Last updated September 1, 2026
Privacy Policy
DigiFulfill (“DigiFulfill,” “we,” “us”) provides automated digital-goods fulfillment for sellers on Lazada. This policy explains what information we collect, how we use it, and the choices available to the two groups of people whose data passes through the service: the merchants who run a DigiFulfill account, and the buyers who purchase from those merchants’ stores.
1. Information we collect
Account and business information
When you create a merchant account we collect your business name, email address, and password (stored by our authentication provider using standard salted hashing — we never see or store it in plain text). If you invite staff to your account, we collect their email address and the permissions you grant them. If you enable two-factor authentication, we store the authenticator secret needed to verify your codes, not the codes themselves.
Marketplace connection and order data
Connecting a Lazada store uses Lazada’s own OAuth sign-in — we receive an access token scoped to that store, never your Lazada password. Through that connection we receive order data Lazada sends us: order and line-item identifiers, product and variant details, quantities, prices, and — where Lazada’s API provides it — buyer contact information needed to deliver a digital code by email or chat.
Digital codes and inventory
Digital codes you upload for merchant-owned products are encrypted before being stored. Codes fulfilled through the DigiFulfill Catalog come from our own supplier inventory and are subject to the same encryption at rest.
Payment and wallet records
DigiFulfill does not process card payments directly. Wallet top-ups and subscription payments are settled by bank transfer or e-wallet outside the platform; we retain the reference details and proof-of-payment image you submit so an admin can verify and approve the transaction, plus an append-only ledger of the resulting wallet balance changes.
Sender credentials
If you connect a custom email sender, we store what’s needed to send on your behalf: SMTP host, port, and username/password (encrypted at rest). You can revert to the platform default sender at any time, which stops us from using those credentials.
Usage and log data
We keep operational logs of fulfillment activity (code reservations, delivery attempts and their outcomes) and an audit trail of sensitive account changes — who changed a price, a wallet balance, or a security setting, and when — so issues can be investigated and reversed if needed.
2. How we use information
- Operate the core service: matching incoming orders to your product catalog, reserving and delivering digital codes, and sending buyer-facing emails or Lazada chat messages on your behalf.
- Calculate and apply billing: usage against your plan's included order allowance, add-on and store-slot charges, and wallet balances.
- Maintain the security of accounts, including detecting unusual account activity and investigating reported abuse.
- Communicate with you about your account, orders that need attention (e.g. low stock or an unaffordable wallet charge), and changes to the service.
- Respond to support requests you send us directly.
3. How we share information
We share information only where it's necessary to run the service:
- With Lazada, to receive order webhooks and, where applicable, confirm delivery status back to them.
- With our infrastructure providers — Supabase (database, authentication, and file storage) and our transactional email provider — who process data only on our instructions and under contract.
- With the digital-goods suppliers behind the DigiFulfill Catalog, limited to what's needed to procure a code for an order (never your buyer's contact details).
- Where required by law, or to protect the rights, property, or safety of DigiFulfill, our merchants, or the public.
We do not sell personal information, and we do not share buyer data across merchant accounts.
4. Data retention
We keep order and fulfillment records for as long as your account is active, since they're the basis for billing history, delivered-code lookups, and dispute resolution. If you close your account, we delete or anonymize personal information within a reasonable period, except where we're required to retain records for legal, accounting, or fraud-prevention purposes (for example, financial ledgers and audit logs).
5. Security
Merchant data is isolated with database-level access rules, not application checks alone — one merchant’s orders and codes are never reachable from another merchant’s session. Digital codes, sender credentials, and payment-related secrets are encrypted at rest. Two-factor authentication is available on every account. Details are on our Security page.
6. Your rights and choices
- Merchants can access, correct, or export their account and order data from the dashboard at any time, or by contacting us.
- You can disconnect a custom sender or a Lazada store connection whenever you choose, which stops us from using those credentials going forward.
- A buyer whose order was fulfilled through DigiFulfill can request access to, correction of, or deletion of their information by contacting the merchant they purchased from, or by writing to us directly — we'll route the request to the relevant merchant where needed.
7. International data transfers
Our infrastructure is hosted in Asia-Pacific data centers. If you or your buyers are located outside that region, your information will be transferred to and processed there. We rely on our providers’ own contractual and security safeguards for that transfer.
8. Children's privacy
DigiFulfill is a business-to-business service intended for merchants operating a commercial storefront. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.
9. Changes to this policy
We may update this policy as the service changes. If a change is material, we’ll notify merchants by email or an in-dashboard notice before it takes effect. The “Last updated” date at the top of this page always reflects the current version.
10. Contact us
Questions about this policy, or a request relating to your personal information, can be sent to orders@digifulfill.com or through our contact page.