Zap+DM works, but DMs can fail and add metadata. Upgrade idea: LNURL-pay or BOLT12 where successAction returns a one-time URL keyed to the payment hash. Buyer submits just the address there, no email. Auto purge after ship. We use this at Masters of The Lair. Would that fit your flow?