Privacy Policy

1. The controller of personal data of users of the droplio.io platform (hereinafter: "Platform") is Windify Digital Services, with its registered office at ul. Płocka 127/16, 87-800 Włocławek, NIP: 8943145650, REGON: 384382857 (hereinafter: "Controller").
2. Contact with the Controller regarding personal data matters: office@droplio.io
3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter: "GDPR"), and applicable national data protection laws, including the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781 as amended), the Act of 18 July 2002 on the Provision of Electronic Services, the Act of 16 July 2004 — Telecommunications Law (with regard to Art. 173 and 174 concerning cookies), the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for users in the United Kingdom, and the ePrivacy Directive 2002/58/EC.

The Controller collects and processes the following categories of personal data:

Users' personal data may be transferred to the following categories of recipients:

1. Stripe, Inc. (USA) — payment operator. Processes transaction data and payment card data. PCI DSS Level 1 certified.
2. Google LLC (USA) — Google Analytics 4 (traffic analysis — only with consent), Google Tag Manager (tag management).
3. Meta Platforms, Inc. (USA) — Meta Pixel / Facebook Pixel (conversion tracking, remarketing — only with consent).
4. Cloudflare, Inc. (USA) — Cloudflare Turnstile (anti-spam and anti-bot protection).
5. OpenRouter / Google (Gemini API) — processing of AI queries (product description generation, image processing). Product data sent to the API does not contain Users' personal data.
6. Resend, Inc. (USA) — email delivery service provider. Processes Users' email addresses for the purpose of delivering verification messages, notifications, and responses to contact form submissions.
7. PostHog, Inc. (USA, EU servers) — analytics platform for collecting statistical data on Platform usage (visited subpages, interactions with interface elements, events related to Platform feature usage). For logged-in Users, data may be linked to the Account identifier, email address, and name for service usage analysis. Data collected only with the User's consent (analytics cookies). Data processed on servers in the European Union (eu.i.posthog.com).
8. Apify Technologies s.r.o. (Czech Republic, EU) — service for fetching publicly available product data from the Amazon platform at the User's request. Processes only product URLs provided by the User — does not process Users' personal data.
9. Hosting provider — servers on which the Platform database is stored.
10. Public authorities — at the request of authorised authorities, pursuant to applicable law.
11. Legal and tax advisors — to the extent necessary to establish, pursue, or defend against claims.

1. Some of the entities to which the Controller entrusts data processing are based outside the European Economic Area (EEA), in particular in the United States (Google LLC, Meta Platforms Inc., Stripe Inc., Cloudflare Inc., Resend Inc., PostHog Inc.).
2. Data transfers to the USA take place on the basis of the EU-US Data Privacy Framework (European Commission Implementing Decision of 10 July 2023) or standard contractual clauses (SCCs) approved by the European Commission.
3. The Controller uses only providers that ensure an adequate level of protection of personal data in accordance with the requirements of the GDPR.
4. For users in the United Kingdom, data transfers are carried out on the basis of the UK Extension to the EU-US Data Privacy Framework (in force since 12 October 2023), the UK International Data Transfer Agreement (UK IDTA), or the UK Addendum to EU Standard Contractual Clauses, as applicable.
5. In the event that the data transfer mechanism (e.g. EU-US Data Privacy Framework) is invalidated or changed, the Controller will immediately take steps to ensure that data transfers comply with applicable law.

1. After the retention period expires, data is permanently deleted or anonymised.
2. Upon Account deletion, User data is deleted immediately, with the exception of data whose retention is required by law (e.g. transactional data retained for 5 years) or data necessary for establishing, pursuing, or defending against claims.

1. The Controller applies appropriate technical and organisational measures to protect personal data, including:

   • SSL/TLS encryption — all communication with the Platform takes place over an encrypted HTTPS connection.
   • Password hashing — passwords stored in encrypted form (bcrypt). The Controller does not have access to passwords in plain text.
   • JWT tokens — sessions based on signed JSON Web Tokens.
   • Anti-bot protection — Cloudflare Turnstile on registration, login, and contact forms.
   • No payment card data stored — payment data processed solely by Stripe (PCI DSS Level 1).
   • Access control — access to data limited to authorised persons.
2. Despite applying the above security measures, the Controller cannot guarantee complete security of data transmitted over the Internet. The User uses the Platform at their own risk and is responsible for securing their login credentials.

1. In the event of a personal data breach that may result in a risk to the rights or freedoms of natural persons, the Controller will notify the President of the Personal Data Protection Office without undue delay and no later than 72 hours after becoming aware of the breach (Art. 33 GDPR).
2. If a personal data breach is likely to result in a high risk to the rights or freedoms of natural persons, the Controller will promptly inform the affected Users (Art. 34 GDPR), including the nature of the breach, possible consequences, and measures taken to address it.

1. The Platform does not use profiling within the meaning of Art. 22 GDPR that would produce legal effects or similarly significantly affect the User.
2. Google Analytics 4 and Meta Pixel may create audience segments based on on-site behaviour. This is profiling for marketing purposes, for which the User gives separate consent via the cookie banner. The User may withdraw this consent at any time.

1. The Platform is not intended for persons under the age of 16.
2. The Controller does not knowingly collect personal data of children. If the Controller becomes aware that data relates to a person under the age of 16, it will immediately delete such data.

1. Providing personal data (name, email, password) is voluntary, but necessary for Account registration and use of the Platform's services. Without providing this data, registration and use of paid features is not possible.
2. Providing data in the contact form is voluntary, but necessary in order to receive a response to the submission.
3. Consenting to analytics and marketing cookies is entirely voluntary and does not affect the ability to use the Platform.

1. This section applies to users who are residents of California, United States, and supplements the information provided in this Privacy Policy with disclosures required under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
2. The Controller does not sell or share personal information of users as defined under the CCPA/CPRA. The Controller does not use personal information for cross-context behavioural advertising.
3. California residents have the right to: (a) know what personal information is collected, used, and disclosed; (b) request deletion of their personal information; (c) correct inaccurate personal information; (d) non-discrimination for exercising their privacy rights.
4. To exercise these rights, California residents may contact the Controller at: office@droplio.io. The Controller will verify the identity of the requesting consumer and respond within 45 days of receiving the request.

1. This section applies to users who are residents of the United Kingdom. The processing of personal data of UK residents is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. UK residents have the same rights as described in §7 of this Privacy Policy. The supervisory authority for data protection matters in the United Kingdom is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom (ico.org.uk).
3. Transfers of personal data from the United Kingdom to countries outside the UK are carried out on the basis of the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement (UK IDTA), or the UK Addendum to EU Standard Contractual Clauses, as applicable.

1. The Controller reserves the right to amend this Privacy Policy at any time, in particular to adapt it to changes in legislation, technological changes, or changes in the scope of data processing.
2. The Controller will notify Users with Accounts of significant changes by email with at least 14 days' notice. Changes take effect on the date indicated in the notification.
3. We recommend reviewing the content of this Policy regularly.
4. Continued use of the Platform after changes are introduced constitutes acceptance of those changes. A User who does not accept the changes should cease using the Platform and delete their Account.