Privacy
Policy.

1. Who We Are

DripCollector Ltd is the controller of personal data used to operate DripCollector accounts, payments, fulfillment, security, and identity linking. For personal data that a connected merchant instructs us to process solely to provide merchant features, that merchant is the controller and DripCollector acts as its processor under our Data Processing Addendum.

2. Data We Collect

• Account and identity data, including Telegram identifiers and usernames, email addresses, Google or wallet identifiers, display names, and authentication records.
• Transaction and fulfillment data, including purchases, pulls, balances, wardrobe activity, payment status, and the name, address, and phone number supplied for shipping.
• Merchant data, including store domain and profile details, authorized staff details, product catalog, inventory, discounts, machine configuration, and Shopify authorization records.
• Shopify customer sign-in data, when enabled and authorized by the customer, including the Shopify store and customer identifiers and email address returned by Shopify.
• Technical and security data, including essential cookies, session identifiers, device and browser details, IP-derived information, timestamps, and application logs.

We receive this information from you, identity and payment providers, connected merchants, Shopify, logistics providers, and your use of the Service. For Shopify customer sign-in, we do not bulk-access customer records, orders, addresses, phone numbers, or payment details; we receive only the store-specific identifier and email that the customer individually authorizes. Please do not provide special-category data unless we specifically request it.

3. How and Why We Use Data

We process data to provide and secure accounts; authenticate users; operate machines and digital wardrobes; process payments, withdrawals, claims, and shipping; prevent fraud and duplicate accounts; provide support; comply with law; and establish, exercise, or defend legal claims.

For connected stores, we use merchant data only to provide the features authorized by the merchant, such as importing products, synchronizing shared inventory, and creating merchant-approved discount codes.

We use a Shopify customer identifier and email solely to authenticate the customer, link a Shopify identity to a DripCollector account, prevent duplicate accounts, and support recovery. We do not merge accounts automatically merely because email addresses match. Ambiguous links require additional verification.

Depending on the context, our legal bases include performing a contract, taking requested pre-contractual steps, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where required. We do not sell personal data or use Shopify customer data for advertising or legally significant automated decision-making.

4. Sharing and Subprocessors

We disclose data only as needed to operate the Service, follow your instructions, protect users, complete transactions, or comply with law. Provider categories include Shopify and identity providers; database, application, content-delivery, storage, monitoring, and communications providers; payment providers including NOWPayments; logistics, warehouse, and delivery providers; and AI-assisted image or document-processing providers used for limited operational tasks.

Providers process data under their own terms or our contractual instructions, as applicable. Our current merchant subprocessors and their functions are described in the Data Processing Addendum. We do not disclose personal data to third parties for their independent direct marketing.

5. Retention and Deletion

We retain account data while an account remains active and for a limited period afterward where needed for recovery, fraud prevention, disputes, or legal compliance. Transaction, tax, accounting, and payment records may be retained for up to six years or longer where law requires. Shipping details are retained only as needed to fulfill and evidence the shipment and meet legal obligations.

Connected-store data is retained while the connection is active and for a short wind-down period. We delete or anonymize it following disconnection, a verified deletion instruction, or Shopify's shop-redaction process, except for information we must retain by law or independently control for completed DripCollector transactions. Backup copies expire through the hosting provider's normal backup lifecycle.

6. Security

We use reasonable technical and organizational measures appropriate to the data and risk, including restricting access to authorized personnel, encrypted connections for data in transit, hosting-provider encryption at rest and for managed backups, and protected storage of platform credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International Transfers

We are based in the United Kingdom and use providers that may process data in the United Kingdom, European Economic Area, United States, and other countries. Where required, transfers rely on adequacy regulations, approved standard contractual clauses, the UK International Data Transfer Addendum, or another lawful safeguard.

8. Your Rights and Shopify Requests

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent without affecting earlier lawful processing. We may verify your identity before acting. You may complain to the UK Information Commissioner's Office at ico.org.uk.

If your request concerns data supplied by a connected Shopify merchant, you may contact that merchant. We assist merchants with verified requests delivered through Shopify's customer-data request and redaction processes. Shop data is handled following Shopify's shop-redaction instruction and applicable retention duties.

9. Cookies and Sign-In

We use essential cookies and comparable storage to maintain sessions, secure authentication, remember necessary settings, and complete account-linking flows. Third-party identity providers process sign-in information under their own privacy terms.

10. Children

The Service is intended only for people aged 18 or older. We do not knowingly collect personal data from children through the Service.

11. Updates

We may update this Policy to reflect changes to the Service, law, or our providers. We will identify the current version by its last-updated date and provide additional notice where a material change requires it.

12. Contact

DripCollector Ltd, company number 17369183, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For privacy requests, contact us through our official support channels, by post, or by phone at +44 7457 426504.

Merchants should also review our Merchant Terms and Data Processing Addendum.