Trust and privacy

• Kept in the EU: the database, the app that works on it, and email sending all run in Ireland.
• Each workspace can see only its own data. That is enforced by the database itself, so a mistake in the app cannot show one customer another’s list.
• Sending keys and LinkedIn and Instagram tokens are encrypted before they are stored, and never sent to your browser.
• Agent tokens are kept only as one-way hashes: even Drop cannot read them back.
• Drop does not train AI on your data, and nor does Anthropic, whose models write for Drop.
• Error reports have names, email addresses and request details stripped before they leave.

• Every contact carries the basis for emailing them, and the date they agreed when your export says so, and otherwise the date they were added, labelled as that.
• Someone who unsubscribes, bounces or complains can never be emailed again from that brand. The database refuses it, not just the app.
• Every email has a one-click unsubscribe and your postal address, placed by Drop so no layout can leave them out.
• Deleting a contact deletes them, while keeping the fact that they unsubscribed, so they stay unsubscribed.

• Only what you allowed on the approval screen. Sending, publishing, switching flows on, deleting and moving between brands are each a separate permission, granted by name.
• An agent may send to a limited number of people unattended, up to a limit you set. Above it, a person has to approve.
• A send or post an agent booked is checked again when it falls due. If the agent has been disconnected or lost permission, it does not go.
• Every action an agent takes is recorded on your Agents page, and you can disconnect it in one click.
• No agent, with any permission, can email someone who unsubscribed, or delete a contact.

The full detail is in the privacy policy, the terms and the cookies page. To report a security problem, write to karamole7@gmail.com.