Privacy Policy
Version 2.0 · Effective 11 October 2026
Contents
- Key points
- 1. Who we are and how to contact us
- 2. Who this policy covers
- 3. Data you give us
- 4. Data we collect when you use the Service
- 5. The Chrome extension
- 6. Your marketplace and supplier data
- 7. Your buyers' data: we act for you
- 8. The hidden label in your listings
- 9. Data about people who are not our customers
- 10. Why we use data, and our lawful bases
- 11. Automatic checks and decisions
- 12. Who we share data with
- 13. Transfers outside the UK and the EU
- 14. How long we keep data
- 15. Cookies and similar technologies
- 16. Marketing emails and how to opt out
- 17. Chrome Web Store Limited Use statement
- 18. Your rights
- 19. US privacy rights
- 20. Children
- 21. Security
- 22. Changes to this policy
- 23. Complaints
Version 2.0 · Effective 11 October 2026
Replaces: the earlier version of this policy (last updated March 2026) and the store privacy policy at dropsync.io/policies/privacy-policy (dated 30 May 2026).
This policy explains how DropSync handles personal data in the DropSync Chrome extension, the web app at app.dropsync.io and the website at dropsync.io. It is a notice to you. It is not a contract term (Terms of Service, Section 1.5).
Section 1.1 explains what Extension, Web App, Website and Service mean in this policy. Other words with capital letters, such as Account, Seat, Buyer Data, Auto Order, Autopilot, Inventory Sync and Clone Features, mean the same as in our Terms of Service.
Key points
(a) Who we are. DropSync. You can contact us at hello@dropsync.io.
(b) The extension does not keep everything on your computer. Many features send data to our servers. These include your listing records, product data for AI writing, and copies of your eBay listing reports when you run Inventory Sync.
(c) Auto Order handles your buyers' details. The extension reads your buyer's name, phone number and delivery address from the eBay order page. It saves them on our servers. For Amazon, it types them into your own Amazon checkout. For AliExpress, our servers send them to AliExpress. For this data we act for you, the seller (Section 7).
(d) Other companies help us run DropSync. Examples are Google Cloud, Stripe, OpenAI, Anthropic, Resend, Sentry and Discord. Many of them are in the USA. Section 12 lists them.
(e) We do not sell personal data for money (Sections 12.6 and 19). We never use data from the extension for advertising.
(f) How long we keep data. Some data is deleted automatically, for example Inventory Sync files after 30 days. Most other data stays while you have an Account and until you ask us to delete it. Section 14 has the details. You can ask us to delete your data at any time.
(g) Analytics and tracking. The web app and the website use Google Analytics and other analytics and affiliate-tracking tools. Section 15 lists them and explains how to block them.
(h) Your rights. You can ask to see, correct, delete or move your data. You can object to how we use it. Email hello@dropsync.io. You can also complain to the ICO or to the data protection authority where you live (Sections 18 and 23).
1. Who we are and how to contact us
1.1 This policy is from DropSync (DropSync, we, us or our). We provide the DropSync Chrome extension (the Extension), the web app at app.dropsync.io (the Web App) and the website at dropsync.io and its free tools (the Website). In this policy, the Service means all of these, plus our servers, emails, Discord community and support.
1.2 For most of the personal data in this policy, DropSync is the controller. This means we decide why and how the data is used. For your buyers' data (Buyer Data), we act for you, the seller, as your processor (Section 7).
1.3 To contact us about privacy, or to use any of your rights, email hello@dropsync.io. If you can, put "Privacy" in the subject line.
1.4 We may move DropSync to a company that we set up to run it (Terms of Service, Section 1.2). That company would then become the controller of your data. We will tell you before this happens, and we will update this policy. For data from the Extension, we will ask for your consent before we move it (Section 17.2(b)).
2. Who this policy covers
2.1 This policy covers:
(a) Customers. People and businesses with a DropSync Account, including Account Owners and people on a Trial.
(b) Seat Users. People who use an extra login that an Account Owner set up.
(c) Visitors and people who sign up. People who visit the Website or the Web App, or who sign up for our guides, reports or newsletter.
(d) Affiliates and partners. People who apply to our affiliate programme, refer customers or claim partner rewards.
(e) Community members. People in the DropSync Discord server.
(f) Our customers' buyers. People who bought from an eBay seller who uses DropSync (Section 7).
(g) Other eBay sellers. Sellers whose public listings our customers research with the Service, and sellers we email about DropSync (Section 9).
(h) YouTube creators. Creators we email about working with us (Section 9).
(i) Anyone who contacts us.
(j) Rights complaints. People who send us complaints that content breaks their rights, and people who reply to those complaints (Section 9.8).
2.2 Sections 3 to 6 are about our customers. Section 7 is about Buyer Data. Section 9 is about other people who are not our customers.
3. Data you give us
3.1 Your Account. When you sign up, we collect your email address and password, and sometimes your name. Google's Firebase service stores your password in a scrambled (hashed) form, and we cannot read it. If you choose Google sign-in, Google gives us your name and email address. We give each Account a user ID.
3.2 Details we add to your Account. We record your plan, Credits, Trial dates, subscription IDs, country and billing currency. We also record your referral details, links to your Seats and the eBay store names you use with DropSync. We record which Extension version you use and when you last opened the Web App.
3.3 Payments. Stripe runs our checkout. Stripe collects your card details, name, email address, billing address and country. We never receive your full card number. We keep your Stripe customer and subscription IDs, plan, country and currency.
3.4 Card and billing checks. To spot repeat Trials, we read these details from Stripe:
(a) the card "fingerprint" (a code that Stripe uses to tell whether two payments used the same card, without showing the card number);
(b) the card brand, the last 4 digits, the card type (for example, debit or credit) and the card's country; and
(c) your billing postcode, combined with your surname.
