Fulfillza 3PL Privacy Policy

1. Our role and your business relationships

For our account administration, platform billing, support, service communications and security purposes, Fulfillza determines the purposes and means of processing. When we process customer, employee, order or shipment data on a business's instructions, we act as its service provider or processor to the extent applicable law defines that role. The role depends on the particular activity, not just who uploads a record.

Your 3PL company controls its fulfillment operations, staff instructions, Client relationships and service billing. A Seller may separately control its stores, customer data and instructions. You are responsible for appropriate notices, permissions and instructions concerning the personal information you provide.

A shopper should normally contact the merchant about its purchase or privacy request. We can assist with information held in Fulfillza. Independent merchants, 3PLs, marketplaces, carriers and payment providers have their own responsibilities and notices. This policy does not replace a required data-processing agreement.

2. Information we collect and where it comes from

Account and business information: names, company names, email addresses, phone numbers, business and warehouse addresses, account identifiers, roles, invitations, memberships, account settings and authentication information, supplied by you or an authorized administrator.

Company applications: business descriptions, application answers, business contact details, supporting documents you upload, verification records and approval or rejection communications. Documents may contain personal information; provide only what is necessary and redact unrelated sensitive details.

Operational records: product and SKU details, inventory, orders, service records, recipient names, delivery addresses, supplied contact details, tracking numbers, returns, shipping labels, receipts, images, spreadsheets, notes and other files. Business records can contain personal information even when uploaded as a PDF or image.

Connections and transactions: store domains and identifiers, granted permissions, authorization credentials, supported imported records, subscription and add-on history, processing-credit records, invoices, wallet and deposit records, funding requests, withdrawal details and payment status.

Support and technical information: messages and attachments, IP addresses, device/browser information, request times, session data, login and recovery events, errors, audit events and actions performed in the application. Sources include your use of the service, authorized business users, enabled integrations, hosting infrastructure and payment or shipping providers.

3. Why we use information

We use information to register and verify accounts; administer roles and relationships; provide inventory, receiving, order, fulfillment, shipping and returns features; perform requested imports or exports; issue invoices; manage subscriptions, credits and deposits; verify funding and payout ownership; communicate about transactions; respond to support and privacy requests; investigate errors; improve reliability; prevent unauthorized access, fraud and abuse; preserve appropriate evidence; and meet legal obligations.

We do not sell personal information or use merchant customer data for targeted advertising or unrelated marketing. Disclosure to an authorized 3PL, carrier or service provider for a requested operation is for that operation. Access to a marketplace does not permit using its customer information for unrelated purposes.

Where a legal basis is required, the basis depends on the activity: performing an agreement, legitimate interests in operating and securing the service balanced against individual rights, legal obligations, or consent where required. The business instructing us to process customer information must establish its own lawful basis. Acceptance of a privacy notice is not blanket consent to every possible use.

4. Account access and sharing between businesses

Authorized company administrators, assigned warehouse staff and permitted Client users receive information according to their role and access. Client-facing records may be visible to the relevant Client or Seller; internal staff-only notes are intended for authorized warehouse staff. An account role does not grant unrestricted access to other companies or Client wallets.

Fulfillza personnel may access information as needed for authorized support, operations, security or legal responsibilities. We use account and role controls to restrict access. Report an unexpected disclosure or incorrect account relationship promptly. Removing a user or disconnecting a relationship does not erase historical business or audit records already lawfully created.

Recipients can download, print or otherwise retain information in the course of authorized work. Those copies remain the responsibility of the business controlling them and may need a separate deletion request.

5. Subscriptions, payments, funding and withdrawals

Stripe handles the full card or bank details entered into its payment forms. Fulfillza receives transaction and customer identifiers, amounts, status, billing contact information and limited payment-method information such as brand and last digits. We do not store the full card numbers, card security codes or bank-account numbers entered into those Stripe forms.

Platform subscription payments are separate from your connected Stripe Client invoice and service-credit transactions. Company shipping, Client service credit, Client shipping, subscription processing credits and security deposits have distinct ownership and purposes.

For bank/Zelle shipping funding and deposit requests, we process the submitted amount, payment reference, payer details, notes, screenshot or proof, review outcome and verified receipt information. Withdrawal processing may involve identity, original funding and payout-destination evidence needed to verify the original payer. A request or screenshot does not itself transfer funds.

Unlike Stripe-hosted forms, a document you upload may contain full financial details if you include them. Redact unnecessary account numbers, unrelated transactions and sensitive details before uploading. Never send passwords, card security codes, private keys or one-time verification codes. Payment providers and banks may retain their own records under their privacy policies.

