Privacy Policy

1. Who we are

dropify.dev is operated by Dropify [legal entity TBD at incorporation] (“we”, “us”, “our”). We provide a cryptographically fair waiting-room infrastructure service for e-commerce drops. Questions? privacy@dropify.dev.

2. Data we collect about tenants (account holders)

When you create an account we collect: name, email address, company name, and payment information (handled by Stripe — we never see raw card numbers). We also store the technical credentials needed to operate your account (adapter keys, subscription identifiers).

We use this data to: create and manage your account, bill you for usage, send transactional emails (receipts, dunning notices), and provide support.

Legal basis (GDPR): contract performance (Article 6(1)(b)).

3. Data we process on your visitors’ behalf

When your store uses the Dropify Drop Room queue, our brain processes each visitor request and may log: IP address, country, ASN, the endpoint accessed, and the reason for any queue decision. This data is stored in our D1 database as forensic audit events.

Retention: forensic audit events are retained for at most 2,000 rows per tenant on a rolling basis (oldest events are purged on each export batch). Daily and 5-minute aggregated counters (no IP addresses) are retained for the life of your account for dashboard display and billing.

You are the data controller for your visitors’ data; we act as your data processor under our Data Processing Addendum.

Legal basis (GDPR): legitimate interest in fraud and bot-abuse prevention (Article 6(1)(f)).

4. Cookies

We set only strictly functional cookies. No consent banner is required because no cookie is used for analytics or advertising. See our security page for the full cookie inventory.

• ws_bind — HttpOnly, 24-hour lifetime. Binds a browser to its queue state. Contains a random nonce only.
• ws_queue_pass — HttpOnly, 15-minute lifetime. Cryptographic admission pass issued after PoW + bot challenge. Verified locally by the edge adapter with no server round-trip.
• better_auth_session — HttpOnly, session lifetime. Dashboard login session. Set on the dashboard domain only.

5. Sub-processors

Sub-processor	Purpose	Location
Cloudflare, Inc.	Infrastructure (Workers, D1, Durable Objects, Turnstile)	Global (EU–US DPF certified)
Stripe, Inc.	Payment processing and billing	USA (SCCs / EU–US DPF)

6. Data-subject rights (GDPR)

If you are a tenant (account holder) based in the EU or UK, you have the right to:

• Access: request a JSON export of all personal data we hold about you via GET https://app.dropify.dev/api/account/data-export (authenticated).
• Erasure: delete your account and all associated data via POST https://app.dropify.dev/api/account/data-delete. Organizations you solely own are erased immediately, including their stores and configuration; organizations with other owners simply lose your membership.
• Rectification: update your name, email, or company name via the dashboard console.
• Portability: your data export (above) is machine-readable JSON.
• Objection / restriction: contact privacy@dropify.dev.

For visitor data (your customers’ IP addresses), you are the data controller. We provide you with the tools to respond to visitor rights requests; contact us if you need assistance.

7. Retention

Account data is retained for the life of your subscription and deleted within 30 days of account cancellation (or immediately on explicit delete request). Stripe billing records are subject to Stripe’s own retention policies.

8. Security

All data in transit is encrypted via TLS 1.2+. Data at rest is protected by Cloudflare D1’s encryption. Secrets (base secret, signing keys) are stored in Cloudflare Workers Secrets and never written to logs or responses. See our security disclosure page for more.

9. Changes to this policy

Material changes will be notified by email to your registered address at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

10. Contact

Privacy inquiries: privacy@dropify.dev
Security issues: security@dropify.dev