Privacy Policy

This Privacy Policy explains how [Company legal name] (“Dropl”, “we”, “us”) collects, uses, shares, and protects personal information when you visit https://www.dropl.io, create a Dropl account, or watch a video hosted on Dropl. We are based in the United States.

We handle personal information in two roles:

• As a controller for information about our customers, website visitors, and people who contact us. This Policy describes those practices.
• As a processor or service provider for information about viewers who watch our customers' videos or submit lead capture forms in their players. In that role we act on our customer's instructions, and the customer's own privacy policy governs how they use that information.

Information you give us

• Account information: your name, email address, password (stored in hashed form), company name, and the team members you invite.
• Billing information: your billing name, address, and payment details. Payments are processed by Stripe. We do not store full card numbers on our servers.
• Your content: videos, thumbnails, titles, descriptions, captions, and branding you upload or create, and content you import from services like Vimeo.
• Communications: messages you send us through our contact form or by email, including your name, email address, company, and message.

Information collected automatically

• Usage and device information: IP address, browser and device type, operating system, referring page, pages visited, and timestamps when you use our website or dashboard.
• Service logs: technical logs about uploads, playback, errors, and security events, which we use to operate and protect the Service.

Viewer information (on behalf of our customers)

• Playback analytics: when someone watches a video in the Dropl player, we collect events such as plays, watch time, and the points where viewers stop watching, along with IP address, approximate location derived from IP address, the page the video was embedded on, and device and browser information. We use this to give our customers view counts, watch time, drop-off charts, and engagement heatmaps.
• Lead capture: if a customer adds a lead capture form to a video, information a viewer submits (such as name and email) is collected and provided to that customer.

• To provide, host, stream, and maintain the Service and your account.
• To process payments, manage subscriptions, and send receipts and billing notices.
• To provide analytics and lead capture features to our customers.
• To import content you ask us to import, such as videos from Vimeo.
• To respond to your messages and provide customer support.
• To send service announcements, security alerts, and administrative messages. If we send marketing emails, you can unsubscribe at any time.
• To protect the Service, prevent fraud and abuse, enforce our Terms of Service, and comply with legal obligations.
• To understand how the Service is used and improve it.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on these legal bases:

• Contract: to provide the Service you signed up for and manage your account and billing.
• Legitimate interests: to secure and improve the Service, prevent abuse, and respond to inquiries, where those interests are not overridden by your rights.
• Legal obligation: to meet tax, accounting, and other legal requirements.
• Consent: where we ask for it, such as for optional marketing emails. You can withdraw consent at any time.

We use cookies and similar technologies, such as local storage, to:

• Keep you signed in and secure your session.
• Remember preferences such as light or dark mode.
• Make the video player and embeds work properly.
• Measure playback so customers can see views and watch time.

We do not use cookies for third-party advertising, and the Dropl player does not show ads. You can control cookies through your browser settings, but disabling some of them may stop parts of the Service from working.

We share personal information only as described here:

• Service providers that process information for us under contract, including payment processing (Stripe), cloud video storage (Backblaze), content delivery (Bunny.net), website and application hosting, and email delivery. They may use the information only to provide services to us.
• Our customers, who receive analytics and lead capture information about viewers of their videos.
• Legal and safety reasons, when we believe in good faith that disclosure is required by law, legal process, or government request, or is needed to protect the rights, property, or safety of Dropl, our users, or the public.
• Business transfers, as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

We keep personal information only as long as we need it for the purposes described in this Policy:

• Account information and content are kept while your account is active. After your account closes, we keep your content for at least 30 days so you can export it, then delete it. Residual copies in backups are deleted on our regular backup cycle.
• Billing records are kept as long as required for tax and accounting purposes.
• Viewer analytics and lead data are kept for as long as the customer's account is active, or until the customer deletes them.
• Support and contact messages are kept as long as needed to resolve your request and maintain a record of our correspondence.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and hashed passwords. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you as required by law.

We are based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, where required.

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access: know what personal information we hold about you and get a copy.
• Correction: fix information that is inaccurate.
• Deletion: ask us to delete your information.
• Portability: receive your information in a portable format.
• Objection and restriction: object to or limit certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal information, or of targeted advertising. We don't do either, but you may still send the request.

GDPR and UK GDPR

If you are in the EEA or UK, you may exercise the rights above and also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA) and other U.S. states

California residents have the right to know, delete, and correct personal information, to opt out of its sale or sharing, and to limit the use of sensitive personal information. Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, and Texas, have similar rights. In the past 12 months we have collected the categories of information described in “Information we collect”: identifiers, commercial information, internet or network activity, approximate geolocation, and customer records. We use and disclose them for the business purposes described in this Policy. We do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights.

How to make a request

Email [email protected]. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law allows. We will respond within the time required by law. If we deny your request, you may appeal by replying to our decision. If you are a viewer of a customer's video, we may refer your request to that customer, because they control that information.

Global Privacy Control and Do Not Track

We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information for that browser. Because there is no common standard for Do Not Track signals, we do not respond to them separately.

Dropl accounts are for adults and businesses. We do not knowingly collect personal information from children under 13, or under 16 where local law sets a higher age. If you believe a child has given us personal information, contact us at [email protected] and we will delete it. Customers who make videos available to children are responsible for complying with laws that apply to them, such as COPPA.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect. The “last updated” date at the top of this page shows when the Policy last changed.

Questions or requests about privacy? Reach us here:

• Email: [email protected]
• Mail: [Company legal name], Attn: Privacy, [Street address, City, State ZIP, United States]
• Or use our contact form.