6. Marketplace connections and connected tools

When an authorized user connects a store or marketplace, we process its account identifiers, authorization credentials, permissions and information supported by the approved, enabled integration. Depending on that integration, this can include catalog, inventory, order, recipient and fulfillment data. References to Shopify, Amazon, Temu or other platforms do not mean every connector is active or approved for every data category.

We exchange only the information needed for the authorized enabled workflow, including supported inventory or fulfillment updates. An authorized spreadsheet or export destination can receive the fields included in that configuration. Confirm the destination and who has access before enabling a connection or exporting a file.

You can revoke access in the provider's app settings and disconnect supported connections in Fulfillza. Revocation affects future access using that authorization; it does not erase existing operational records, cancel a subscription or remove copies already held by independent recipients. Provider-required deletion requests are assessed with the affected business.

7. Labels, shipping providers and optional AI reading

Requested rates, labels, tracking and delivery workflows send necessary sender, recipient, address, package and shipment details to the selected carrier or shipping intermediary. These providers may process information independently for delivery, billing, fraud prevention and legal obligations. A printed or uploaded label can contain personal information in both visible text and barcodes.

When optional OpenAI label-reading assistance is enabled, a label page that local text or barcode readers cannot reliably resolve may be sent automatically to the OpenAI API to suggest a tracking number. The selected page image can contain recipient names, addresses and other printed details; asking for only a tracking number does not redact that image. Suggestions support human review and do not themselves verify a shipment.

Provider processing and retention can differ from Fulfillza's local storage. Requesting that an AI response not be stored is not a guarantee of zero provider retention or immediate deletion of safety logs. Contact support before uploading labels if your business or marketplace has restrictions on this processing. Disabling future assistance does not recall an already transmitted request.

8. Service providers and other disclosures

We use service providers for hosting and infrastructure, communications, payment processing, technical support and authorized processing. These categories receive the account, contact, technical, payment-status or operational information needed for their task. Relevant providers include our hosting service (Hostinger), Stripe, the selected shipping providers, enabled marketplace or spreadsheet providers, and OpenAI when label assistance is enabled. Their involvement depends on the services actually used.

We may disclose proportionate information to professional advisers, insurers, regulators, courts or law enforcement when reasonably necessary for advice, valid legal process, fraud investigations, protection of rights and safety or compliance with law. We may share relevant information in a business transfer such as a merger or acquisition, subject to applicable privacy obligations.

A business may request information about the providers, processing locations and contractual arrangements relevant to its account at admin@fulfillza.com. A provider name in this policy is not a certification of approval by a marketplace or a promise that all provider services are enabled.

9. Cookies, browser storage and communications

Session cookies and related browser storage support sign-in, request security and interface preferences. Technical requests may also reach the hosting, payment or external asset providers used by a page. Browser cookie controls can limit storage, but blocking essential cookies can prevent sign-in or other features from working. Removing a browser cookie does not delete server records or cancel billing.

The warehouse integration does not require advertising pixels on shoppers' storefront browsers. Customer information generally comes from a merchant, 3PL or authorized connection rather than direct tracking of storefront browsing. We do not use fulfillment customer information for cross-context behavioral advertising.

Service notices, verification, password recovery, receipts and security messages are connected to account operation. Optional marketing, if separately offered, is subject to the choices and unsubscribe method provided with it. Contact support about privacy preferences; these choices do not waive essential legal or transaction communications.

10. Retention, deletion and backup copies

Retention depends on the purpose and data category, necessary fulfillment and returns work, an authorized business's instructions, applicable marketplace restrictions, outstanding transactions and legal requirements. We do not treat an active subscription or an accounting obligation as permission to retain every customer label or address indefinitely.

Account and membership data are kept as needed for the relationship and lawful closure. Order, recipient and label data are subject to their operational need and applicable deletion duties. Limited financial, funding, withdrawal, fraud, security and dispute evidence may remain for required accounting, legal or claims periods, with personal data limited to what is necessary. Transient verification and processing data should not be retained merely because longer-lived business records remain.

Disconnecting a store, ending a subscription and deleting personal information are separate actions. A deletion request is assessed for records that can be deleted or de-identified and for any specific lawful preservation requirement. We explain relevant exceptions rather than promising immediate erasure of every record.

Backup copies can persist until replacement or expiry and remain subject to restricted use. Independent carrier, payment, AI or marketplace copies follow the applicable recipient arrangements and legal duties; deletion from Fulfillza does not itself erase those copies. A 3PL's downloads, spreadsheets, printouts or local files also require its own handling. Contact us about a specific category or deadline; there is no single period applicable to all records.

