With the EU’s mandatory digital withdrawal button requirement (Directive EU 2023/2673) having officially gone into effect last month (June 2026), I’m looking into how to handle compliance for a store built on Reflow.
For context, the directive requires that any online store selling to EU consumers must provide a prominent, frictionless, unauthenticated digital path to cancel contracts/orders. It essentially mandates a self-service flow, working for both logged-in users and guest checkout, consisting of:
A clear “Withdraw from contract” button/link visible during the statutory 14-day window.
A form allowing the customer to identify their order (e.g., via Order ID and Email) without requiring a password/login.
An immediate, automated, timestamped confirmation receipt sent to the consumer upon submission.
I’ve combed through the Reflow documentation and release history, but I haven’t found any native, out-of-the-box components or automated toggle switches for a self-service cancellation/withdrawal flow for EU customers. Currently, it looks like refunds and cancellations still require manual admin intervention via the Reflow Dashboard, or custom code to update order states
Are there any plans to introduce a native frontend component or automated workflow for this in Reflow’s core toolkit soon?
For my current projects, I am dealing specifically with physical items.
While the directive heavily highlights digital services and subscriptions, it absolutely applies to distance contracts for physical goods sold to EU consumers as well. The primary compliance hurdle for physical e-commerce under this law is the “guest checkout” factor.
For physical goods, the required workflow looks like this:
The Trigger: A customer buys an item as a guest (no account created).
The Right to Withdraw: Within the statutory 14-day window from delivery, they must be able to return to the site and initiate a formal legal withdrawal without being forced to register an account or log in.
The Proof: Upon submitting the form (identifying the order via Order ID and email), they must automatically receive a digital, timestamped confirmation receipt, which legally pauses their 14-day clock while they arrange to ship the physical item back.
From a Reflow perspective, this is tough to implement cleanly out-of-the-box right now because guest orders are typically managed strictly on the admin dashboard side.
If Reflow were to support this natively for physical e-commerce, a great implementation would be a dedicated, unauthenticated frontend component (like <reflow-order-withdrawal>) where a guest can enter an Order ID and Email. If the order is valid and within the 14-day window, submitting it could:
Automatically flag the order status as “Withdrawn” or add a specific tag/metadata in the Reflow dashboard.
Trigger a native Reflow transactional email confirming the withdrawal receipt to the customer.
Are there any existing API endpoints or metadata fields you’d recommend leveraging if I need to build a custom form to handle this for physical orders in the interim?
Thank you, this is valuable feedback. As far as I understand, the withdrawal button regulates the client-side experience. It doesn’t dictate that the process needs to be fully automated in the backend. Given the many different ways people are using Reflow, a fully automated behaviour like the one you’re proposing won’t work for many vendors or open them for refund fraud.
I would propose a much simpler version:
Make a withdrawal button/link that shows a modal with a form with fields for order number, name etc
The form is submitted with smart forms to the seller’s email.
Set up an autoreply on the seller’s email account so the user gets an instant confirmation (as required by the law)
It will then be up to the seller to track down the order and decide how to process the refund.
That is an incredibly elegant and practical approach! You are correct on the legal distinction here: the directive only mandates the registration and confirmation of the withdrawal request, not an instantaneous automated refund. The seller absolutely retains the right to inspect the returned physical goods before releasing any funds, which completely mitigates the risk of refund fraud.
I think your proposed workflow using Smart Forms is a good, low-overhead solution that would work well for most Reflow users.
Here are two quick thoughts on that implementation:
The Autoresponder Challenge: Relying on a standard email inbox autoresponder (like a cPanel/gmail out-of-office reply) can sometimes be unreliable due to spam filters, or it might send generic text that doesn’t reference the customer’s specific order.
Smart Forms Customisation: If Bootstrap Studio’s Smart Forms could natively allow us to customise the “Success/Auto-response” email template sent to the submitter (e.g., dynamically piping in their {order_number} and {name} with a legal confirmation timestamp), that would instantly satisfy the law’s strict requirement for a formal, timestamped receipt.
If we could configure the Smart Form to automatically fire a structured confirmation email directly to the customer’s input email, then this would be a perfect, lightweight solution.
Thanks for putting this together and sharing the demo, @richards It’s great to see a working visual proof-of-concept for the modal and form. For anyone considering a custom PHP mailer approach like this, there are a few important technical and security considerations:
1. Bot Abuse & Email Bombing Risk: If a public PHP script automatically reflects emails to whatever address is typed into the email field, bots can target the endpoint to perform email bombing or send spam using your server. Any custom PHP script handling this needs robust rate-limiting, honeypots, or reCAPTCHA integration.
2. Deliverability & Spam Filters: Sending transactional confirmation receipts via basic PHP mail() often fails strict SPF/DKIM/DMARC checks. If the auto-generated receipt lands in the customer’s spam folder or bounces, it creates a potential compliance issue regarding the “immediate timestamped confirmation” rule.
3. BSS Hosting Constraints: A PHP solution requires self-hosting on a cPanel/LAMP server, which rules it out for anyone using Bootstrap Studio’s built-in web hosting.
4. Order Verification: Ideally, the backend script should query the Reflow API to verify that the Order ID actually exists before generating a legal receipt, rather than blindly confirming whatever number is submitted.
This demo highlights exactly why an integrated solution within Reflow/Smart Forms (where BSS handles server-side spam prevention, deliverability, and native hosting) would be the ideal outcome for the community
I agree, this really does need to be added to reflow.
The proof of concept was using PHPmailer over authenticated SMTP, not mail(), so as long as the DKIM/DMARC etc is set up correctly on the domain then there should be no problem with falling into the customers spam folder.
It would be easy to setup a honeypot, I would suggest using a website field as most bots would fill this automatically, It runs before anything else, so a bot that fills in every field just gets a fake “success” and never touches the mailer or the Reflow lookup.
if (trim((string)($_POST['website'] ?? '')) !== '') { respond(true, 'Your withdrawal request has been received...'); }
A call to the Reflow API can check that the order number corresponds the the email address
$url = "https://api.reflowhq.com/v2/projects/{$projectId}/orders/{$orderNumber}";
// ...
$orderEmail = $order['customer']['email'] ?? null;
if (strcasecmp(trim($orderEmail), trim($email)) !== 0) {
// do something
}
this I havn’t tested as I dont have the pro version of reflow