Section 11 explains how we use these details.
3.5 Unfinished checkouts. If you start a checkout and do not finish it, we keep the email address you entered. We may email you a reminder.
3.6 Seats. If you are an Account Owner and you add a Seat, you give us the Seat User's display name. The Seat login uses your email address with a tag added. We record each Seat's Credits and when it was last active. The Account Owner can see this activity.
3.7 Support. When you contact support in the Web App or in our Discord support channels, we collect:
(a) your user ID, email address and name;
(b) the subject and your messages (up to 4,000 characters each); and
(c) any files you attach, such as images, PDFs or spreadsheets (for example, eBay listing exports).
We also add facts about your Account to help us answer: your plan, Credits, Extension version, eBay username, store name, country, your saved settings, listing counts, your latest listing and Inventory Sync runs, any listings you mention, and your earlier tickets.
3.8 Contact form. The contact form on the Website collects your name, email address and message. Shopify, which hosts the Website, sends it to our mailbox.
3.9 Community and rewards.
(a) In our Discord server, our support bot reads messages in the channels it can access. We keep a copy of those messages, with Discord user IDs and usernames.
(b) We may link your Discord ID to your DropSync Account. We record your Discord username when you claim the DS Tag reward.
(c) If you share a "win card", we post an image of a sale, with its profit and margin, in our #wins channel. It does not show your eBay username.
3.10 Affiliates and partners.
(a) Applications: name, email address, platform, channel link, audience size, your reason for applying, and any files you upload (images, PDF or video, up to 25 MB).
(b) Payouts: payout email address, full name, country, amount, and the identity and tax details we ask for (Terms of Service, Section 34.1(g)).
(c) Commissions: your commissions and referral counts.
(d) Partner reward claims: the email address you used with the partner's tool.
3.11 Sign-ups. You can sign up for a free guide, the eBay Sales Report, the Title Builder unlock or our newsletter. When you do, we collect your email address, your first and last name if you give them, the page you signed up on, and how you first came to our site (Section 4.5).
3.12 Booking a call. If you book a call from the Web App, we put your name and email address in the Cal.com booking link, so the booking form is filled in for you.
3.13 AI Features. Text and images that you put into AI Features go to our AI provider (Sections 4.7 and 12). Do not put personal data into AI Features unless the feature needs it (Terms of Service, Section 16.4).
3.14 What you must give us. You must give us an email address to have an Account. You must give payment details to Stripe to start a Trial or a Plan. Some features need more data. For example, Auto Order cannot work without your buyer's delivery details, and AliExpress ordering needs your AliExpress connection. If you do not give us this data, that feature will not work, but the rest of the Service can still work.
3.15 Checks. If we ask you to confirm who you are, your business, that you control a store or card, or who owns an Account (Terms of Service, Sections 6.8 and 6.9), we collect what you send us, such as business documents, ID or the last 4 digits of a card.
4. Data we collect when you use the Service
4.1 Sign-in. We use a sign-in cookie (`__session`) that lasts 24 hours. When the Web App signs in the Extension, it uses a one-time code that lasts 60 seconds. We store only a hashed copy of that code. To limit abuse of sign-in at checkout, we store a hashed copy of your IP address.
4.2 Records of calls to our servers. Each time the Extension or the Web App calls our servers, we record:
(a) your IP address and browser type (user agent);
(b) the page or site the call came from;
(c) your user ID and the name of the function that was called; and
(d) a fingerprint (hash) of any AI request.
If a call comes without a sign-in, we also record the first 140 characters of the AI request. This is usually a product title. Our server logs can also contain your email address. We use these records to keep the Service secure, to stop abuse and to detect copies of our software.
4.3 Error reports. When you are signed in to the Web App, our error-tracking provider, Sentry, receives reports of errors. Each report includes your user ID and email address, the error, the page address, and details of your browser and device.
4.4 Product events. The Web App can record which feature ran, how it went (counts of results), your Extension version, your language setting and your user ID. We use this to spot faults that affect many customers.
4.5 Analytics and how you found us.
(a) In the Web App, Google Analytics receives page views and events. A page view includes the full page address. That address can include your email address or a checkout session ID, if one is in the link. Events include sign-in, sign-up and purchases, with the plan and Credits. For purchases, we send your user ID as the order ID. Google also receives your device details and IP address.
(b) On the Website, Shopify, Google Analytics and other Google tags record visits, devices, pages, and cart and checkout events. A page address can include your email address, for example when you sign up with Google on our homepage or follow a pricing link from the Web App. See Section 15.
(c) Our own cookies (`ds_ft` and `ds_lt`) record how you first and last came to our site: campaign tags (utm tags), referral code, referring site, landing page and time. When you create an Account or sign up for a guide, we save these details with it.
4.6 Referral links. If you arrive through a referral link, your browser stores the referral code and its source. We count clicks for each affiliate, but we do not store details about the visitor with the count. An older affiliate-tracking script from Rewardful also still loads on the Website. It sets its own cookie and adds a referral ID to Stripe checkout links.
4.7 AI requests. When you use AI Features, our servers send product data to OpenAI: titles, descriptions, item specifics, product photo addresses and our instructions. We do not store these requests, except for the call records in Section 4.2.
4.8 Email links and tracking. Links in our Weekly Sync newsletter carry campaign tags. This lets us see in our analytics when someone clicks them. Our emails, including the Weekly Sync, can also contain a small image and tracked links. These tell us, through our email provider Resend, whether you opened the email and which links you clicked.
