Privacy Policy

Who we are

DropClicker Ltd (“DropClicker”, “we”, “us” or “our”) operates the DropClicker ecommerce platform and Shopify app.

DropClicker Ltd is registered in England and Wales under company number 16988571.

Registered office:
3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE

For privacy questions, data-protection requests or complaints, contact: support@dropclicker.com

This Privacy Policy explains how we collect, use, share and retain personal data when you visit our website, join our mailing list, create or use a DropClicker account, connect a Shopify store, use our AI features, contact us or otherwise use our services.

It also explains how DropClicker handles personal data relating to customers of merchants who use our services.

Our role under data protection law

DropClicker acts as a data controller where we determine why and how personal data is processed.

This includes personal data used for our website, merchant accounts, subscriptions and payments, support, security, fraud prevention, marketing, legal compliance and our own business records.

Where we process a merchant’s customer personal data solely on the merchant’s instructions in order to process and fulfil an order, the merchant will normally be the controller and DropClicker acts as a processor.

There are also limited circumstances where DropClicker may need to process information relating to an order for our own purposes, including accounting, fraud prevention, resolving disputes, complying with legal obligations or establishing, exercising or defending legal claims. For those purposes, DropClicker may act as an independent controller.

Further terms applying to our processing of merchant customer data are contained in our Terms of service.

Personal data we collect

Merchant and account information

Depending on how you use DropClicker, we may collect:

• your name;
• business name;
• email address;
• account and profile information;
• your Shopify store information;
• subscription and account status;
• support messages and correspondence;
• settings and preferences;
• information you provide when using DropClicker features.

Authentication credentials are handled using our authentication systems and service providers.

We do not need access to your plain-text password.

Information we receive from Shopify

When you install or connect DropClicker to Shopify, we receive information through Shopify’s APIs that is necessary to authenticate the connection and provide DropClicker’s functionality.

Depending on the features being used, this may include:

• Shopify store domain and Shopify identifiers;
• authorised Shopify user information such as name and email address;
• store and location information;
• product and variant identifiers;
• SKU and product information;
• product prices;
• inventory information;
• order identifiers;
• order status;
• order line items;
• quantities;
• order totals;
• shipping amounts;
• currency;
• fulfilment information;
• tracking information;
• refund or cancellation information;
• customer name and contact information where required for an order;
• recipient delivery address;
• telephone number where available and required for fulfilment.

We only intend to process Shopify customer information that is reasonably necessary to identify, process, fulfil, support or update orders involving DropClicker products, or where processing is required by law.

We do not use Shopify merchants’ customer information to market DropClicker directly to those customers.

Merchant customer and order data

When a customer purchases a DropClicker product through a merchant’s store, or where a merchant manually creates an order in DropClicker, we may process information required to process and deliver that order.

This may include:

• recipient name;
• delivery address;
• email address where required;
• telephone number where required;
• order number;
• products ordered;
• quantities;
• order value and relevant payment information;
• fulfilment status;
• tracking information;
• refund or cancellation information.

We do not intend to collect customer information that is not reasonably necessary to provide the service.

Technical and security information

When you use our website or services, we and our infrastructure providers may process technical information required to operate, protect and troubleshoot the service.

This may include:

• IP address;
• browser or device information;
• request timestamps;
• authentication events;
• security events;
• error information;
• technical logs.

We use this information to operate DropClicker, maintain security, diagnose problems, prevent fraud and abuse and protect our users and systems.

Waitlist and marketing

If you join the DropClicker waitlist, we collect your email address and, if you give it, your name so we can send the launch, early-access and related updates you requested.

The waitlist and our marketing mailing lists are managed using MailerLite.

Technical request information, including your IP address, may also be received by MailerLite when a signup form is submitted.

When you create a DropClicker merchant account, you can choose whether you would also like to receive DropClicker marketing emails.

Joining our marketing mailing list is optional and is not required to create or use a DropClicker account.

The marketing option must be separate from accepting our Terms of service and Privacy Policy.

If you choose to join our marketing list, we may send you:

• product news;
• feature updates;
• ecommerce tips;
• offers;
• promotions;
• other DropClicker marketing communications.

We rely on your consent for these optional marketing communications.

You may withdraw your consent at any time by using the unsubscribe link in a marketing email or by contacting support@dropclicker.com.

Withdrawing consent does not affect processing that lawfully took place before consent was withdrawn.

If you unsubscribe, we may retain the minimum information necessary on a suppression list so we can respect your choice and avoid unintentionally adding you back to marketing.

Transactional and service communications are separate from marketing.

These may include authentication messages, security notices, billing information, subscription communications, order notifications, fulfilment updates and important information about your account or the service.

We do not add Shopify merchants’ customers or other end customers whose information we receive for order fulfilment to DropClicker’s marketing mailing lists.

