Privacy Policy — Rebuttal

Last updated: 15th of August, 2026

Who we are

Rebuttal is a Shopify application operated by NorthMastApps, based in Portugal. Rebuttal helps Shopify merchants prepare evidence responses to payment disputes (chargebacks). Contact: northmastapps@gmail.com.

Our role.

For personal data belonging to a merchant's customers, the merchant is the data controller and we act as a data processor on the merchant's behalf, under Shopify's platform terms and this policy. For data about merchants themselves (account and billing information), we are the controller.

What we collect and why.

When a merchant installs Rebuttal, we collect and store, for each new order: customer name, email address, billing and shipping addresses; order contents and totals; checkout session details (IP address, browser user agent, language); payment verification results (AVS/CVV outcome codes, plus the card's issuing-bank identification number and brand — never full card numbers); fulfillment and delivery tracking; a snapshot of the product listing as it appeared at the time of purchase; and a copy of the store's refund policy and terms of service in effect at the time of purchase. When a payment dispute occurs, we store the dispute details provided by Shopify and generate an evidence document from the data above. We collect this data for one purpose: assembling evidence that the merchant may review and submit in response to payment disputes. We do not use it for advertising, profiling, or any other purpose, and we never sell personal data.

Where data is stored.

Data is stored on infrastructure provided by Fly.io in Frankfurt, Germany (EU). We use Sentry for error monitoring, configured so that request contents and personal data are not transmitted with error reports. Data is exchanged with Shopify as required for the app to function. We use Resend to send transactional emails on the merchant's behalf (dispute notifications, and data-export emails containing customer data, when requested). Where a merchant connects PayPal or Stripe, evidence for a dispute on that gateway — including customer data — is sent to PayPal or Stripe respectively, as needed to submit or track the merchant's response. We share data with no other parties, except where required by law.

Evidence integrity.

Order-time evidence — payment verification, session details, the product listing, and store policies — is captured once, at the time of the order, and never modified or refetched afterward: a listing or policy changed after the sale is exactly what the snapshot exists to prove. The one exception is fulfillment: shipping and delivery status are updated as the carrier reports them, and the evidence document shows its own capture time for that section separately, so it is always clear when each piece of evidence was recorded.

Automatic replies to payment disputes.

Where a merchant switches on automatic replies for PayPal inquiries, Rebuttal sends one message to the customer who opened the dispute, through PayPal, on the merchant's behalf. That message contains only data captured from the customer's own order — such as shipping tracking, the product listing as it appeared at the time of purchase, and the store's refund policy — and a copy of it is retained with the dispute record as part of the merchant's response. This feature is off unless the merchant enables it, only one message is ever sent for a dispute, and Rebuttal never sends a message that is not built from that captured order data.

Retention and deletion.

Evidence data is retained while the merchant has Rebuttal installed, because dispute deadlines can arrive months after an order. We honor Shopify's mandatory privacy webhooks: when a customer requests deletion through their merchant, that customer's captured order data is redacted. One deliberate exception applies: where an order is the subject of a payment dispute, the generated evidence for that dispute is retained even after a redaction request, because it forms part of the merchant's legal response to the dispute — a legitimate interest recognized under data-protection law. That evidence is deleted when the merchant uninstalls, on Shopify's standard redaction schedule (48 hours after uninstall), along with all of the store's other data. Merchants may also request earlier deletion at northmastapps@gmail.com.

Data subject rights.

Customers seeking access to or deletion of their data should contact the merchant they purchased from, who can fulfill the request through Shopify's built-in privacy tools. We act on those requests directly: deletion is processed automatically, and for data-access requests we compile the customer's data and email it to the merchant to deliver. We also respond to merchant-forwarded requests at northmastapps@gmail.com.

Security.

Data is transmitted over HTTPS and stored in access-controlled infrastructure.

Website analytics and cookies.

This section describes rebuttalapp.com, our public marketing website, only — it does not apply to the Rebuttal app itself, and no merchant or customer data processed inside the app is analyzed or tracked. On the marketing website, we use Google Analytics 4 to understand how visitors use our public pages (page views, referrers, approximate location derived from IP). Google Analytics only runs if you accept it through the cookie banner shown on your first visit; if you decline or make no choice, it does not run and no analytics cookies are set. Where accepted, Google Analytics sets cookies (including _ga and _ga_*) that expire after 13 months. This processing relies on your consent, which you can withdraw at any time using the "Cookie preferences" link in the site footer. Analytics data is processed by Google Ireland Limited and may be transferred to Google's infrastructure in the United States under Google's standard contractual clauses. We do not enable Google Signals and do not share this data with other Google products or services. To object, decline consent in the banner, withdraw it later via the footer link, or use your browser's cookie controls.

Founder list.

On the marketing website, visitors may submit their email address to join a list notified when Rebuttal launches on the Shopify App Store. This email is stored by Netlify (our form processor) and used only to send that one launch notification; it is never sold or shared with third parties for marketing. You may request deletion at any time at northmastapps@gmail.com.

Changes.

We'll update this page when our practices change, with the date above revised accordingly.