SILK

SILK Privacy Policy

Effective date: September 6, 2026 Source language: Hebrew (this is a translation)

1. About SILK

SILK is a marketplace where sellers open their own stores and list products in them, and buyers find products and contact sellers directly (via WhatsApp, Telegram, or phone) to complete the transaction. As of now, SILK does not process payments — all payment is carried out directly between the buyer and the seller.

  • Operator: SILK
  • Email for privacy inquiries: privacy@silk.co.il

We protect your data in accordance with the Israeli Protection of Privacy Law, 5741-1981, and its regulations (including Amendment 13).

2. Scope

This policy applies to all SILK services, including:

  • SILK's web application;
  • sellers' stores and the product catalog storefront;
  • placing orders (including guest orders, without registration);
  • communication between the platform and users (order notifications, etc.).

Our principles:

  • transparency and fairness;
  • data minimization — we collect only what is actually used in SILK's data schema, without "preparing in advance" for features that do not yet exist;
  • accuracy and confidentiality of stored data.

3. What data we collect

Below is the data SILK actually collects in the current version of the platform, tied to real fields in the database. We do not describe categories that do not currently exist in our systems technically (for example, geographic location, browsing history, or biometric data — SILK does not collect these).

3.1 Account data (profiles table)

  • Phone (phone) and its verification flag (phone_verified_at) — this schema field is prepared for future verification via an SMS code, but this feature is not currently active (there is no integration with an SMS provider, e.g., Twilio); a phone number entered by the user is stored, but does not currently undergo OTP verification.
  • Full name (full_name) and profile picture (avatar_url) — filled in automatically from data received when signing in via Google, or entered manually by the user.
  • Interface language (locale).
  • System role (role) — regular user, moderator, or admin.
  • "Seller" status is not stored separately: any user who has at least one store (a record in the stores table with an owner_id pointing to their profile) is considered a seller.

3.2 Sign-in and authentication data

  • Sign-in is possible via email (magic link, a one-time link sent to your email) or via Google OAuth. Sign-in via phone number (SMS code) has not yet been technically implemented.
  • The session is stored in secure server-side cookies (via Supabase SSR), not in the browser's localStorage.
  • When signing in via Google, we receive from Google a name and, if available, a profile picture URL — only the data transferred by Google as part of the standard OAuth profile.

3.3 Store data (for sellers, stores table)

  • Store name, URL (slug), description (in multiple languages), design, logo.
  • Contact channels with buyers (contact_channels) — WhatsApp, Telegram, and/or phone, entered by the seller voluntarily so buyers can contact them.
  • Store status and the store's status of inclusion in the marketplace's general catalog (catalog_status) — see Section 8 below.
  • Store market (market_id) — currently the only active market is Israel (currency ILS, Hebrew language); the field is technically prepared for additional countries, but there are currently no other active markets.

3.4 Product data (products table)

  • Product name and description (original and machine-translated into other languages), price, currency, condition (new/used), attributes, inventory, publication status.
  • This is data entered by the seller about their product, and not personal data of the buyer.

3.5 Order and buyer data (orders, order_items, carts tables)

When placing an order — including a guest order without registration — we collect:

  • the buyer's name (buyer_name);
  • the buyer's phone (buyer_phone) — a required field, since this is the channel through which the seller contacts the buyer to complete the transaction;
  • an optional note for the order (buyer_note);
  • the composition of the order (which products, in what quantity and at what price at the time of the order);
  • the order status and payment status (as of now SILK does not actually process payments — the payment status in the system is informational only, until a real payment integration is activated);
  • if the order was placed by a registered user — the order is linked to their account (buyer_id); if placed as a guest — the order is not linked to an account, but to a one-time cart token.

This data is transferred to the seller of the store where the order was placed, so that they can contact the buyer and complete the transaction. This is the core function of the platform, so the transfer to the seller is necessary to fulfill the buyer's request and is not optional.

Notice at the time of collection (Section 11 of the Protection of Privacy Law): providing your name and phone number when placing an order is done voluntarily, but without them the order cannot be transferred to the seller. The data is stored in SILK's database and transferred to the seller of the store and to the infrastructure providers detailed in Section 6. By clicking the submit-order button (via any channel — on the website, WhatsApp, Telegram, or phone), you confirm that you have read this notice and agree to these Terms of Service and this Privacy Policy, even if you are not registered.

3.6 Shipping addresses (addresses table)

For registered users who save a shipping address: the recipient's name and phone, city, street, apartment, postal code, country, and free-text notes. Saved at the user's discretion (for reuse in future orders), and not necessarily linked to a specific order.