How we use personal data and our lawful bases

We process personal data only where we have an appropriate lawful basis.

Performance of a contract

We process information where necessary to provide DropClicker and perform our agreement with merchants.

This can include operating accounts, connecting stores, synchronising products and inventory, processing orders, arranging fulfilment, providing tracking, administering subscriptions and providing support.

We may also process information when taking steps at your request before entering into a contract.

Legal obligations

We process information where necessary to comply with legal, regulatory, accounting, tax or data-protection obligations.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• protecting DropClicker and our users;
• preventing fraud and abuse;
• maintaining security;
• diagnosing technical problems;
• maintaining service reliability;
• handling disputes and complaints;
• protecting our legal rights;
• establishing, exercising or defending legal claims;
• improving the service using information that does not unnecessarily identify individuals.

Consent

We rely on consent for optional marketing communications and for other processing where consent is the appropriate lawful basis.

Where we rely on consent, you can withdraw it at any time.

Shopify order fulfilment

The normal DropClicker fulfilment process works as follows.

A customer purchases a product through a merchant’s Shopify store.

Where an order contains products provided through DropClicker, the merchant pays DropClicker for the relevant product and delivery charges.

DropClicker holds the commercial trade relationship with the underlying product provider.

DropClicker then places or arranges the fulfilment order using the customer’s delivery information.

The relevant fulfilment, warehouse or delivery partner receives the information reasonably necessary to prepare, dispatch and deliver the customer’s order.

This can include the recipient’s name, delivery address and, where genuinely required for delivery, contact information.

The provider dispatches the parcel directly to the merchant’s customer.

When tracking information becomes available, DropClicker records that information and can synchronise tracking and fulfilment status back to Shopify.

We do not disclose customer personal data to fulfilment partners for their own marketing purposes.

Payments and billing

DropClicker uses Shopify Billing for subscriptions or charges that are required to be processed through Shopify.

DropClicker also uses Stripe for eligible payments made through the DropClicker platform, including merchant order payments and applicable subscription payments outside the Shopify billing flow.

Full payment-card details are entered into payment interfaces provided by Shopify or Stripe.

DropClicker does not store your full payment-card number or card security code.

We may receive and retain transaction information required to administer payments, including:

• payment amount;
• currency;
• payment status;
• checkout or transaction identifiers;
• order references;
• account references;
• billing status;
• refund information.

Relevant transaction records may be retained as part of our accounting and financial records.

AI features

DropClicker provides optional AI-powered features, including tools that assist merchants with creating ecommerce stores, designs and content.

When you choose to use an AI feature, information required to perform your request may be provided to OpenAI, our AI service provider.

Depending on the feature and what you choose to submit, this may include:

• prompts and instructions;
• store name;
• store description;
• store category;
• brand information;
• design preferences;
• selected product information;
• selected collection information;
• uploaded logos;
• reference or inspiration images;
• other information or files deliberately provided to the AI feature.

We use this information to generate the content, design or other output requested by the merchant.

Merchants should not include unnecessary personal data, sensitive personal data or customer order information in AI prompts or uploads.

DropClicker does not intentionally send Shopify end-customer personal data to OpenAI merely because a Shopify store is connected.

Generated outputs and related project information may be stored by DropClicker so merchants can view, edit and continue working with their projects.

DropClicker does not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects.

Who we share personal data with

We do not sell personal data.

We use third parties where necessary to operate DropClicker.

These currently include:

Shopify

Provides the Shopify ecommerce platform, APIs, app functionality and Shopify Billing.

Stripe

Processes eligible payments made through DropClicker.

Supabase

Provides database, authentication, backend and related storage services used by DropClicker.

Vercel

Provides hosting and delivery infrastructure used by the DropClicker website and related web services.

Railway

Provides hosting infrastructure used by the DropClicker Shopify application.

IONOS

Provides DropClicker’s domain and email hosting.

Emails sent to or received from DropClicker may therefore be processed through IONOS systems.

MailerLite

Processes waitlist subscriptions and optional DropClicker marketing communications.

Google

Provides Google Sign-In where a user chooses that option and currently provides externally hosted website fonts.

Where Google Sign-In is used, Google may provide information such as the user’s name, email address, profile image and Google account identifier for authentication purposes.

OpenAI

Processes information submitted through DropClicker’s AI functionality where required to provide the requested AI output.

Fulfilment, warehouse and delivery partners

Receive the information reasonably necessary to prepare, dispatch, deliver and support relevant customer orders.

Professional advisers and authorities

We may provide information to accountants, lawyers, insurers, regulators, courts, law-enforcement bodies or other parties where reasonably necessary or required by law.

We may also disclose information in connection with a genuine sale, restructuring, investment, merger or acquisition involving all or part of DropClicker’s business, subject to appropriate confidentiality and data-protection safeguards.

International transfers

DropClicker is established in the United Kingdom, but some of our service providers operate internationally.

