Privacy Policy

What we collect

We collect information about you in three ways:

• You give it to us. When you create an account, verify your phone number, place an order, have a piece shipped, request a withdrawal, or write to support.
• Automatically. As you use the app, we record the activity your account generates and basic technical data about the device you use.
• From third parties. From the sign-in provider you choose, from our payment and payouts processor, and from the carrier that delivers your parcel.

The categories we collect are:

• Account and identity. The account identifier and email address released by Sign in with Apple or Google when you use it, or the email address you give us directly. If you use Apple’s Hide My Email, we receive the relay address rather than your real one.
• Date of birth and age attestation. Your date of birth, and a record that you confirmed you are 18 or over - the time you confirmed it, and the IP address you confirmed it from.
• Phone number. Your phone number, and the time it was verified by SMS code.
• Agreement records. The time you accepted the Terms of Service, the IP address you accepted from, and which version of the document you accepted.
• Shipping details. The recipient name, postal address and contact details for any piece you have shipped, and the tracking information that comes back.
• Transaction and activity data. The money you add and cash out, the boxes you open, the pieces credited to you, the pieces you sell back, and your running balance.
• Payment references. A reference from our payment processor, and the brand and last four digits of the card. Full card numbers never reach us - see section 4.
• Identity and bank details, collected through Stripe. If you withdraw cash, Stripe collects what it needs to verify you and pay you. That can include a government identification document, a passport or driver’s licence number, a social security or taxpayer identification number, your date of birth, and your bank account details. Stripe collects this on our behalf, as part of providing payouts to you, on its own hosted pages.
• Communications. What you write to us, and what we write back.
• Device and diagnostic data. App version, device model, operating system version, IP address, and crash and error reports.

So that the last category is not misread: because Stripe collects it on our behalf, we count it as information we collect, and we have listed it here rather than leave it unsaid. But it is entered directly into Stripe’s pages, and none of it - no identification document, no social security number, no bank account number - is transmitted to or stored on Drip Drops servers. What comes back to us is Stripe’s account identifier for you, and whether Stripe has cleared that account to receive money. The same division applies to full card numbers. Section 4 sets out both.

How we use it

• To operate the Services. Creating and securing your account, opening boxes, keeping your balance, fulfilling shipments, and telling you where your parcel is.
• To check eligibility. Confirming that you are 18 or over and that your phone number is real, and recording your acceptance of the Terms.
• To take and make payments. Processing deposits, buybacks and withdrawals, and resolving refunds, chargebacks and disputes.
• To support you. Answering your questions and investigating problems with your account or an order.
• To keep the Services safe. Detecting and preventing fraud and abuse, including duplicate accounts opened to claim a first-time offer more than once; enforcing our Terms; and exercising or defending legal rights.
• To improve the Services. Diagnosing crashes and errors, and understanding which parts of the app fail or confuse people.
• To communicate with you. Service messages about your account, orders and shipments, which you cannot switch off while you hold an account; and, if you have opted in, occasional messages about drops and offers, which you can switch off at any time.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Who we share it with

• Service providers who perform functions on our behalf. They are named individually in section 4, and may use your information only to provide those services to us.
• Professional advisers - accountants, lawyers and insurers - where they need it in order to advise us.
• Law enforcement and regulators, where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of our users, of Drip Drops, or of the public.
• Another business, in connection with a sale, merger, financing, change of control, bankruptcy, or similar transaction involving some or all of our assets. If such a transaction would transfer control of your personal information to a non-affiliate, we will take commercially reasonable steps to notify you by email or by posting an updated policy on this page.
• Anyone you direct us to, with your consent.

The Services may contain links to third-party sites and services. Those links are for your convenience and do not imply endorsement, and we are not responsible for those parties’ practices. Anything you give a third party on its own site is covered by that party’s privacy practices, not by this policy.

Payments, payouts and shipping

These are the providers that receive your information, and what each one gets:

• Stripe - card payments. Deposits are processed by Stripe. Card details are entered into Stripe’s own payment interface and transmitted directly to Stripe; full card numbers never touch Drip Drops servers. We retain only a payment reference and the card brand and last four digits, so we can recognise the payment and handle refunds and disputes. See stripe.com/privacy.
• Stripe Connect - withdrawals. Cash withdrawals are paid out through Stripe Connect. Stripe collects whatever identity and bank details it needs to verify you and pay you - on our behalf, but on its own hosted onboarding pages, and under Stripe’s privacy policy as well as this one. Nothing from that process reaches our API: we store only Stripe’s account identifier for you, and whether Stripe has cleared that account to receive money.
• Twilio - phone verification. Verification codes are sent by SMS through Twilio, which receives your phone number in order to deliver the message.
• EasyPost and the carrier - shipping. When you have a piece shipped, we pass the recipient name, address and contact details to EasyPost, which buys the label and returns tracking, and to the carrier that actually carries the parcel.
• Render - hosting. The Site and our API run on Render, in the United States.
• Sentry - diagnostics. Crash and error reports go to Sentry, configured not to attach personal information to reports by default.
• Apple and Google - sign-in. If you use Sign in with Apple or Google, that provider knows you signed in to Drip Drops, and tells us the identifier and email address you chose to release. We never receive your password.