3.7 Payment data (payments table) — for future use

SILK's data schema already includes a table for payment transactions (provider, transaction ID, amount, status, "raw" data from the payment provider) — but this is technical infrastructure prepared in advance for the future: as of the publication date of this policy, SILK is not connected to any payment provider and does not process real payments. Once a payment integration is activated, this policy will be updated to specify the particular payment provider and the terms for processing card/payment data.

3.8 Push notifications and devices (notifications, user_devices tables)

  • Device token (for sending push notifications), platform type (iOS/Android/web), and additional device metadata.
  • Notification content (e.g., a message to a seller about a new order), and delivery/read status.
  • Collected only when notification features are used and retained until the user disables them or the device is deleted.

3.9 Technical and analytics data

  • IP address and device data required to operate the session and to protect against abuse (e.g., CSRF protection for the session cookie).
  • Technical operational logs of the application (server/database logs) — not a separate analytics product.
  • Visit analytics data: Vercel Analytics (always, anonymously, without cookies) and, subject to your consent via the cookie banner, Google Analytics / Microsoft Clarity, as well as advertising measurement and remarketing data via Meta Pixel — see Section 13 below for full details.

4. Legal bases and purposes of processing

4.1 Based on contract (fulfilling the user's request)

  • providing the platform's functionality (creating a store, listing products, placing an order);
  • transferring order data (name, phone, order composition) to the seller so they can contact the buyer;
  • sending notifications about order status.

4.2 Based on consent

  • signing in via Google OAuth (the user initiates this themselves, explicitly);
  • push notifications (require explicit approval at the device/browser level);
  • analytics and marketing cookies (Google Analytics, Microsoft Clarity, Meta Pixel) — via the cookie banner, see Section 13 below; in the future, additional marketing communications (e.g., email newsletters) will be added in the same way, if and when they are added.

4.3 Based on SILK's legitimate interest

  • securing the platform, preventing fraud and abuse, detecting bots and automated data collection;
  • enforcing the Terms of Service — including suspension, blocking, and preventing re-registration of blocked users (see Section 10);
  • establishing, exercising, or defending against legal claims and demands;
  • internal analysis, service improvement, and feature development (see Section 7);
  • complying with legal, regulatory, and authority requirements.

5. How SILK records consent

Registered users. On first sign-in to an account, and each time a new, material version of the Terms of Service or of this policy is published, the user is required to actively confirm (by checking a box that is not pre-checked) the current documents before continuing to use the service. SILK records every such confirmation in an immutable record (the legal_documents and legal_consents tables): the user's identity, the document version, its language, the time of confirmation, the IP address, and the browser identifier (user agent). These records are retained for as long as the account exists and thereafter for as long as needed for evidentiary purposes, dispute resolution, and compliance with legal requirements, and constitute prima facie evidence of the giving of consent and of its content.

Guest buyers. In the absence of an account, consent to the Terms of Service and to this policy is given by clicking the submit-order button, after an explicit notice with links to the documents is displayed near the button (see Section 3.5). SILK records the time of the order and its details.

Consent to marketing communications is collected separately, in a separate box that is not pre-checked, and is not a condition for using the service; SILK records every choice (consent or refusal) in a separate record (marketing_consents) with the time, IP, and browser identifier.

Separate, immediate (opt-in) consent to analytics and marketing cookies is collected via the cookie banner — see Section 13 below — and is stored locally in your browser, not in the database.

6. Who we share data with

6.1 The store's seller

When you place an order (including as a guest), we transfer to the seller of the selected store: your name, your phone number, the order note, and the order composition — so that the seller can contact you and complete the transaction. This is at the core of how SILK operates, and is not an optional data transfer.

6.2 Infrastructure providers (data processors)

  • Supabase — SILK's database, authentication, and file storage run on Supabase's infrastructure. Supabase acts as a data processor on our behalf.
  • Vercel — the website's hosting provider; also operates Vercel Analytics (see Section 13) — an aggregated, anonymous analytics service, without cookies and without identifying the user.
  • Google (OAuth, and, subject to your consent, Google Analytics) — if you sign in via Google, Google transfers to us a limited set of your profile data (name, profile picture) in accordance with its privacy policy. If you consented to analytics cookies, Google also receives relatively anonymous usage data on the website as part of Google Analytics.
  • Microsoft (subject to your consent, Microsoft Clarity) — if you consented to analytics cookies, Microsoft receives usage and behavior data on the website as part of Microsoft Clarity.
  • Meta (subject to your consent, Meta Pixel) — if you consented to marketing cookies, Meta Platforms Ireland Ltd. (and/or Meta Platforms, Inc., depending on your location) receives usage and behavior data on the website — including product views, add-to-cart, checkout initiation, and order completion (without payment details, which SILK does not process) — for the purpose of measuring advertising effectiveness and remarketing on the Facebook/Instagram platforms.
  • Future SMS provider (e.g., Twilio) — once sign-in/verification via SMS is technically implemented, this policy will be updated to specify the particular provider.

