Privacy Policy

Effective 20 October 2026

1. Who we are

Lufias is operated by LUFIASFARZA TRADING (201803414038 / 002918821-W), a business registered in Malaysia ("Lufias", "we", "us"). We provide Lufias Commerce (online stores built on WooCommerce) and Lufias Channels (an add-on that connects those stores to marketplaces such as Shopee and TikTok Shop). You can reach us at hello@lufias.dev.

We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. This website

lufias.dev uses no cookies, no analytics and no third-party scripts. Like every web server, ours briefly records technical request details (such as IP address, browser and the page requested) to keep the service secure and working. These records are kept for a short period and are not used to identify or profile visitors.

3. Lufias Channels: what we process

When a store uses Lufias Channels, we process only what the service needs:

• Store account: the store's name and web address, the plan, and the contact details the store owner gives us.
• Connected shops: each marketplace shop's identifier, name and region, and the authorisation tokens the marketplace issues when the seller approves Lufias Channels. Tokens are stored encrypted.
• Product data: what the store sends to be listed: titles, descriptions, images, prices, stock, weights, dimensions and marketplace attributes.
• Listing records and activity log: each listing's status on the marketplace, and a log of connections and listing events shown to the store owner. The activity log is kept for 180 days.
• Marketplace notifications: messages the marketplaces send about connected shops and listings, kept for 30 days.

The current version of Lufias Channels does not collect buyers' names, addresses or contact details.

4. How we use it

We use this data only to provide the service the store has asked for: to connect its shops, check and publish its products, keep prices and stock in line, show listing status, and keep the service secure. We do not sell personal data and do not use it for advertising.

5. Who we share it with

• The marketplaces the seller connects (such as Shopee and TikTok Shop), through their official interfaces, only as the seller instructs, for example when a product is published.
• Our hosting providers, who run the servers for us and may not use the data for anything else.
• Authorities, where the law requires it.

6. Security

All connections use HTTPS. Marketplace tokens are encrypted at rest. Every request between a store and the Lufias hub is signed with the store's own secret, limited in time and cannot be replayed. Access to production systems is restricted.

7. Keeping and deleting data

When a seller disconnects a shop, its authorisation tokens are deleted. When a store stops using Lufias Channels, its data is deleted within 30 days, except where the law requires us to keep it longer. Activity logs and notifications are deleted after the periods above.

8. Your rights

Under the PDPA you may ask to access or correct your personal data, or withdraw your consent to its processing (which may mean we can no longer provide the service). Write to hello@lufias.dev and we will reply within 21 days.

9. Changes

We will update this page when our practices change and show the new effective date at the top. Significant changes will also be told to the stores that use our services.