By business type

Refund Policy Generator for e-commerce

Written for checkout data, payment hand-offs, marketing consent and cross-border selling.

Generate your refund policy Read the refund policy guide

A store’s refund policy is read before purchase far more often than any other legal page, which makes it a conversion document as well as a compliance one. Stating statutory rights clearly and then being generous on top converts better than being vague about both.

An online store collects more categories of personal data than almost any other small business, and it collects them at the highest-stakes moment: checkout. Name, address, phone, email, order contents, payment token, device identifiers and behavioural history all arrive in one flow, feeding a dozen downstream systems.

The marketing layer is where most stores go wrong. Abandoned cart emails, review requests, loyalty programmes and retargeting all reuse data collected to fulfil an order. Each of those is a distinct purpose, and in the UK and EU each needs its own basis - which is usually consent or the narrowly-defined soft opt-in, not the contract basis that covers the order itself.

Selling across borders multiplies everything. Every market adds a consumer law, a cancellation regime and a set of disclosure duties, and shipping internationally means transmitting customer data to carriers and customs authorities in each destination.

What a refund policy for an online store has to cover

Statutory cancellation and faulty-goods rights per market, stated first
The return window, the condition requirement, and how a return is started
Who pays return shipping, split between faulty and change-of-mind
Refund timing and method, matching what your gateway actually does
Lawful exclusions only - personalised, perishable, unsealed hygiene items, waived digital content

How an online store actually moves personal data

Checkout data

Collected under contract, but the fields you add beyond what fulfilment needs - date of birth, gender, marketing preferences - are on a different footing.

Payment tokens and fraud scoring

The gateway processes card data as its own controller for fraud prevention, which is a hand-off, not a straightforward sub-processing.

Abandoned cart capture

An email address entered but never used to complete an order. Using it is direct marketing, and whether the soft opt-in applies is genuinely debatable because no sale happened.

Retargeting and lookalike audiences

Uploading customer lists to ad platforms for matching or audience building is a disclosure to a third party and, in California, likely sharing.

Reviews and post-purchase requests

Review platforms receive customer name, email and order data, and typically publish part of it.

Cross-border shipping and customs

Address and contents data transmitted to carriers, customs brokers and destination authorities.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Klaviyo or Mailchimp · Trustpilot or Judge.me · Meta and Google Ads · DPD, Royal Mail or your carrier · Gorgias or Zendesk

The rules that apply

Distance selling and cancellation rules

Fourteen days in the UK and EU, seven in Brazil, none federally in the US - the same store faces different obligations per market.

Marketing consent and the soft opt-in

Post-purchase marketing is permitted only where the address was collected in a sale of similar goods with an opt-out offered at the time and in every message.

Cookie and tracking consent

Retargeting pixels, analytics and personalisation all require consent in the UK and EU before they fire.

Payment card handling

Using a hosted gateway keeps card data off your systems, but the policy has to describe the hand-off accurately rather than implying you store nothing at all.

Consumer information duties

Total price, delivery costs, return costs, complaint routes and trader identity, disclosed before the order is placed.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

The e-commerce document set

Map the checkout field by field
For each field: why it is collected, the basis, where it goes and how long it is kept.
Separate order processing from marketing
Different purposes, different bases, different retention. The consent record for marketing has to be independent.
Scan the storefront for pre-consent tags
Retargeting pixels are the usual finding.
Write the refund policy against every market you ship to
Statutory rights first, then your own terms.
Document the payment hand-off
Which provider, which fields they see, and what you retain.
Set retention for orders and for marketing profiles separately
Tax retention is not a reason to keep a behavioural profile.

Where this usually goes wrong

Abandoned cart emails without a basis

Where no purchase completed, the soft opt-in argument is weak. Consent captured at the point of email entry is the defensible route.

Pre-ticked marketing checkboxes

Invalid consent in the UK and EU, and it taints the whole list rather than just the individual record.

Customer list uploads to ad platforms undisclosed

It is a disclosure to a third party and in several US states a sale or share requiring an opt-out.

Retargeting pixels firing before consent

The most common UK and EU failure on e-commerce sites, and the one a cookie scan finds in seconds.

A returns policy that contradicts statutory rights

Final sale rules that override cancellation rights are unenforceable and, in several markets, independently actionable.

Order data retained forever

Tax records justify a period for the transaction data, not for marketing profiles and behavioural history attached to it.

Frequently asked questions

Do I need a privacy policy for a small online shop?

Yes. Taking an order always involves personal data, which triggers transparency obligations in every major market, and payment providers and marketplaces require a published policy as a condition of service.

Can I email customers after they buy?

In the UK and EU, only under the soft opt-in: your own similar products, to someone who bought from you, with an opt-out offered at collection and in every message. Otherwise you need consent.

Are abandoned cart emails allowed?

They are direct marketing, and where no purchase completed the soft opt-in is difficult to rely on. Capturing explicit consent at the point of email entry is the safer route.

Do I need a cookie banner for an online shop?

If you serve the UK or EU and run analytics, retargeting or personalisation - which nearly every store does - then yes, and it needs to block those tags until consent.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.