We work only with providers that contractually guarantee an adequate level of data protection.

6.3 Government authorities

Data is transferred only when required by law (for example, by a court order).

6.4 Limitation of liability for third-party actions

SILK transfers data to sellers and infrastructure providers only to the extent required to operate the platform, and on the basis of contracts that ensure data protection. We bear no liability for the actions of third parties that violate their obligations, provided that SILK has fulfilled its duties to ensure information security and legal compliance.

7. Use of platform data for SILK's business purposes

SILK may use data generated on the platform for its business purposes. We distinguish this right by the type of data:

  • Catalog and product data (names, descriptions, images, prices, inventory, categories) — is not personal data, and SILK may use it without restriction in accordance with the license under Section 4 of the Terms of Service, including displaying it in the general catalog, transferring it to external platforms (search engines, feeds, advertising networks), translating and automatically processing it, and training recommendation, search, and artificial intelligence systems.
  • Aggregated and anonymous data (for example: how many products in a given category sell on average, which categories are growing, anonymous activity statistics) — SILK may use this broadly and without time limitation: for analysis, for developing new product features (including training statistical models and artificial intelligence), and for revenue-generating activity (for example, market reports, benchmarking metrics for sellers, targeted advertising), without further consent, since this data does not allow identification of a specific user. SILK may derive such data from personal data through anonymization, and the derivation itself is a legitimate processing activity.
  • Personal data (data of a specific buyer or seller) — is used only within the purposes described in Section 4 of this policy, and is not sold and is not transferred to third parties for their own marketing purposes without separate consent.

8. Listing products in the marketplace's general catalog

Sellers list products in their stores. SILK has the technical capability (catalog_status with the values hidden by default, pending_review, listed, delisted) to include products in the marketplace's general catalog — a showcase, search, and cross-store display of products from all stores, not limited to a single store.

As of the publication date of this policy, the general catalog is not active — all stores are, by default, in hidden status, and no product is displayed outside its own store. If and when SILK activates this feature:

  • the decision to include a specific store/product in the general catalog is made by SILK, not by the seller;
  • images and product descriptions included in the general catalog will be processed in the same way as within a separate store — for the purposes of this policy, publication in the general catalog does not change the category or scope of personal data collected, since the product listing itself (unlike an order) does not contain a buyer's personal data.

9. International data transfer

Your data is stored in Supabase data centers in the European Union, outside Israel. We protect data transferred across borders by means of contracts with infrastructure providers and technical security measures, in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Outside the State's Borders), 5761-2001. This document is written for SILK's activity in Israel only; expanding activity to additional markets (such as Russia) will require an update to this policy in accordance with the requirements of the relevant local law (including data localization requirements, if applicable) before launching activity in that market.

10. Data retention periods

  • Profile and store data — for as long as the account is active, and after its closure or termination (by you or by SILK) — for the period required for dispute resolution, auditing, backup, and compliance with legal requirements.
  • Identifiers of blocked users (email, phone, IP addresses, device and browser identifiers) — without time limitation, to the minimum extent required to enforce the block and prevent re-registration in violation of the Terms of Service.
  • Consent records (legal_consents, marketing_consents) — for as long as the account exists, and thereafter for as long as required for evidentiary purposes and compliance with legal requirements.
  • Content that was removed or whose store was closed — SILK may permanently delete it at any time and is not required to provide a copy; copies may remain in backups, caches, and third-party systems to which it was lawfully transferred, as described in Section 4.2 of the Terms of Service.
  • Order data (including guest orders) — retained for the period required to resolve possible disputes between the buyer and the seller, and to comply with accounting/tax requirements, as applicable.
  • Technical operational logs — a limited period required to ensure security and fix faults.
  • Inactive accounts — we reserve the right to delete accounts, stores, and content that have been inactive for a prolonged period, at our discretion. Where possible, we will send advance notice to the registered email address.
  • Some data may be retained for a longer period if required by law (for example, for accounting and tax purposes).

