Privacy notice

This notice explains how DROPT ("DROPT", "we", "us") uses personal information in the DROPT creator app, brand console and website. Contact our team at hello@droptapp.com about privacy or your data.

Information we collect

• Applications and accounts: your name, email, social handles, creator profile and application details; for brands, business and contact information.
• Activity on DROPT: campaign entries and post links, applications for gifting and experiences, content offers, messages you send through DROPT, support requests and notification preferences.
• Payments and delivery: earnings and transaction records, payout details you provide, and delivery addresses for gifts. Card payments, when available, are processed by our payment provider.
• Connected social accounts: account identifiers, profile information, follower and following counts, account likes and post counts available through the permissions you grant. We import the public content returned by the platform, including captions, thumbnails, post links and available views, likes, comments, shares and saves. We record account growth snapshots beginning when tracking starts. Campaign submissions also include ownership checks.
• Technical information: authentication records, device notification tokens, app version and update information, and technical logs used to operate and protect the service.

TikTok and Instagram connections

Connecting an account is optional. You authorise access on TikTok or Instagram and can withdraw that access. Features that require verified account ownership or video metrics may not work without a connection. Instagram connections require a Professional account (Creator or Business).

We use the official platform APIs to display your content library, record account growth, verify submitted videos and refresh campaign metrics. Authorised DROPT administrators can view your content and growth history. We store the access credentials issued by the platforms encrypted on our backend. We do not receive your social-platform password, publish posts on your behalf, or read your private social messages through this integration.

Campaign metrics are normally checked approximately every 30 minutes while tracking is active. Provider delays, revoked permissions and outages can delay updates. Connected account profiles and content libraries are normally refreshed every six hours, including new posts returned by the platform. We cannot retrieve account growth from before tracking began. Some metrics or older posts may be unavailable through the platform API.

Why we use information

We use account and activity information to review applications, provide the features you request, administer campaigns and agreements, arrange deliveries and handle payments. Where necessary to provide an agreed service or take steps you request before joining, we rely on performance of a contract.

We use security logs, ownership checks and relevant activity records for our legitimate interests in protecting accounts, preventing fraud, resolving disputes and maintaining a reliable service. We rely on legal obligations where records or disclosures are required by law. We use your consent for optional social-account access and optional notifications; you can withdraw it without affecting earlier lawful use.

You choose whether to provide optional information. Without required account, delivery or payment information, we may be unable to provide the associated feature. Applications are reviewed by our team. Campaign rankings may be calculated from recorded metrics; you can contact us to raise an error or dispute.

Who receives information

Brands receive creator profile and campaign information relevant to their activity, including submitted posts and performance. A fulfilling brand can receive the delivery details needed to send a gift. Other participants may see information displayed on campaign leaderboards. Your social access credentials are not shared with brands or other creators.

We use service providers for hosting and storage (including Vercel and Convex), email (Resend), payments (Stripe) and mobile notifications and updates (Expo and platform delivery services), as applicable to the features you use. TikTok and Meta process account authorisations and API requests under their own policies. Information may also be disclosed when necessary to comply with law or protect legal rights. We do not sell personal information.

Storage and retention

We keep account information while it is needed to provide your account and support its activity. We keep campaign, transaction, agreement and audit records where needed to settle payments, investigate disputes, prevent fraud or meet legal record-keeping requirements. Retention depends on the record, the unresolved obligation and applicable requirements; account deletion does not remove every financial or campaign record.

Disconnecting a social account removes the stored connection and its access credentials from DROPT, stops future authorised collection, and deletes its imported content library and account growth history. Previously recorded campaign results and metric history may remain with campaign and audit records. See data deletion for account deletion and its limits.

Our providers may process data outside the UK. Where a transfer requires a legal safeguard, we use an applicable adequacy decision or contractual safeguards. Contact us for information about the providers and safeguards relevant to your data.

Cookies and local device storage

The website uses cookies and similar storage for sign-in, session security and essential preferences. The app also stores settings and whether you have seen release notes. The current website does not include advertising or optional analytics cookies. Blocking essential storage may prevent sign-in from working.

Your choices and rights

You can ask to access or correct information, request deletion, or ask about restriction, objection and portability where these rights apply. You can withdraw optional permissions in the app or through the social platform. Email hello@droptapp.com; we may ask for information needed to verify the request, but never your password.

You can also complain to the Information Commissioner's Office. DROPT is intended for adults aged 18 and over. Contact us if you believe a child has provided personal information.

Changes to this notice

We will update this page when our practices change and provide additional notice where appropriate. We will explain any new use of connected-account data before introducing it.