What we hold, and for how long.

We hold a name, an email, and billing details about you, plus hashes and cycle metadata on behalf of your company. Raw uploads are purged when the match finishes. Nothing is sold, and nothing is shared.

How this document was written.

This is a first version, drafted with AI against the statute and the regulations it cites, and not reviewed by outside counsel. It is accurate to how DropDue actually works, which is the part we can vouch for. It will be reviewed by a lawyer before the first enterprise contract, and the date above changes when it is. If a clause matters to your deal, have your own counsel read it.

01
Two different kinds of data, kept apart.
About you, the account holder, we collect a name, a work email, and billing details. That is ours, we are the controller of it, and this policy governs it.
On your behalf we process the identifiers you run through a cycle. That data is yours. We are your service provider for it, we hold it under the addendum at /dpa, and this policy does not give us any wider right over it.
02
Service provider, not an independent controller.
Where DropDue processes personal information on behalf of a business customer to match against the CPPA DROP list, DropDue acts as that business's service provider under the CCPA, not as an independent controller of that data. We do not sell or share it, and we do not use it for our own purposes.
03
We hold hashes, not the identifiers behind them.
Hashing runs in your browser wherever the tier allows it. What reaches our servers is the hash and the cycle metadata around it, not the email address or the phone number that produced it.
A hash is one way. We cannot read your customer list out of it, and neither can anyone who takes our database.
04
How long each thing lives.
Raw uploads are purged as soon as the match run that used them finishes. Cycle metadata and the audit log are retained indefinitely, because the record of what you did is the artifact you may need years later. A stored DROP key is revoked and purged within one business day of cancellation.
Account and billing records follow the tax retention we are required to keep, which is seven years.
05
Who else touches it.
We use a small number of subprocessors, each bound to the same restrictions we accept. They are listed on the security page and here, and we announce a material change before it takes effect: Vercel for application hosting, Railway for background job processing, Neon for database hosting, Amazon Web Services for key management, Cloudflare for object storage and outbound email, Postmark for inbound email parsing, Stripe for payments.
06
How it is protected.
Encryption in transit and at rest, keys held in a managed KMS, access logged, and one click revoke on any stored DROP key. The security page states each of those in full and it is the version that governs. We have not repeated the detail here so that the two cannot drift.
07
Your rights as a visitor to this site.
If you are a California resident and you gave us your email through a free tool or a lead form, you can ask what we hold about you, ask us to delete it, and ask us to correct it. Write to the address at the bottom of this page and we answer inside 45 days.
We do not sell personal information and we do not share it for cross context behavioural advertising. This section covers you, the visitor, and not the people whose deletion requests our customers process.
08
Where the data sits.
Hosting and storage are in the United States. We do not transfer personal information out of the country, so there is no cross border transfer mechanism to describe. If that changes, this page changes first.
09
Not for children.
DropDue is a business tool. It is not directed at children under 16 and we do not knowingly collect information from them. If you believe a child sent us something, write to us and we will remove it.
10
Who to write to.
Privacy questions, rights requests, and anything about this page go to the address below. A person reads it. There is no ticket queue to get past.

Questions about this document: legal@dropdue.com.

Terms →Privacy →Guarantee →DPA →Security →

DropDue is a software tool, not a law firm, and this page is not legal advice. Not affiliated with the CPPA.

How this document was written.

Two different kinds of data, kept apart.

Service provider, not an independent controller.

We hold hashes, not the identifiers behind them.

How long each thing lives.

Who else touches it.

How it is protected.

Your rights as a visitor to this site.

Where the data sits.

Not for children.

Who to write to.