5. The Chrome extension
5.1 What the Extension reads. The Extension works in your browser, on the pages you open and with the accounts you are signed in to. Depending on the features you use, it reads:
(a) Amazon and AliExpress product pages: titles, prices, stock, photos, variations, delivery details and product codes;
(b) eBay listing forms and your own listings, so that it can fill in and save listings;
(c) eBay search results and seller pages, for Competitor Scanner, the sold-item scanner and Clone Features;
(d) your eBay order pages and your Seller Hub order list, for Auto Order and Autopilot. These pages show your buyer's name, phone number and delivery address;
(e) your own details shown on eBay pages: your eBay username, store name and full name; and
(f) Amazon order pages after an order, to read back the order number, total and delivery date.
5.2 What stays in your browser. The Extension keeps these items in Chrome's storage on your computer. They leave your browser only when a feature in Section 5.3 needs them:
(a) your sign-in (user ID and email address);
(b) your eBay username, store name and full name;
(c) the email address of your Amazon buying account, any phone numbers you set, your AliExpress account name and phone number, your virtual assistant's name, and the sender name for gift messages;
(d) your message templates and settings;
(e) listing records that are waiting to be sent to us;
(f) Autopilot status and an install ID;
(g) your Google Gemini key, if you add one; and
(h) the details of your last Auto Order, including your buyer's name, phone number and address, and a record of your last 20 Amazon address checks, including your buyers' names and addresses. The Extension can also show these details in Chrome's developer console.
5.3 What reaches our servers. These go to our servers in Google Cloud:
(a) Listing records. For every listing you create, and every eBay file you import: title, price, SKU, ASIN or AliExpress product ID, source address, photo address, eBay item number and address, quantity sold, listing type and clone stamp. We use them for My Products, Inventory Sync and Auto Order.
(b) Product data for AI (Section 4.7).
(c) Auto Order data, including Buyer Data (Section 7).
(d) Clone records: which listings you cloned or repriced, and how much you used Clone Features.
(e) Autopilot records, if we invited you to Autopilot: eBay order number, item number, title, SKU, order page address, install ID, Chrome profile name and the result.
(f) Your Extension version, and the call records in Section 4.2.
(g) Your eBay username and store names, saved with your Account (Sections 3.2 and 6.7), and the Amazon account email and AliExpress account name on your orders (Section 6.5).
5.4 What goes from your browser straight to other companies. Some features send data from your browser directly to another company. This data does not pass through our servers:
(a) ipapi.co. When the Extension is installed or updated, and you have not picked an eBay site, it looks up your IP address to guess your country and pick the right eBay site.
(b) Keepa. Keepa (Germany) receives your product searches and IP address under Keepa's own terms.
(c) Google Lens. Image search opens a Google Lens tab with the address of the product photo.
(d) Google Gemini. If you add your own Gemini key, images and text go to Google under your own key and Google's terms.
(e) ChatGPT. If you use the ChatGPT mode, the Extension types prompts into your own ChatGPT tab, under your own OpenAI account.
5.5 Passwords. The Extension does not ask for your eBay, Amazon or AliExpress password, and we do not store those passwords. It uses the sessions you are already signed in to. You connect AliExpress on AliExpress's own sign-in page, which gives us a login token (Section 6.4).
5.6 Why the Extension needs its permissions.
(a) Access to websites, including "all websites". To read and change pages on eBay, Amazon and AliExpress, and on a few helper pages such as ChatGPT and Google Lens.
(b) Tabs, tab groups, scripting, active tab, navigation events, offscreen documents and alarms. To open and manage the tabs it works in, to run its scripts on those pages, and to run timed tasks such as Inventory Sync and Autopilot.
(c) Storage and unlimited storage. To keep the items in Section 5.2 in your browser.
(d) Clipboard (read and write). To copy and paste order and listing details when you use the copy and paste buttons.
(e) Downloads. To save files you ask for, such as Amazon order invoices.
(f) Web requests. To read the request headers of eBay pages and pass them to the Extension's script in the same tab. They stay in your browser.
(g) Network rules. To block some page content in tabs the Extension opens in the background, so that they load faster.
(h) Context menus. To add DropSync items to the right-click menu.
(i) Cookies and history. The Extension asks for these two permissions, but it does not use them. It does not read your cookies or your browsing history.
5.7 Removing the Extension. When you remove the Extension, Chrome deletes the data in Section 5.2. This does not delete data that is already on our servers. Section 18 explains how to ask us to delete that data.
6. Your marketplace and supplier data
6.1 My Products. The listing records in Section 5.3(a) make up My Products. You can clear them in My Products.
6.2 Inventory Sync files. Each time you run Inventory Sync, the Web App saves a copy of:
(a) the full eBay listings report that it works from (item numbers, titles, SKUs, prices and quantities); and
(b) every file that the Service sends to eBay.
We store these copies, compressed, in our Google Cloud storage in the USA. They are deleted automatically after 30 days. We keep them so that we can investigate problems when you ask for help. Our admin tools can download a copy to our own computer for a support case.
6.3 Inventory Sync run records. After each run, we keep a record of it: a status for each item, the full rows for items that did not succeed, your settings and the counts. Run records are deleted automatically after 30 days.
6.4 AliExpress connection. When you connect AliExpress, we store the login tokens that AliExpress gives us (an access token and a refresh token) and the link to your AliExpress account. We use them to place AliExpress orders and to read prices for you. Our servers renew them automatically before they expire, even after your Plan ends. We keep them until you disconnect, or until we delete your Account's data.
6.5 Supplier details on orders. Our order records include the email address of the Amazon account you buy with, and your AliExpress account name. If you set an AliExpress phone number, we send it to AliExpress with your AliExpress orders.
6.6 Product prices and stock. Our servers can ask ScrapingBee to fetch Amazon and AliExpress product and search pages. We send ScrapingBee only the address of the product or search page (which can include your search words).
