Privacy policy
Last updated: November 1, 2026
StoreDuet is a system for managing inventory and syncing products between online stores, run by Redix Digital ("we"). This policy explains what the system keeps, why, who it's shared with, how long it's kept, and how to ask to see, correct or delete it. It applies to https://storeduet.com and the system at https://app.storeduet.com.
In short: we don't sell data, show ads, or use tracking or analytics tools, and we use data only to run the system for you.
1. What is kept
Your user details
- Name, email address and business name.
- A password, if you signed up with one. It's kept only as a one-way hash, so it can't be read.
From Google, when you sign in with Google
- Name, email address, whether Google verified the address, profile picture, and the Google account ID.
- That's all the system asks Google for. It doesn't access anything else in the account, such as email, files or contacts, and it doesn't keep the access tokens Google sends.
Sign-in details
- A sign-in cookie that identifies your session.
- When you sign in with Google, the IP address and browser type are kept with the session.
Data from the stores you connect
- Products, variations, SKUs, prices, stock quantities and links to product pictures.
- The stores' access keys (or the approval you gave inside the store), kept encrypted. The system never receives the store's own password.
Orders and your customers' details
Only if you turned the Orders page on. It's off until you do. While it's on, the system keeps from the stores' orders: the customer's name, email, phone, billing and shipping addresses, the customer's note, the items, the amounts, and the name of the payment and shipping method. Card details never reach the system. Wolt orders carry a first name and last initial, the delivery address, and a phone only when the venue delivers itself.
Activity log
Every change sent to the stores: what it was before and after, in which store, and the name of the user who made it.
Security logs
A record of events such as a failed sign-in, a sign-up, an invitation created and actions on stores. The record includes an email address, and sometimes an IP address.
Pictures you upload
Pictures for a new product are kept on the server for a short while, until they reach the stores.
A request from the home page
Asking to join through the form on the home page sends a name, an email address, which stores you have, and a message if you add one. The request isn't kept in the system: it is emailed to support, the answer goes to the address you gave, and the request is deleted after a month.
2. What it's used for
- Running the system: showing your stock, sending the changes you asked for to the stores, and syncing them.
- Knowing who you are when you sign in, and protecting the account.
- Security: spotting break-in attempts and abuse, and investigating faults.
- Answering your requests.
- Support and oversight: the system administrator at Redix Digital can view your account as you see it, in view-only mode, with no way to change anything in it. Every view is recorded in the security log and ends by itself after an hour at most.
- Meeting legal requirements.
3. Legal basis
- Providing the service: most of the data is needed to give you the service you asked for.
- Consent: connecting a store, turning on the Orders page, signing in with Google and sending a request from the home page are your choice, and you can withdraw at any time.
- Legitimate interest: security logs and the activity log, to protect the system and you.
- Legal obligation: when the law or an authority's order requires keeping or handing over data.
4. Data received from Google
The system uses the data it receives from Google (name, email, profile picture and account ID) only to let you sign in and to identify your account. It isn't sold, passed to others, used for advertising, or used to train AI models. People don't read it unless you ask, or when needed for security or by law.
StoreDuet's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Data outside Israel
The system's server and database are with Hostinger in Lithuania, and its backups in France, both in the European Union. Cloudflare and Google process data on their networks around the world, the United States included. We work only with established providers committed to data security and privacy.
7. The stores' customers
The customers' details in orders belong to the business that connected the store. The business is responsible for them toward its customers, and we process them on its behalf and by its instructions. Only that business's users see them.
A store's customer who wants to see or delete their details should contact the store. If the store asks, we'll help. Turning the Orders page off, or disconnecting the store, deletes its orders from the system.
9. Security
- All traffic is encrypted (HTTPS).
- Store access keys are kept encrypted (AES-256-GCM). Passwords are kept only as a one-way hash.
- Each business sees only its own data, checked again on the server by every page and action.
- Rate limits on sign-in attempts and on requests from the home page, and security logs.
- Periodic security reviews of the code.
No system is 100% secure, but we do everything reasonable to protect the data.
10. Security incidents
If personal data is found to have been exposed or harmed, we'll report it to the Privacy Protection Authority as the law requires, email the people whose data was affected, explain what happened and what we did, and act to limit the harm and prevent it from happening again.
11. How long it's kept
| Data | How long |
|---|---|
| User and account details, including the data from Google and sign-in details | As long as the account is active. After a deletion request, deleted within 30 days. |
| A store's access keys and products | Until the store is disconnected. |
| Orders and customers' details | While the Orders page is on and the store is connected. Turning it off or disconnecting deletes them. |
| Activity log | 30 days. |
| Uploaded pictures | Until they reach the stores, and 48 hours at most. |
| An invitation to join (the invitee's email address) | Until it's revoked or its deletion is requested. |
| A request from the home page | In support's mailbox for one month, then deleted. |
| Security and server logs | By the hosting provider's deletion cycle. |
12. Your rights
Under Israel's Privacy Protection Law, you can ask:
- To see the data kept about you, and get a copy of it.
- To correct wrong data.
- To delete your account and your data.
- To object to a particular use of your data.
Send a request to support@storeduet.com from the address registered on the account, or the one you wrote to us from. We'll answer within 30 days. When an account is deleted, its business, connected stores, orders and logs are deleted too, except what the law requires us to keep. Access keys inside the store itself are removed in the store.
Without a name and email address an account can't be opened, and without a store connection the system can't sync it.
13. Age
StoreDuet is a service for businesses, for users aged 18 and over. We don't knowingly collect data about minors.
14. Changes to this policy
When the policy changes, we'll update this page and the date at its top. We'll give notice of a material change in advance, in the system or by email.
15. Contact
For any question or request about privacy: Redix Digital, support@storeduet.com.
If you didn't get a satisfying answer, you can contact Israel's Privacy Protection Authority.