11. Your rights

  • Right of access — to request a copy of your data.
  • Right of rectification — to correct inaccurate data.
  • Right of erasure — to request deletion of data, unless it is required to perform a contract, to enforce the Terms of Service (including retaining blocking identifiers), to establish or defend against claims, for backup, or by law. Erasure does not apply to aggregated and anonymous data, to non-personal catalog and product data, and to orders that have already been transferred to the seller (the seller has independent control over the copy they received).
  • Right to restrict processing — to suspend the use of data that is in dispute.
  • Right to withdraw consent — to withdraw consent to non-essential processing (for example, push notifications, signing in via Google, or analytics and marketing cookies — via "cookie settings") at any time, without any effect on basic use of the platform, except for features that technically require this consent.
  • Right to lodge a complaint with the competent privacy protection authority.

To exercise these rights, contact the email address in Section 16. SILK may require reasonable identity verification before handling the request, and will respond within the period prescribed by law. Repeated, unreasonable, or excessive requests may be denied or may be subject to a reasonable fee, to the extent permitted by law.

12. Data security

  • We implement technical protection measures appropriate to the scale of the platform (connection encryption, restricted access to the database at the Row Level Security policy level — every table in SILK's database is protected so that, by default, a user sees only their own data or data explicitly intended for public display).
  • Access to data within the SILK team is restricted by role (role in the profiles table: user, moderator, admin).
  • In the event of a security incident affecting your personal data, we will report it to the Privacy Protection Authority within 72 hours of discovering the incident, as required by Amendment 13 to the Protection of Privacy Law, and will notify you directly to the extent required by law and by the severity of the incident.
  • SILK bears no liability for failures in service delivery or data protection caused by force majeure circumstances (including cyberattacks, infrastructure failures, or natural disasters), provided that we have taken all reasonable measures to prevent such incidents.

13. Use of cookies, analytics, and advertising

Technically necessary cookies. SILK uses cookies to operate the session (signing in to an account, maintaining the session, CSRF protection, interface language). These cookies are always active, do not require consent (they are necessary for providing the service itself), and are not transferred to third parties for advertising purposes.

Aggregated, anonymous analytics (no cookies). SILK uses Vercel Analytics — a service of the infrastructure provider (Vercel Inc.) that does not use cookies and does not collect information that allows identification of a specific visitor or matching their actions across different sites; only aggregated, anonymous data on visitor traffic is collected, and the data is retained for no more than 24 hours. Since this tool is not technically a cookie and does not identify the user, it always operates, without the need for separate consent.

Analytics and marketing cookies (only with one consent, shared by both categories). SILK may use Google Analytics (Google Ireland Ltd. / Google LLC) and Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corporation) to analyze user behavior on the website (pages viewed, navigation, errors), and also Meta Pixel (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) to measure advertising effectiveness and for remarketing on the Facebook/Instagram platforms — including product view, add-to-cart, checkout initiation, and order completion events. Both of these types of cookies (analytics and marketing) are activated together, only after a single active consent from you via the cookie banner shown on your first visit: the "Accept All" and "Necessary Only" buttons have equal visual weight, and the consent box is not pre-checked. Refusal does not restrict access to the site's functions. You can view your decision and change it at any time via the "Cookie settings" link at the bottom of the site / in the "Security and rules" area of your personal account — this action immediately disables scripts already loaded (including Meta Pixel) and deletes the corresponding cookies (including _ga, _clck/_clsk, and also _fbp/_fbc from Meta).

14. Minors

Registering with SILK and opening a store are available only to users aged 18 and over. By registering, you represent and confirm that you are 18 or older. If we become aware that personal data of a minor under this age was collected without the consent of a parent or legal guardian, we will act to delete it as soon as possible.

15. Changes to this policy

If we change anything in this policy, we will publish the updated text on the website and you may review it at any time.

Insofar as the change involves a material change in the purpose of data processing, in the types of personal data collected, or in the identity of the party to whom the data is transferred (for example: a new payment provider, a new use of data for marketing purposes) — we will notify you of this reasonably before the change takes effect with respect to you, and will request renewed consent, in accordance with the principle of informed notice and consent set out in the Protection of Privacy Law, 5741-1981, and its regulations. Non-material changes (for example, wording, clarity, updating contact details, expanding the description of existing processing) will take effect upon publication. SILK determines, at its reasonable discretion and in accordance with the law, whether a change is material.

16. Contact

For questions and complaints related to the processing of personal data, send an email to privacy@silk.co.il.