This means personal data may sometimes be processed outside the United Kingdom.

Where UK data-protection law restricts the transfer of personal data to another country, we will use a lawful transfer mechanism.

Depending on the destination and provider, this may include applicable UK adequacy regulations or recognised contractual safeguards permitted under UK data-protection law.

You can contact support@dropclicker.com for further information about safeguards applicable to a particular transfer.

How long we keep personal data

We do not intend to retain identifiable personal data indefinitely simply because it may be useful in the future.

Different categories of information are retained for different periods depending on why the information is required.

Merchant account information

We retain information required to operate an active DropClicker account while the account or commercial relationship remains active.

After the relationship ends, information that is no longer required will be deleted or anonymised.

Certain account or contractual information may need to be retained for longer where necessary for accounting, taxation, fraud prevention, disputes, regulatory obligations or legal claims.

Financial and transaction records

Financial, company and accounting records that we are legally required to retain may generally be kept for up to six years, or for another period required by applicable law.

This does not mean every item of customer personal data is automatically retained for six years.

Customer delivery and fulfilment information

Customer names, contact information and delivery addresses are retained only for as long as reasonably necessary to:

• process and deliver the relevant order;
• provide tracking;
• handle returns or refunds;
• resolve delivery problems;
• investigate disputes or fraud;
• comply with applicable legal requirements;
• establish, exercise or defend legal claims.

When identifiable customer information is no longer required for these purposes, it should be deleted or anonymised.

DropClicker may retain non-identifying historical order information, including product, quantity, date, cost, payment and fulfilment information, where the identity of the customer is no longer necessary.

Marketing information

Marketing information is retained while we have valid consent to send the relevant communications.

If you unsubscribe, we may retain a minimal suppression record so we can respect your opt-out.

Support correspondence

Support correspondence will normally be retained for up to two years after the relevant matter is resolved unless it needs to be retained for longer because of a dispute, legal obligation or legal claim.

Security and technical information

Security, compliance and technical records are kept only for as long as reasonably necessary for security, investigation, compliance and legal purposes.

We review the information we retain and aim to delete or anonymise personal data when it is no longer required.

Shopify privacy requests

Shopify may send DropClicker privacy requests relating to customers whose information has been processed through the app.

These can include requests relating to access, deletion or redaction of applicable customer information.

We process valid Shopify privacy requests in accordance with applicable law and Shopify’s requirements.

Where particular information must lawfully be retained, for example because of an accounting obligation or an existing legal claim, we may retain only the information necessary for that purpose and restrict its use accordingly.

When a merchant disconnects or uninstalls DropClicker, we stop using the Shopify connection to provide the connected service and handle stored Shopify information in accordance with this Privacy Policy, Shopify’s requirements and applicable law.

Cookies and website technologies

Our website and applications may use technologies required to provide functionality, maintain security and keep users authenticated.

Where cookies or similar technologies require consent under applicable law, we will obtain that consent before using them.

Strictly necessary technologies may be used where permitted without consent.

Further information is available in our Cookie policy.

Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures include encrypted connections, authentication controls, access controls and security measures provided by our infrastructure providers.

No internet-connected service can be guaranteed to be completely secure.

If a personal-data breach occurs, we will assess it and make notifications to the Information Commissioner’s Office and affected individuals where required by applicable law.

Your data protection rights

Depending on the circumstances and applicable lawful basis, UK data-protection law may give you the right to:

• be informed about how your personal data is used;
• access personal data we hold about you;
• have inaccurate personal data corrected;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• object to direct marketing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent.

These rights are not absolute and legal exemptions or conditions may apply.

To exercise your rights, contact: support@dropclicker.com

We may need to take proportionate steps to confirm your identity before releasing personal information.

We will respond without undue delay and within the period required by applicable data-protection law.

This will normally be within one month, although applicable law allows the period to be extended or paused in certain circumstances.

We do not normally charge a fee for exercising data-protection rights, although applicable law allows a reasonable fee or refusal in limited circumstances, including manifestly unfounded or excessive requests.

Data protection complaints

If you are concerned about the way DropClicker has handled your personal data, you can make a data-protection complaint by contacting: support@dropclicker.com

We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you appropriately informed and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Complaint information is available at:

https://ico.org.uk/make-a-complaint

Children

DropClicker is a business ecommerce service and is not intended for people under 18.

We do not knowingly invite children to create DropClicker merchant accounts.

Changes to this privacy policy

We may update this Privacy Policy where DropClicker’s services, providers, legal obligations or personal-data processing change.

The latest version and its last-updated date will be published on this page.

Where a change materially affects how personal data is used, we will take reasonable steps to bring the change to affected users’ attention where required.

Contact us

For privacy questions, rights requests or data-protection complaints:

support@dropclicker.com

DropClicker Ltd
Company number 16988571

3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE