Privacy Policy

1. Who We Are

Dropkard is operated by Joshua Harris trading as Dropkard, based in the United Kingdom. For personal data relating to Dropkard accounts, billing, use of the Service, and operation of the Service, Joshua Harris trading as Dropkard is the data controller.

When you submit your email address through a fan email form on an artist's page, the artist is the data controller and Dropkard acts as their data processor. See our Terms of Service (Section 7) for the full processor arrangement. Dropkard remains a separate data controller for limited processing that we determine is necessary to secure and operate the Service, comply with our legal obligations, and respond to data-protection requests or complaints.

If you have any questions about how we handle your data, contact us at hello@dropkard.com.

2. What Data We Collect

Account data. When you create an account, we collect your email address. If you sign in with email, we send a one-time verification code to that address; we do not use a password. If you sign in via Google OAuth, we receive your email address and name from Google as part of the authentication process.

Marketing preferences. If you opt in via the optional checkbox in account settings, we store your choice to receive occasional Dropkard product updates and newsletters.

Usage data. We collect information about how you use the Service, including page views, link and release clicks, approximate country and device type derived from your connection, referrer URL where available, and actions taken within your account. Analytics events are retained in our database. Free accounts see the last 30 days in the analytics dashboard; Plus and Pro accounts see extended history. This data is used to provide analytics features and to improve the Service.

Public page data. Content you add to your Dropkard page — including your display name, bio, links, artwork, and a YouTube or SoundCloud embed if you add one — is stored and made publicly accessible at your chosen URL.

Payment data. We do not collect or store payment card details. All payment processing is handled by Paddle, our payment processor, who acts as merchant of record. We store only your Paddle customer ID and subscription status.

Fan email capture data. If you choose to join an artist's email list, the feature records the email address you provide, the artist page through which you submitted it, a fixed source tag identifying the form as a bio-page capture, and the date and time of submission. If you request a release notification instead, the feature records the same core fields with a source tag identifying a release-page capture, the specific release, and whether you later confirmed the request via the confirmation link. We only treat the request as confirmed after you complete that separate confirmation step. Requesting a release notification does not create a Dropkard account. These fields are inherent to the technical structure of the capture feature, in the same way that a software form tool defines the shape of the records it creates; they do not determine the artist's purpose for collecting or using your email address. We record the submission only after you select the unticked consent checkbox. Joining an artist's list does not create a Dropkard account.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your account
• Provide and operate the Service
• Send transactional emails, including account confirmation and billing notifications
• Send Dropkard product updates and newsletters when you have opted in via your account settings
• Display analytics to you within your dashboard
• Respond to support requests

An artist may use a general (bio-page) captured fan email address to send the news and updates described beside the consent checkbox. Dropkard processes that address only to provide the capture feature on that artist's instructions, including storing it and making it available to the artist in their dashboard or as a CSV export. Dropkard does not use captured fan email addresses for our own product marketing and does not send those artist-composed communications.

For release-specific notifications and other artist communications, see Section 2 (Fan email capture data) and our Terms of Service (Section 7). We do not sell personal data to third parties. We do not use account data or captured fan email addresses for advertising, and we do not use captured fan email addresses to market Dropkard.

4. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract: processing necessary to provide the Service you have signed up for
• Legitimate interests: processing to maintain the security and integrity of the Service, and to improve it
• Legal obligation: processing required to comply with applicable law
• Consent: an artist relies on your consent when using a captured email address to send you news and updates by email. You may withdraw that consent at any time. Dropkard product updates and newsletters rely on the optional marketing consent in your account settings; you may withdraw that consent via the same checkbox or by emailing hello@dropkard.com. Dropkard processes captured fan email addresses on the artist's documented instructions. Where Dropkard separately processes limited information to secure and operate the Service or comply with law, we rely on our legitimate interests or legal obligations as appropriate.

5. Data Storage and Security

Primary account and page data are stored in Supabase in the eu-west-2 region (West Europe, London). Some processing by sub-processors listed in Section 6 may occur in other locations. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.

6. Third-Party Services

We use a small number of third-party services to operate Dropkard, and some pages may load additional third-party players an artist has chosen to embed:

Captured fan email addresses are accessible only to the relevant artist and authorised Dropkard personnel who need access to operate or support the Service. The artist can export confirmed addresses to a CSV file; once exported, the artist remains responsible as data controller for that copy and any communications they send. See our Terms of Service (Section 7) for release notifications.

7. Cookies

Dropkard uses only essential cookies necessary for authentication and session management. We do not set tracking or advertising cookies ourselves, and our own page-view analytics do not use cookies. We also store your light/dark theme choice in your browser's local storage on marketing and dashboard pages; it is not shared with third parties.

If an artist chooses to display an embedded YouTube or SoundCloud player, that embed loads directly from YouTube or SoundCloud. The iframe contacts that provider when it loads, and cookies may be set then or when the player is used. YouTube embeds use Privacy-Enhanced Mode; SoundCloud has no equivalent. Those cookies are controlled by YouTube or SoundCloud under their own policies, not by Dropkard. We do not use non-essential cookies.

8. Data Retention

We apply the same technical retention and deletion baseline to all personal data stored by Dropkard. Account data is retained for as long as an account remains active. Captured fan email addresses remain associated with the artist's account, including if the artist downgrades to the free tier, until the artist's account is deleted, the artist asks us to delete them, or we receive and verify a valid withdrawal or deletion request. Analytics events remain in our database for as long as your account is active. Free-tier accounts can view the last 30 days in the dashboard; Plus and Pro accounts can view extended history. We do not automatically delete older analytics events when you are on the free tier.

When data is due for deletion under this policy, we delete it from active systems within 30 days unless retention is required by law, and backup copies expire through our normal backup-retention cycle. That 30-day window and backup-expiry cycle are uniform technical measures used across the Service; they are not separate decisions about how long fan email data should be retained. An artist is separately responsible for any copies they have exported from Dropkard.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention obligations)
• Restrict or object to certain processing
• Portability — receive your data in a portable format

If you joined an artist's email list, you can withdraw consent by using the unsubscribe method provided in the artist's emails or by contacting the artist directly. If you confirmed a release notification, you can cancel it using the cancellation link in that notification email. If you cannot contact the artist, email hello@dropkard.com with the email address you submitted and the URL of the artist page, and we will assist with the request. Withdrawing consent does not affect processing that was lawful before withdrawal. You also have an absolute right to object to the use of your personal data for direct marketing.

To exercise any of these rights, contact us at hello@dropkard.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email. The current version is always available at dropkard.com/privacy.

11. Contact

Joshua Harris trading as Dropkard

hello@dropkard.com

United Kingdom