6.7 Your eBay store names. We compare the eBay store names on your Account with those on other Accounts. We do this for two reasons:
(a) to stop other DropSync customers from cloning your listings; and
(b) to spot repeat Trials.
When another customer uses Clone Features, the Service can tell them whether a store belongs to an active DropSync customer. It does not tell them which customer.
6.8 Research results. Results from Competitor Scanner, the sold-item scanner and Clone Hunter are stored mostly in your browser. They contain other sellers' store names, item numbers, titles, prices and sold counts (Section 9.2).
7. Your buyers' data: we act for you
7.1 Our role. When you use Auto Order, Autopilot or the Orders pages, the Service handles personal data about your buyers (Buyer Data). eBay treats each seller as the controller of the buyer data that the seller receives. So you, the seller, decide why and how Buyer Data is used. We handle it for you, as your processor, to run the features you turn on.
7.2 What Buyer Data we handle. Depending on the feature:
(a) your buyer's name, phone number and delivery address (address lines 1 and 2, town or city, county, postcode and country);
(b) the eBay order number, item, sale price, fees, your earnings, SKU, your note and any gift message; and
(c) the supplier order number, total, delivery date, and the delivery name and address on the supplier order.
7.3 Where Buyer Data goes.
(a) Our servers. The Extension sends the order details in Section 7.2 to our order records in Google Cloud (our database is in the EU). They power your Orders pages and profit figures.
(b) Amazon. For Amazon orders, the Extension types your buyer's name, address and any gift message into your own Amazon checkout, in your own browser. Amazon receives them as your supplier.
(c) AliExpress. For AliExpress orders, our servers send your buyer's name, address, postcode, country and phone number to AliExpress through its order system. Its gateway is in Singapore, and AliExpress is part of the Alibaba group in China. If you set your own AliExpress phone number, we send that number instead of your buyer's. Our order record keeps the AliExpress order number, item, price and account, but not the address.
(d) Virtual clipboard. If you use the virtual clipboard to move an order between browsers, we store the full order details, including Buyer Data, until your next copy replaces them.
(e) Auto Order Link. The link that this button makes contains your buyer's name, address and phone number, and your earnings. Anyone you send the link to can read them. Your browser saves the link in its history, and Amazon receives it when the page opens.
(f) Messages to buyers. If you use delivery or feedback messages, the Extension sends them through eBay, from your account. They can include your buyer's first name.
(g) Autopilot. Autopilot reads your buyer's eBay username from Seller Hub. The username stays in your browser.
7.4 Who at DropSync can see Buyer Data. The people who run DropSync and approved support operators can see order records in our admin tools. For data from the Extension, people at DropSync read it only in the cases in Section 17.2(d).
7.5 What we do not do. We do not contact your buyers ourselves. We do not sell Buyer Data, and we do not use it for advertising.
7.6 How long we keep it. We do not yet delete Buyer Data automatically. It stays in your order records until you ask us to delete it (Section 14).
7.7 Data processing terms. Our data processing terms for Buyer Data are in Schedule 1 of our Terms of Service (Terms of Service, Section 1.6). They apply to every customer automatically. The providers that can receive Buyer Data are in Section 12. Our main processor for Buyer Data is Google Cloud (our database and file storage). Amazon and AliExpress receive Buyer Data as your suppliers, not as our processors (Terms of Service, Section 19.3A). If you put Buyer Data in a support ticket, it also reaches our support providers (Anthropic, Resend, Telegram and Discord). Anthropic's AI can also see Buyer Data when we use it to investigate a fault (Section 12.1).
7.8 Your duties as the seller. You must tell your buyers how you use their data, for example in your own privacy notice. You must follow data protection law for Buyer Data (Terms of Service, Sections 11.5 and 19.3).
7.9 If you are a buyer. If you bought from a seller who uses DropSync, that seller decides how your data is used. Please contact the seller first. If you contact us, we will pass your request to the seller and help them to answer it.
8. The hidden label in your listings
8.1 When the Service writes a listing description, it adds a hidden label to it (Terms of Service, Section 15.5). The label holds the listing's SKU. This is usually the supplier's product code, such as an Amazon ASIN or an AliExpress product ID.
8.2 The label is encoded, not encrypted. Buyers do not see it on the listing page. But anyone who views the page's source code, or uses a tool that reads it, can read it. This includes DropSync's own item-page tools, which can read the label on any listing that has one.
8.3 We do not put your name, your Account details or your buyers' details in the label.
8.4 The Service uses the label to recognise the listing. For example, Auto Order uses it to work out what to buy, and Inventory Sync uses it to check the supplier. The Service also uses it to recognise listings that DropSync created. We can use it to help you recover your product links if your SKUs are lost.
8.5 The label stays as long as the listing exists on eBay. You may remove it, but some features may then not recognise that listing.
9. Data about people who are not our customers
9.1 Our customers' buyers. See Section 7. This data comes from the seller's eBay order pages.
9.2 Other eBay sellers in research and Clone Features.
(a) What we handle: store names, item numbers, titles, prices, sold counts and listing pages.
(b) Where it comes from: public eBay pages that our customers open with the Service.
(c) Why: so that our customers can research products and competitors, and use Clone Features.
(d) Where it is kept: mostly in the customer's browser. Our servers keep records of which listings a customer cloned or repriced.
(e) Lawful basis: legitimate interests (Section 10).
9.3 eBay sellers we email about DropSync. We send sales emails to some UK businesses that sell on eBay. We email a business only if its eBay business details show a UK address and a company number, as limited companies do.
