Privacy policy

What we collect when you create an account, order a watch or send a request, why we need it, who else handles it, and how to have it corrected or deleted.

Last updated 17 September 2026

Who we are

Ducioo × ool is a collaboration and part of ducioo. The business responsible for your information is [BUSINESS LEGAL NAME], [REGISTERED ADDRESS]. For anything in this policy, email ducioocanton@gmail.com.

What we collect

Your account

• Your name, email address and, if you give it, phone number.
• Your password, stored only as a salted one-way hash. We cannot read it.
• If you use Continue with Google: your Google account identifier, name and verified email address. We do not receive your Google password, contacts or anything else in your Google account.

Your orders

• The straps and quantities you order, the price, and the payment method.
• The delivery name, phone number and address you give.
• The order’s progress: payment status, carrier and tracking number, and a history of each change.

Payments

• Crypto is paid on NOWPayments’ own payment page. We receive a payment reference, the coin, the amount due and the amount received, and the payment status. We never see your wallet or exchange account. Transactions on public blockchains are visible to anyone.
• Bank transfer is arranged in a WhatsApp chat with us. Your WhatsApp number and the messages you send are seen by our team and handled by WhatsApp under its own privacy policy. Bank details you send are used only to match your payment.

Custom finish requests

• The colour you describe and the email or phone number you give us to reply to.
• A one-way hash of your IP address, used only to stop the form being flooded.

Security records

• Failed sign-in attempts, with the email address and IP address used, so repeated guessing can be locked out. These are deleted after 15 minutes.
• A record of each signed-in session, holding only a hash of the session token, until you sign out or it expires after 30 days.

Cookies and storage on your device

We use no advertising, analytics or tracking of any kind, and no third-party scripts. The site sets only these:

• __Host-dxo_session, a cookie that keeps you signed in (30 days, or until you sign out).
• __Host-dxo_oauth, a cookie that protects the Continue with Google step (10 minutes).
• Your bag and your light or moss colour choice, kept in your browser’s local storage, and the strap you last looked at, kept for the visit. These stay on your device; we do not receive them until you check out.

Why we use it

• To take, confirm, deliver and support your order, and to let you follow it in your account.
• To keep accounts and payments secure and to prevent fraud.
• To reply to custom finish requests and questions you send us.
• To keep the records that tax and consumer law require.

We do not sell your information, and we do not send marketing messages.

Who else handles it

• Cloudflare hosts the site and its database and protects our order dashboard. Like any web host, it processes your IP address to deliver pages.
• NOWPayments processes crypto payments.
• Google, only if you choose Continue with Google.
• WhatsApp (Meta), only if you pay by bank transfer.
• Delivery carriers receive the name, address and phone number needed to deliver your watch.

Each handles your information under its own privacy policy. We share it with no one else unless the law requires it.

Where it goes

Cloudflare serves the site from data centres around the world. Watches ship from China and other production locations, so order and delivery details are handled by our team and carriers there, and wherever your watch is delivered.

How long we keep it

• Your account: until you ask us to delete it.
• Orders: [ORDER RECORD RETENTION PERIOD], as tax and consumer law require.
• Custom finish requests: [REQUEST RETENTION PERIOD].
• Failed sign-in records: 15 minutes. Sessions: until sign-out or 30 days.

Your choices

You can ask us to show you, correct, export or delete the information we hold about you, or object to how we use it. Email ducioocanton@gmail.com from the address on your account, and we will reply within [RESPONSE TIME, e.g. 30 days]. We may need to keep order records the law requires even after deleting your account. You can also complain to the data protection authority where you live.

Security

Passwords are hashed, sessions use secure cookies that scripts cannot read, payments are confirmed only by signed notifications from NOWPayments, and our order dashboard is behind separate sign-in. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Children

This site is not intended for anyone under 18, and we do not knowingly collect their information.

Changes

If we change this policy, the new version will appear here with a new date. If a change affects how we use information you have already given us, we will tell you first.