11. Security and incident communications

We use access authentication, role and account restrictions, encrypted web connections and safeguards for integration credentials to help protect the service. We limit access according to the work being performed. These measures do not guarantee absolute security or establish that every stored field, backup or downloaded copy uses the same encryption.

Protect your login and devices, use available authentication safeguards, verify invitations and remove access for departing personnel. Avoid unnecessary sensitive information in notes, screenshots and support attachments. Promptly report suspected unauthorized access or disclosure to admin@fulfillza.com without including passwords or verification codes.

Where a personal-data incident requires notification, we will notify the affected business, individuals or authorities as required by applicable law and the relevant agreement. The recipients, information and timing depend on the circumstances and legal duties.

12. Processing locations and international transfers

Fulfillza is operated by a Texas business. Hosting, support, payment, shipping, marketplace and other providers may process information in the United States or another country. A business registration location does not determine the location of every server or provider copy.

Where applicable law requires a cross-border transfer mechanism, the relevant parties must establish an appropriate mechanism and other required safeguards. This policy alone does not establish an adequacy decision, certification or executed contractual clauses. Contact us about actual locations and transfer arrangements before enabling a workflow with geographic restrictions.

13. Your rights and how to make a request

Depending on applicable law, you may have rights to confirm processing, access or receive a copy, correct inaccuracies, delete information, obtain a portable copy, object to or restrict certain processing, withdraw consent for processing based on consent, or opt out of sale, targeted advertising or qualifying profiling. We do not sell personal data, use fulfillment customer data for targeted advertising, or use label suggestions to make decisions producing legal or similarly significant effects about individuals.

Email admin@fulfillza.com with the subject "Privacy request" and your account/store identifier, request type and sufficient context to locate the records. You may also use official in-app support. We verify identity and authority proportionately and may request clarification; we do not require passwords, access tokens or full bank details. An authorized agent may contact us with evidence of authority where the law permits.

For information controlled by a merchant or 3PL, we may coordinate with or direct you to that business and assist with its valid instructions. We will not disclose another account owner's private information to fulfill a request. We explain applicable exceptions or denial reasons and the available appeal route. Requests are generally free, subject only to lawful exceptions for excessive or similar requests. We do not discriminate for exercising applicable rights.

14. Texas and other regional rights; appeals

Privacy laws differ in their coverage, business exemptions and treatment of commercial or employment records. A Texas business address does not mean every record is covered by the Texas Data Privacy and Security Act, nor does it remove rights that apply under another jurisdiction.

Where the Texas Act applies, we respond to a verified rights request without undue delay and within 45 days, with one additional 45-day extension when permitted and explained within the initial period. To appeal a denial, email admin@fulfillza.com with the subject "Privacy appeal" and the original request details. We provide a written appeal decision within 60 days where that Act applies. If an applicable appeal is denied, you may contact the Texas Attorney General.

Individuals in other jurisdictions may also contact their competent privacy regulator and use applicable access, deletion, correction, portability, objection, restriction or appeal rights. We apply the deadlines and verification rules required by the law governing the request. Withdrawing consent does not invalidate earlier lawful processing or require deletion of records we must lawfully retain.

15. Children and sensitive information

Fulfillza account registration is for adults acting for businesses and is not directed to children. Customer orders submitted by a merchant can nevertheless include household or recipient information. A merchant must avoid unnecessary information about children and comply with applicable restrictions.

Do not upload Social Security numbers, government identifiers, health information, biometric identifiers or other sensitive data unless specifically required for a lawful, disclosed verification or service purpose. Ordinary label images and financial screenshots can contain sensitive details; minimize them. If you believe a child or another person has provided unnecessary sensitive information, contact us for review and appropriate action.

16. Policy changes and related documents

This policy describes the 3PL workflows and complements the 3PL Terms of Service. It does not authorize processing beyond applicable law, an accepted processing agreement or the permissions granted by a connected platform.

We may update the policy when practices, services or legal requirements change. We identify the effective date and provide material-change notice and additional consent where required before applying a materially different use. A posted update is not blanket consent to a new use that legally requires a separate choice. You may save or print this policy.

17. Contact

E-COM SOL LLC / Fulfillza — Texas, United States. Email admin@fulfillza.com for privacy requests, appeals, provider/location questions or suspected data exposure. Website: fulfillza.com. Use only official channels and redact unnecessary sensitive information.