(a) Where we got your details. We find sellers through eBay's public search interface (the Browse API). We read the business details that eBay shows for business sellers: company name, business email address, VAT number, company number and business address.
(b) What we keep. Those details, your eBay username, store name, one of your listings, our view of how you source products (for example, from Amazon or AliExpress), and the status of our emails to you.
(c) What we send. Up to 3 emails. They come from our outreach address at trydropsync.com, with "DropSync" in the sender name.
(d) Who helps us. We send and receive these emails through Zoho Mail (USA). When you reply, we get a message in our private Discord channel (or in Telegram).
(e) Lawful basis. Legitimate interests: telling businesses about a tool that may help them.
(f) Your choice. Every email says where we got your details and how to stop. Reply "stop", or use the unsubscribe option in your email app, and we will not send you sales emails again. If you reply "stop", we also add you to a do-not-contact list. You can also email hello@dropsync.io.
(g) Earlier emails. Before 11 October 2026, we emailed some sellers in the UK and Germany from a dropsync.io address through Resend. We found their email addresses on their public eBay store pages. We have stopped those emails, and we keep their records until we delete them.
9.4 YouTube creators we email.
(a) Where we got your details. From YouTube's public data interface (channel name, subscriber count and country), and from the business email address shown on your channel page or website.
(b) What we do. Anthropic's Claude AI helps us decide which creators fit, and writes a first name and a personal opening line. We email up to 50 new creators a day, plus follow-ups, through Resend, from our outreach address at dropsync.io. Resend tells us if an email was opened or a link clicked. We get summaries in Telegram and Discord.
(c) Lawful basis. Legitimate interests: finding creators to work with.
(d) Your choice. You can object at any time, and we will stop. Reply to the email, or email hello@dropsync.io.
9.5 Discord members. See Section 3.9.
9.6 People referred by an affiliate. If you signed up through an affiliate's link, that affiliate can see your email address and the commission on your Plan in their affiliate dashboard.
9.7 People shown in support files. If a customer sends us a screenshot or a file that shows someone else, for example a buyer, we handle it as part of the ticket.
9.8 Rights complaints. If you send us a complaint that content breaks your rights (Terms of Service, Section 18.7), we may send it, with your name and contact details, to the customer concerned. If they reply, we may send the reply to you.
10. Why we use data, and our lawful bases
10.1 UK and EU data protection law says that we need a lawful basis for each use of personal data. We use these bases:
(a) Contract: we need the data to provide the Service you asked for.
(b) Legitimate interests: we have a good business reason, and it does not override your rights. The table says what the reason is.
(c) Legal obligation: the law requires it.
(d) Consent: you said yes. You can withdraw your consent at any time.
10.2 This table shows each use:
| What we do | Main data | Lawful basis |
|---|---|---|
| Create and run your Account, Seats and sign-in | Account and sign-in data (3.1, 3.2, 3.6, 4.1) | Contract |
| Provide the features you use: listing, AI writing, My Products, Inventory Sync, Clone Features, scanners, Auto Order and Autopilot | Listing records, product data, Inventory Sync files, supplier data (Sections 5 and 6) | Contract |
| Take payments and run Credits | Payment data (3.3) | Contract |
| Keep billing and tax records | Payment data | Legal obligation |
| Send service emails (welcome, password reset, Trial ending, low Credits, failed payment) | Email address, name, plan | Contract |
| Answer support requests, including AI sorting and draft replies | Support data (3.7), Account facts, Inventory Sync files | Contract. Legitimate interests: answering quickly and well |
| Spot repeat Trials and fraud | Card and billing checks (3.4), eBay store names, email address, name | Legitimate interests: enforcing our one-Trial rule and preventing fraud |
| Check who you are, your business or who owns an Account | Data you send for checks (3.15) | Legitimate interests: security and preventing fraud |
| Keep the Service secure, stop abuse and detect copies of our software | Call records and logs (4.2) | Legitimate interests: protecting the Service, our customers and our software |
| Find and fix faults | Error reports, product events, Extension version (4.3, 4.4), and Account, listing and order data where a fault needs it (17.2(d)) | Legitimate interests: keeping the Service working |
| Stop customers cloning each other's listings | eBay store names, hidden label (6.7, Section 8) | Legitimate interests: protecting our customers' listings |
| Analytics on the Website and the Web App | Analytics data and cookies (4.5, Section 15) | Consent. On the Website, we ask through Shopify's cookie banner where it appears. You can block analytics at any time (Section 15.7) |
| Track referrals and pay affiliates | Referral and affiliate data (3.10, 4.6) | Contract with the affiliate. Legitimate interests: crediting the right referrer. Legal obligation: payment and tax records |
| Marketing emails to customers | Email address, name, plan, usage (for example, when you last opened the Web App) | Legitimate interests: telling customers about DropSync. You can opt out at any time |
| Marketing emails to people who sign up | Sign-up data (3.11) | Consent |
| Sales emails to eBay sellers and creators | Data in Sections 9.3 and 9.4 | Legitimate interests: telling businesses about DropSync |
| Run the community and rewards | Discord data and win cards (3.9) | Legitimate interests: running our community and support. Contract: rewards you claim |
| Buyer Data | Section 7 | We act for the seller. The seller chooses the lawful basis |
| Research data about other sellers | Section 9.2 | Legitimate interests: our customers' product research |
| Handle rights complaints, and pass complaints and replies to the other side | Complaint data (9.8) | Legitimate interests: dealing with rights complaints fairly |
| Share facts with a Marketplace, payment provider, card issuer or rights owner when we suspect fraud or misuse, or to answer a chargeback | Relevant Account and usage data (12.4) | Legitimate interests: preventing fraud and misuse. Legal obligation, where the law requires it |
| Make combined statistics that do not identify anyone, for example to rank product ideas | Listing records, product events | Legitimate interests: improving the Service (Terms of Service, Section 18.3) |
| Move DropSync to a company, deal with legal claims and follow the law | Any data that is relevant | Legitimate interests. Legal obligation |
11. Automatic checks and decisions
11.1 Repeat-Trial checks. Our system compares each new Trial with earlier Accounts. It looks at the card details in Section 3.4, eBay store names, email addresses and names. When it finds a match, it posts an alert in a private Discord channel for our team. The alert names the kind of match, for example "same card", with the card brand and the last 4 digits.
