Privacy policy

Your account. When you sign up and use Drop, Drop decides what to do with your account details and how you use the product. For this, Drop is the controller.

Your contacts. The people on your lists, and the emails and posts you send them, are yours. You decide who is on your list and what they receive; Drop processes that data on your behalf. For this, you are the controller and Drop is your processor, on the terms in the data processing section of the Terms. If you are on someone’s list and want your data removed, ask the business that emailed you; if you cannot reach them, write to us and we will help.

• Account details: your email address, and your name if you sign in with Google. Passwords are handled by our authentication provider and stored only as a secure hash.
• What you put in: contacts and their consent records, campaigns, flows, social posts and their pictures, your brand kit, and your postal address for email footers.
• Research about your business: when you give Drop your website, it reads that site and public web pages about your market, and stores a summary, competitors with their sources, an audience description and post ideas.
• Connected accounts: for LinkedIn and Instagram, the account’s id, name and picture, and an access token, encrypted before it is stored. For your own sending key, the key, encrypted.
• Agent connections: which agent you connected, the permissions you gave it, and a record of every action it takes, visible to you in Drop. Access tokens are stored only as one-way hashes.
• Sending results: whether each email was delivered, opened, clicked, bounced or complained about, and the numbers LinkedIn and Instagram report for your posts.
• Posts from a connected page: when you connect a LinkedIn page, Drop brings in its posts from the last year, including ones made outside Drop, with their text, date, link and numbers, so your results cover everything you post.
• Billing: your plan and Stripe’s customer reference. Card details go straight to Stripe; Drop never sees them.
• Visits to this website: counted with Vercel Web Analytics, which sets no cookies and stores no personal data.
• Errors: when something breaks, a report goes to Sentry with names, email addresses and request headers removed.

• To provide Drop: running your account, sending what you send, publishing what you publish, because you asked us to, under our contract with you.
• To keep it working and safe: error reports, rate limits, the agent action log and preventing abuse, as our legitimate interest in a reliable, secure service.
• To bill you and keep the records tax law requires: legal obligation.
• To write and research for you: only when you ask Drop to write something or research your business.

Drop does not sell data, does not show ads, and does not use your contacts for anything but your own sending.

Drop uses these services to run. Each receives only what its job needs.

Anthropic does not use data sent through its API to train its models, and neither does Drop. Where a service is outside the EU, the transfer is covered by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, as that provider offers.

• Your account and everything in it: while you have an account. When you ask us to close it, it is deleted within 30 days, apart from billing records the law requires us to keep.
• A contact you delete is deleted at once, except for the fact that the address unsubscribed, bounced or complained, which is kept so it can never be emailed again. That record is the law working, not an oversight.
• A connected LinkedIn or Instagram account: its token is destroyed the moment you disconnect it. Records of posts published through Drop stay, so your calendar and results stay accurate.
• Posts Drop brought in from a connected account (ones made outside Drop) are deleted 30 days after you disconnect it, unless you connect it again before then.
• An archived brand keeps its data until you ask for it to be deleted.

You can ask for a copy of your data, for it to be corrected, for it to be deleted, or to object to how it is used. Write to karamole7@gmail.com and you will have an answer within a month, usually much sooner. Some of it you can do yourself straight away: delete contacts on the Contacts page, disconnect an agent on the Agents page, and disconnect a social account on the Social page.

If you are not happy with the answer, you can complain to your data protection authority.

Sending keys and social tokens are encrypted before they are stored. Agent tokens are kept only as hashes. Each workspace can see only its own data, enforced by the database rather than by the app. More on the Trust page.

Drop sets only the cookies it needs to keep you signed in and finish connecting an account. There are no tracking or advertising cookies. The full list is on the Cookies page.

Drop is for businesses and is not meant for anyone under 16.

If this policy changes in a way that matters, account holders are told by email before it takes effect. The date at the top always says when it last changed.