply. Questions about privacy: support@zoviotech.com.