11.2 A person decides. The check does not block anyone by itself. A person reviews each alert before we refuse or end a Trial or close an Account (Terms of Service, Section 7.3).
11.3 Billing. Our billing system may pause or limit an Account when a payment fails (Terms of Service, Section 10.2). You can ask us to review this.
11.4 Apart from these routine billing steps, we make no decisions about you based only on automated processing that have legal effects or similarly significant effects. Inventory Sync rules and repricing act on your listings, based on your settings.
12. Who we share data with
12.1 Providers that work for us. These companies process data for us to run the Service. Where we know it, we say where they process the data.
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud and Firebase (database, sign-in, server functions, file storage, logs, scheduled tasks) | Hosts all Account, listing, order, support and outreach data | Database: EU (several EU locations). Server functions: mostly London, UK. The functions that sign you in to the Web App run in the USA. File storage (support attachments, Inventory Sync files, affiliate files, Discord message copies, tutorial videos): USA. Sign-in and logs: Google's global network |
| Google Analytics and Google tags (including a Merchant Center tag, through Shopify's Google & YouTube app) | Analytics in the Web App and on the Website; measuring advertising | USA |
| Google (YouTube Data API, Google sign-in, Google Lens) | Finding creators; signing you in; image search from your browser | USA |
| Stripe | Payments, subscriptions, checkout and the billing portal; card details for repeat-Trial checks | USA and Ireland |
| Shopify | Hosts the Website; cookies, analytics pixels, the contact form and customer accounts | Canada and Ireland |
| Cloudflare | Delivers the Website; routes all email sent to our dropsync.io addresses, including hello@dropsync.io and replies to our outreach emails | USA |
| Resend | Sends most of our emails, including the newsletter and creator emails; holds our newsletter list; tells us when an email is opened or a link clicked | USA |
| Zoho Mail | Sends and receives our sales emails to eBay sellers, and holds the replies (Section 9.3) | USA |
| OpenAI | AI listing text, item specifics and photo matching (product data only) | USA |
| Anthropic | AI sorting, draft replies and deeper checks of support tickets (ticket text, attachments, and the Account, settings, listing and Inventory Sync data in Section 3.7). An AI assistant that we use to investigate faults, which can see Account, listing and order data, including Buyer Data. Choosing creators to email, and drafting creator emails and newsletters | USA |
| Sentry | Error reports from the Web App, with your user ID and email address | USA |
| Discord | Community server, support intake, the #wins channel, and private channels for our team: repeat-Trial alerts, a daily list of this week's Trial accounts and their progress, nightly service reports, and outreach replies and summaries | USA |
| Telegram | Alerts to our team: short previews of support tickets (up to 160 characters), affiliate payout requests (name, email address, country and amount), outreach summaries, and daily and nightly reports about accounts (email addresses, plan and activity) | Company in the United Arab Emirates; servers worldwide |
| Cal.com | Call booking (your name and email address in the booking link) | USA |
| Rewardful | An older affiliate-tracking script that still loads on the Website | USA |
| Wise | Affiliate payouts, which we make by hand | UK and EU |
| ScrapingBee | Fetches supplier product and search pages (page addresses only, which can include your search words) | France |
| ipapi.co | Looks up your IP address from your browser when the Extension is installed or updated | USA |
| Public code networks (Google gstatic, cdnjs, jsDelivr, Sentry and Shopify) | Deliver code to your browser. They receive your IP address | Worldwide |
| The provider of a Shopify app pixel on the Website (Shopify app ID 1615517) | Analytics and marketing (Section 15.3) | Not stated by the provider |
12.2 Others who receive data. These are not our providers, but data reaches them when you use the Service:
(a) eBay. The Extension acts on eBay as you. We also use eBay's public search interface to find sellers for outreach (Section 9.3).
(b) Amazon. Amazon receives your buyer's delivery details and gift message through your own Amazon account. It also receives Auto Order Link addresses (Section 7.3).
(c) AliExpress, as your supplier. It receives order and delivery details through its Open Platform. It also gives us product and price data and runs your AliExpress connection. It is not our processor (Section 7.3; Terms of Service, Section 19.3A).
(d) Google and OpenAI, when you use your own Gemini key or the ChatGPT mode (Section 5.4).
(e) Other DropSync customers. They can learn whether a store belongs to an active DropSync customer (Section 6.7). DropSync's tools can read the hidden label in your listings (Section 8).
(f) Affiliates. An affiliate can see the email address of each customer they referred (Section 9.6).
(g) Your Account Owner, who can see Seat activity (Section 3.6).
(h) The Discord community, which sees the win cards you share (Section 3.9).
(i) Keepa, which receives your product searches and IP address from your browser, under its own terms (Section 5.4(b)).
12.3 Inside DropSync. The people who run DropSync have access to all the data in this policy. For data from the Extension, people at DropSync read it only in the cases in Section 17.2(d). Approved support operators can see the support tickets for their topics and the Account facts they need. When you sign up, we get an email with your name, email address and plan.