Cookies and similar technologies

The website at dripdrops.co sets no cookies. It loads no analytics, no advertising trackers, and no third-party scripts. The one third-party request it makes is for the web fonts it uses to render the page, which are served by Google Fonts and which therefore see your IP address.

The app does not use cookies. It stores a session credential on your device so that you stay signed in; we hold only a hashed form of that credential, never the credential itself. Signing out, or deleting your account, ends every session immediately.

Because we set no tracking cookies, there is nothing here to opt out of. If you would nonetheless rather block third-party requests, your browser’s settings and privacy extensions will do so; the Site works without the web fonts, though it will look plainer.

Your choices and rights

• See and correct your information. Your profile in the app shows what we hold about your account. Write to us for anything not shown there, or to correct something that is wrong.
• Delete your account. You can do this from inside the app. Section 7 sets out exactly what that does, and what survives it.
• Marketing. Opt out using the unsubscribe instruction in any marketing message. We will still send you service messages about your account and your orders.
• Notifications and device permissions. Grant or revoke these in your device’s system settings at any time.

Depending on where you live, you may also have the right to confirm whether we hold personal information about you, to access it, to correct it, to have it deleted, to receive a portable copy, to withdraw consent you have given (without affecting processing carried out before you withdrew it), and not to be discriminated against for exercising any of these rights. To exercise them, contact us using section 12. We may need to verify your identity before we act, and we may decline a request where we cannot verify it, or where the law requires us to keep the information.

The identity and bank details Stripe collects under section 4 sit in Stripe’s systems rather than ours, and are governed by Stripe’s privacy policy as well as this one. We will pass a request on where we can, but for that information Stripe may need to deal with you directly.

How long we keep it

We keep your information for as long as we need it to provide the Services, meet our legal and accounting obligations, enforce our agreements, and resolve disputes. Retention is judged category by category, according to why the information was collected and what law requires of us.

Deleting your account closes it, ends every active session at once, and stops any further use of your information to provide the Services. It is not an instant erasure of everything, for two reasons we would rather state plainly than bury:

• Records that exist in order to be kept, are kept. Your age attestation, your acceptance of the Terms, and your transaction and payment history are retained for as long as tax, accounting, anti-fraud and consumer-protection law requires, and in order to defend legal claims. Payment and payout records are separately held by Stripe under its own retention rules.
• We keep a link between a closed account and a new one. If you delete your account and later open another using the same Apple ID, Google account or email address, we retain a pointer recording that the new account follows the old one. It exists solely to stop first-time offers being claimed twice, and carries nothing about what the old account did.

Where you have a right to erasure and none of the grounds above apply, write to us and we will delete.

Where it is processed

Drip Drops is operated from the United States, and your information is stored and processed there. Our service providers may process it in other countries. If you use the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection law may differ from the law where you live. Where the law requires safeguards for such transfers, we rely on our providers’ standard contractual clauses and equivalent measures.

How we protect it

We use reasonable procedural, physical and electronic safeguards, including encryption in transit and at rest, designed to protect your information against accidental or unlawful destruction, loss, misuse, alteration, and unauthorised access or disclosure. Session credentials are stored only as hashes. Card numbers and identity documents are held by our processors, not by us.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The safety of your account also depends on you: use a device passcode, keep your sign-in provider secure, and tell us at once if you believe someone else has reached your account.

Age restrictions

The Site and the Services are for people aged 18 and over. We ask you to confirm your age, and we record that confirmation. We do not knowingly collect or solicit information from anyone under 18. If we learn or suspect that a user is under 18, we will close the account and delete the information as soon as we can. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We change the Services regularly, and those changes sometimes mean we collect new information, or use what we already hold in a new way. When we revise this policy we will update the effective date and version at the top of this page. For material changes we will also tell you in the app or by email before they take effect. Your continued use of the Services after a change takes effect is subject to the updated policy.

Contacting us

Questions about this policy, and requests about your own information, go to our support page, or to the address below.

Operated by

Curated Drops, LLC

Address

800 Third Avenue FRNT A #1084
New York, NY 10022
United States

Email

support@dripdrops.co