Privacy Policy

AHMD OPERATIONS LTD is the controller for personal data used to run Dropz. Payment providers and destination websites can be separate controllers for information they process under their own notices.

Dropz is operated by AHMD OPERATIONS LTD, a company registered in England and Wales with company number 17494337.

Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For account, payment, privacy or legal enquiries, email [email protected] or use our Help centre. You do not need an account to contact us.

This policy covers Dropz visitors, account holders, creators, Premium subscribers and support contacts. It does not cover the privacy practices of external destinations.

• Accounts: email, display name, profile image where supplied, verification records, connected sign-in provider identifiers, sessions, preferences and referral attribution.
• Links and activity: destination URLs, titles, public identifiers, access sessions, sponsor-step starts and completions, visits, unlocks, timestamps and attributable purchases.
• Billing: provider references, checkout email, plan, amount, currency, subscription status, payments, refunds and disputes.
• Creator records: earnings, recorded exchange rates, referrals, payout requests, recipient payment instructions and verification information where requested.
• Technical data: IP addresses or derived security identifiers, approximate country, browser, device, referrer, errors and abuse signals.
• Support: messages, attachments or evidence you choose to send us, request timestamps, internal case notes, receipt delivery records and optional payment references or last four card digits supplied to locate a payment.

Full card numbers and card security codes go directly to the payment provider. Dropz does not store them. Creator payout instructions may include a bank account, PayPal address or public cryptocurrency wallet address.

Where the GDPR or UK GDPR applies, we rely on these bases:

• Contract: to create an account, publish links, provide Premium, record earnings and pay approved cashouts.
• Legal obligation: to keep tax, billing and accounting records and to answer lawful requests.
• Legitimate interests: to keep the service secure, prevent fraud and abuse, provide support and understand whether the service is working, balanced against your rights.
• Consent: where a non-essential cookie, analytics tool or marketing message requires it. You can withdraw consent without affecting processing that was already lawful.

New subscriptions, payments, refunds and fraud checks are processed by Whop or PayPal, depending on the checkout you choose. Existing Stripe subscriptions and their payment records remain with Stripe. Card numbers and card security codes are entered directly into the payment provider’s form; Dropz does not store them. See Whop’s Privacy Policy, PayPal’s Privacy Statement and Stripe’s Privacy Policy for their independent processing.

Dropz receives the checkout result it needs to turn Premium on or off and to reconcile billing and creator earnings: references, status, amount, currency, the checkout email and dispute or refund status. Wallets also follow their own providers’ notices.

Signing in with Google shares your Google account identifier, verified email and available basic profile information with Dropz. We use these to create or link your account. This sign-in integration does not request access to your Gmail messages, Google Drive files or contacts. Email sign-in uses a time-limited link instead of a password.

Where a human-verification challenge is displayed, Google reCAPTCHA receives the browser and interaction information used to assess the request. Dropz submits the challenge response for verification and stores a short-lived, signed verification cookie. Google describes its processing in its Privacy Policy.

Free access pages use Adcash advertising and Monetag sponsor links. Adcash can load advertising code, including a library served from a Dropz URL, that communicates with advertising providers. Hosting that library on our domain does not make its processing solely internal to Dropz. Ads may open another tab or window after an interaction.

Advertising services may receive your IP address, browser and device details, page or referral information, identifiers and ad interactions to deliver offers, measure activity and detect abuse. Opening a Monetag sponsor link sends your browser to the offer provider. Information you submit there is handled under that provider’s own notice.

We record sponsor-step activity to maintain progress and prevent repeated or invalid unlocks. A recorded step is not proof that you bought or installed an advertised product. See Adcash’s privacy information and Monetag’s Privacy Policy for their practices and available choices.

Accepting these terms or purchasing Premium is not, by itself, consent to optional advertising tracking. Processing that requires consent must have that consent; browser settings and provider controls do not replace this requirement.

• Hosting and Cloudflare: server operations, traffic delivery and security; see Cloudflare’s Privacy Policy.
• Resend: delivery of transactional emails, including sign-in links; see Resend’s Privacy Policy.
• Whop, PayPal and Stripe: subscriptions, payment processing, billing management and fraud prevention.
• Google: optional Google sign-in and human-verification challenges.
• Adcash, Monetag and offer providers: advertising on free access pages and sponsor destinations.
• Payout services: recipient and payment details needed to process a cashout using your selected method. Public blockchain transactions can expose wallet addresses and amounts permanently.

Authentication runs within Dropz using Better Auth. Our own database stores account and session records. Providers may act on our instructions or have independent responsibilities for their payment, advertising and security operations.

Creators can see reporting about their own links, attributable purchases and subscriber activity. Authorised staff can review records needed for account support, moderation, payments and fraud investigations. We may disclose information to professional advisers, authorities where lawfully required, or a successor in a business transfer subject to applicable protections.

Providers may process data outside your country. Restricted international transfers require applicable safeguards, such as adequacy decisions or approved contractual protections. Contact us for information about the safeguards applicable to your data.

We retain account and link information while needed to operate your account and published links. Records may remain after closure for disputes, fraud investigations, legal obligations or establishing and defending claims. Financial records are retained for applicable accounting and tax requirements.

Retention depends on the record’s purpose, ongoing account or dispute activity, legal requirements and security risk. Sign-in links expire after ten minutes and sessions normally expire after seven days unless renewed; those lifetimes do not themselves erase audit or financial records.

Depending on applicable law and the processing basis, you can request access, correction, deletion, restriction or portability, object to processing, or withdraw consent. We may verify identity. Some records must be retained despite a deletion request. Where local law gives you rights concerning sale, sharing or targeted advertising, you can also contact us to exercise those rights.

Email [email protected] with your request. You do not need to sign in or pay to make it. For GDPR requests, we respond without undue delay and normally within one month of receipt, free of charge. If the law permits an extension for a complex or numerous request, we explain the reasons within that first month. You can also use our Help centre to submit a request. You may complain to your local authority, including the UK Information Commissioner’s Office where applicable.

Production uses HTTPS, controlled sessions, restricted access and server-side checks. No service can promise absolute security. Keep your email account secure, never share sign-in links and report suspected unauthorised access.

Dropz uses cookies and browser storage for account sessions, access progress, security verification and preferences. A referral identifier can preserve creator attribution when you register. Whop, PayPal, Stripe, Cloudflare, Google and advertising providers may also use cookies or similar identifiers when their components are loaded.

Dropz also counts, on its own servers, pages viewed, the referring site, device and browser type, approximate country, and on-site steps such as a sponsor being opened or Premium checkout. That count does not set a cookie and is not sent to an advertising or analytics company. The IP address is used to derive the country and a short-lived visitor total, then it is not kept as a raw address.

Storage needed for a service you request is different from optional advertising or analytics storage. Where consent is required, it must be obtained before optional storage is used. This policy is an explanation of processing, not a consent mechanism.

Your browser can inspect, restrict or remove stored information. Removing essential cookies may sign you out or interrupt access and payments; it does not cancel Premium. Manage renewal through Premium billing.

Dropz is not directed at anyone under 18. We do not knowingly collect personal data from children. Email [email protected] if you believe a child has provided information and we will look into it.

We update this notice when services, providers or practices change. The date above identifies the revision. We provide additional notice of significant changes when required.

Dropz is operated by AHMD OPERATIONS LTD, a company registered in England and Wales with company number 17494337.

Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For account, payment, privacy or legal enquiries, email [email protected] or use our Help centre. You do not need an account to contact us.