12.4 Legal, fraud and complaints. We may share data with:
(a) authorities, courts and professional advisers, when the law requires it or to protect our rights, our customers or the public (Terms of Service, Section 19.6);
(b) a Marketplace, payment provider, card issuer or rights owner, when we reasonably suspect fraud or misuse, or to answer a chargeback (Terms of Service, Section 20.2A); and
(c) the Account concerned, if you send us a rights complaint, and the person who complained, if you reply to one (Terms of Service, Section 18.7).
12.5 If DropSync changes hands. If we move DropSync to a company we set up, or sell the business, we will tell you first, and your data would move with it (Section 1.4). For data from the Extension, we will ask for your consent before we move it (Section 17.2(b)). If you do not agree, we delete that data instead of moving it.
12.6 No sale for money. We do not sell personal data for money. For US law, see Section 19.
13. Transfers outside the UK and the EU
13.1 Our main database is in the EU, and most of our server functions are in London. But some data goes to, or is accessed from, other countries:
(a) USA: our file storage, the functions that sign you in to the Web App, and most of our providers (Section 12).
(b) Singapore and China: AliExpress orders and your AliExpress connection.
(c) Other countries: Telegram, the Shopify app pixel in Section 12.1 and the public code networks process data in other locations, or in locations we have not confirmed.
(d) Our own computers: the people who run DropSync can access data, and our admin tools can save copies, wherever these people work. This can be outside the UK and the EU.
13.2 Safeguards. UK and EU law allows these transfers when a safeguard is in place. For our larger providers, the safeguard is usually one of these:
(a) the provider's certification under the EU-US Data Privacy Framework and its UK Extension; or
(b) the standard contractual clauses approved by the European Commission, with the UK Addendum or the UK International Data Transfer Agreement, in the provider's data processing terms.
13.3 For AliExpress orders, you, the seller, choose to send your buyer's details to AliExpress, your supplier, in Singapore and China. You are responsible for the lawful basis for that transfer, and for telling your buyers about it (Terms of Service, Section 19.3A).
13.4 You can ask us which safeguard applies to a provider. Email hello@dropsync.io.
14. How long we keep data
14.1 The table shows how long we keep each kind of data. Where it says "No fixed period", we keep the data while your Account is open, and until you ask us to delete it or we delete it ourselves. We will update this table when we set fixed periods.
| Data | How long we keep it |
|---|---|
| Account and Account details | While you have an Account, and after you cancel. We do not delete closed Accounts automatically. You can ask us to delete yours |
| Inactive Accounts | If an Account has no paid Plan and no sign-in for 12 months, we may close it and delete its data. We email you at least 30 days before (Terms of Service, Section 27.9) |
| Seats | Removing a Seat turns off its login. The Seat's record stays with the Account |
| Sign-in cookie | 24 hours |
| Extension sign-in code | 60 seconds |
| Hashed IP address (checkout sign-in limit) | No fixed period |
| Payment data at Stripe | Stripe keeps it under its own rules and the law. Our copy of the IDs, plan and country stays with your Account |
| Email addresses from unfinished checkouts | No fixed period |
| Repeat-Trial and fraud checks | No fixed period |
| Documents and details you send for checks (3.15) | No fixed period |
| Server logs | 30 days |
| Google Cloud admin audit logs | 400 days |
| Our records of calls to our servers | No fixed period |
| Product events | They carry a 30-day expiry date, but automatic deletion is not switched on yet, so we keep them for now |
| Error reports (Sentry) | Up to 90 days, under our Sentry plan |
| Google Analytics data | Data linked to you: up to 14 months, the most that our Google Analytics plan allows. Summary reports that do not identify you can be kept longer |
| `ds_ft` and `ds_lt` cookies | 90 days. The first-visit record we save with a new Account has no fixed period |
| Listing records (My Products) | Until you clear them in My Products, or ask us to delete them |
| Clone records | No fixed period. You cannot delete these yourself; ask us |
| Inventory Sync files | 30 days, then deleted automatically |
| Copies saved to our computers for support | No fixed period yet |
| Inventory Sync run records | 30 days, then deleted automatically |
| Order records, including Buyer Data | No fixed period. Ask us to delete them |
| Virtual clipboard | Until your next copy replaces it |
| Autopilot records | No fixed period |
| AliExpress connection | Until you disconnect, or until we delete your Account's data |
| Data in the Extension (Section 5.2) | Until you remove the Extension or clear its data |
| Data in the Web App's browser storage | Until you clear your browser's site data |
| Support tickets, attachments and AI notes | No fixed period |
| Copies of Discord messages, and Discord links | No fixed period |
| Affiliate applications, payouts and commissions, and partner claims | No fixed period |
| Newsletter and marketing list | Until you unsubscribe or we remove you |
| Sign-up records | No fixed period |
| Outreach records (eBay sellers and creators) | No fixed period |
| Alerts in our team's email and Telegram | No fixed period |
| Hidden label | As long as the listing exists on eBay |
| Data at providers that we send it to but do not store it ourselves (OpenAI, ipapi.co, Keepa, ScrapingBee) | Under each provider's own rules |
14.2 Even after you ask us to delete data, we may keep some records when the law requires it (for example, tax records), or when we need them for a legal claim. If we do, we will tell you.
15. Cookies and similar technologies
15.1 What they are. Cookies are small files that a website stores in your browser. Similar technologies include browser storage, tracking pixels (including small images in emails) and links with tracking tags. In this section we call them all "cookies".
15.2 Necessary and optional. Some cookies are strictly necessary: the Service cannot work without them. The law does not require consent for these. Other cookies are for analytics, marketing or affiliate tracking. In the UK and the EU, the law requires your consent for these.
