Privacy Policy

1. Who We Are

Dropkard is operated by Joshua Harris trading as Dropkard, based in the United Kingdom. For personal data relating to Dropkard accounts, billing, use of the Service, and operation of the Service, Joshua Harris trading as Dropkard is the data controller.

When you submit your email address through a fan email form on an artist's page, the artist named on that page decides why and how your email address will be used to contact you. That artist is the data controller for those communications. Dropkard acts as the artist's data processor when we collect, store, display, and export your email address through the Service, and, where you have confirmed a release-specific notification request, send that single automated release-day notification. Dropkard remains a separate data controller for limited processing that we determine is necessary to secure and operate the Service, comply with our legal obligations, and respond to data-protection requests or complaints.

If you have any questions about how we handle your data, contact us at hello@dropkard.com.

2. What Data We Collect

Account data. When you create an account, we collect your email address. If you sign in via Google OAuth, we receive your email address and name from Google as part of the authentication process.

Usage data. We collect information about how you use the Service, including pages visited, links clicked, and actions taken within your account. This data is used to provide analytics features and to improve the Service.

Public page data. Content you add to your Dropkard page — including your display name, bio, links, artwork, and any video embed you choose to add — is stored and made publicly accessible at your chosen URL.

Payment data. We do not collect or store payment card details. All payment processing is handled by Paddle, our payment processor, who acts as merchant of record. We store only your Paddle customer ID and subscription status.

Fan email capture data. If you choose to join an artist's email list, the feature records the email address you provide, the artist page through which you submitted it, a fixed source tag identifying the form as a bio-page capture, and the date and time of submission. If you request a release notification instead, the feature records the same core fields with a source tag identifying a release-page capture, the specific release, and whether you later confirmed the request via the confirmation link. We only treat the request as confirmed after you complete that separate confirmation step. Requesting a release notification does not create a Dropkard account. These fields are inherent to the technical structure of the capture feature, in the same way that a software form tool defines the shape of the records it creates; they do not determine the artist's purpose for collecting or using your email address. We record the submission only after you select the unticked consent checkbox. Joining an artist's list does not create a Dropkard account.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your account
• Provide and operate the Service
• Send transactional emails, including account confirmation, billing notifications, and product updates
• Display analytics to you within your dashboard
• Respond to support requests

An artist may use a general (bio-page) captured fan email address to send the news and updates described beside the consent checkbox. Dropkard processes that address only to provide the capture feature on that artist's instructions, including storing it and making it available to the artist in their dashboard or as a CSV export. Dropkard does not use captured fan email addresses for our own product marketing and does not send those artist-composed communications.

Separately, if you submit your email on a specific release page and confirm via a separate confirmation link, Dropkard will — on the artist's documented instructions as processor — automatically send one release-day notification for that release when the release date arrives (stating that the named release by the artist is out). Delivery is through our email provider. Every such notification includes a cancellation link. The artist remains the data controller for that notification's purpose and consent. Dropkard does not send general fan-list or other marketing emails on the artist's behalf.

We do not sell personal data to third parties. We do not use account data or captured fan email addresses for advertising, and we do not use captured fan email addresses to market Dropkard.

4. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract: processing necessary to provide the Service you have signed up for
• Legitimate interests: processing to maintain the security and integrity of the Service, and to improve it
• Legal obligation: processing required to comply with applicable law
• Consent: an artist relies on your consent when using a captured email address to send you news and updates by email. You may withdraw that consent at any time. Dropkard processes captured fan email addresses on the artist's documented instructions. Where Dropkard separately processes limited information to secure and operate the Service or comply with law, we rely on our legitimate interests or legal obligations as appropriate.

5. Data Storage and Security

Your data is stored in Supabase, hosted in the eu-west-2 region (West Europe, London). All data is stored within the United Kingdom. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.

6. Third-Party Services

We use a small number of third-party services to operate Dropkard, and some pages may load additional third-party players an artist has chosen to embed:

Captured fan email addresses are accessible only to the relevant artist and authorised Dropkard personnel who need access to operate or support the Service. The artist can export confirmed addresses to a CSV file and may then use an email provider of their choice. Once an artist exports an address, that artist remains responsible as data controller for the exported copy, the provider they choose, and any communications they compose and send themselves. Separately, where an address was captured for a specific release and confirmed, Dropkard may send the single automated release-day notification described in this policy on the artist's instructions; that delivery is not an artist-composed communication after export. Supabase stores the copy held within Dropkard on our behalf.

7. Cookies

Dropkard uses only essential cookies necessary for authentication and session management. We do not set tracking or advertising cookies ourselves, and our own page-view analytics do not use cookies.

If an artist chooses to display an embedded YouTube or SoundCloud player, that embed loads directly from YouTube or SoundCloud. The iframe contacts that provider when it loads, and cookies may be set then or when the player is used. YouTube embeds use Privacy-Enhanced Mode; SoundCloud has no equivalent. Those cookies are controlled by YouTube or SoundCloud under their own policies, not by Dropkard. No cookie consent banner is currently shown on Dropkard.

8. Data Retention

We apply the same technical retention and deletion baseline to all personal data stored by Dropkard. Account data is retained for as long as an account remains active. Captured fan email addresses remain associated with the artist's account, including if the artist downgrades from Pro, until the artist's account is deleted, the artist asks us to delete them, or we receive and verify a valid withdrawal or deletion request.

When data is due for deletion under this policy, we delete it from active systems within 30 days unless retention is required by law, and backup copies expire through our normal backup-retention cycle. That 30-day window and backup-expiry cycle are uniform technical measures used across the Service; they are not separate decisions about how long fan email data should be retained. An artist is separately responsible for any copies they have exported from Dropkard.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention obligations)
• Restrict or object to certain processing
• Portability — receive your data in a portable format

If you joined an artist's email list, you can withdraw consent by using the unsubscribe method provided in the artist's emails or by contacting the artist directly. If you confirmed a release notification, you can cancel it using the cancellation link in that notification email. If you cannot contact the artist, email hello@dropkard.com with the email address you submitted and the URL of the artist page, and we will assist with the request. Withdrawing consent does not affect processing that was lawful before withdrawal. You also have an absolute right to object to the use of your personal data for direct marketing.

To exercise any of these rights, contact us at hello@dropkard.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email. The current version is always available at dropkard.com/privacy.

11. Contact

Joshua Harris trading as Dropkard

hello@dropkard.com

United Kingdom