15.3 On the Website (dropsync.io):
| Name | Set by | What it does | Type | How long |
|---|---|---|---|---|
| `_shopify_essential` | Shopify | Runs the site and remembers your visit | Strictly necessary | 1 year |
| `localization`, `cart_currency` | Shopify | Remember your country and currency | Strictly necessary | `localization`: 1 year. `cart_currency`: 14 days |
| `_shopify_analytics` | Shopify | Measures visits | Analytics | 1 year |
| `_shopify_marketing` | Shopify | Measures marketing | Marketing | 1 year |
| `loggedConversion` | Shopify | Records conversions | Analytics | 2 months |
| Shopify page reports (no cookie) | Shopify | Report when pages load and when you leave a page | Analytics | Not stored in your browser |
| Google Analytics (G-DTTNXQL7F3), Google tag (GT-NFRJTZW7) and a Merchant Center tag | Google, through Shopify's Google & YouTube app | Measure visits and the results of advertising | Analytics and advertising | `_ga` cookies: 2 years |
| Shopify app pixel (app ID 1615517) | That app's provider, through Shopify | Analytics and marketing. Shopify marks it as one that may involve a "sale of data". It can receive customer details from checkout events, such as name, email address, phone number and address | Analytics and marketing | Unknown |
| Custom pixel | Code added in our Shopify settings | Can receive page, cart and checkout events from Shopify. Shopify marks it for analytics and marketing | Analytics and marketing | Unknown |
| `ds_ft`, `ds_lt` | DropSync | Record how you first and last came to our site (Section 4.5(c)) | Analytics | 90 days |
| `rewardful.referral` | Rewardful | An older affiliate-tracking script that still loads. It credits the affiliate who referred you, and adds a referral ID to Stripe links | Affiliate tracking | The number of days set in our Rewardful campaign |
| `ff_referral_code`, `ff_referral_source`, `ff_rc_…` (browser storage) | DropSync | Remember a referral link, and stop a click being counted twice in one day | Affiliate tracking | Until you clear it |
| `ds_hero_google` (browser storage), `dsh_wave_seen` (session storage) | DropSync | Page display features | Functional | Until you clear it, or until the end of your visit |
15.4 In the Web App (app.dropsync.io):
| Name | Set by | What it does | Type | How long |
|---|---|---|---|---|
| `__session` | DropSync (Firebase) | Keeps you signed in | Strictly necessary | 24 hours |
| Firebase sign-in data (browser database) | Google Firebase | Keeps you signed in | Strictly necessary | Until you sign out |
| Google Analytics (`_ga` cookies) | Measures use of the Web App and purchases (Section 4.5(a)) | Analytics | 2 years | |
| Sentry (no cookie) | Sentry | Sends error reports (Section 4.3) | Error tracking | Not stored in your browser |
| Browser storage (about 100 items) | DropSync | Settings, feature switches, and saved results from Competitor Scanner, Product Sourcing and Clone Hunter. Some items contain other sellers' store names | Functional | Until you clear your browser's site data |
| `ds_ft`, `ds_lt` (read only) | DropSync | Read once, to save how you came to us with your new Account | Analytics | See Section 15.3 |
The Web App does not show a cookie banner. Google Analytics runs when the page opens. You can block it as Section 15.7 explains.
15.5 In the Extension. The Extension does not set cookies. It uses Chrome's storage for the items in Section 5.2.
15.6 Your choices on the Website. Shopify's cookie banner appears in some regions, depending on where you are. Shopify's own cookies and pixels follow your choice in the banner. Our `ds_ft` and `ds_lt` cookies follow a refusal of analytics in the banner once your choice has loaded. Rewardful's script loads on every page. You can block any of these as Section 15.7 explains.
15.7 How to block or delete cookies.
(a) Use your browser's settings to block or delete cookies and site data.
(b) Use Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) to stop Google Analytics on every site.
(c) Clear your browser's site data for dropsync.io and app.dropsync.io.
If you block strictly necessary cookies, you cannot stay signed in.
15.8 Do Not Track. Our sites do not respond to "Do Not Track" signals from browsers.
16. Marketing emails and how to opt out
16.1 Customers. When you check out, including for a Trial, we add you to our newsletter list. We may send you:
(a) our Weekly Sync newsletter;
(b) a week-one playbook;
(c) reminders if you have not used DropSync for a while, and offers to come back after you cancel; and
(d) a short survey after you cancel.
16.2 People who sign up. When you sign up for a guide, the eBay Sales Report or the Title Builder unlock, we add your email address to our list at once. We do not send a confirmation email first. If you create a customer account on the Website, we add you to our list only if you tick the box for email marketing.
16.3 Unfinished checkouts. If you start a checkout and do not finish, we may email you a reminder (Section 3.5).
16.4 How to opt out.
(a) Use the "Unsubscribe" link at the bottom of the Weekly Sync newsletter.
(b) For our other marketing emails, such as the week-one playbook, use the "Unsubscribe" option that your email app shows. It sends an unsubscribe request to hello@dropsync.io.
(c) You can always email hello@dropsync.io with "unsubscribe" in the subject line.
(d) If you unsubscribe from marketing, we will still send service emails, such as password resets, Trial reminders and payment notices.
16.5 Sales emails to eBay sellers and creators. See Sections 9.3 and 9.4.
16.6 Tracking in emails. Links in the Weekly Sync carry campaign tags, so we can see clicks in our analytics. Our emails, including the Weekly Sync, can also contain a small image and tracked links. These tell us, through Resend, whether you opened the email and which links you clicked (Section 4.8).
17. Chrome Web Store Limited Use statement
17.1 What DropSync does with information it receives through the DropSync Chrome extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
17.2 In plain terms:
(a) We use data from the Extension only to provide and improve the features that the Extension offers: listing, tracking, pricing and fulfilling products for your selling business.
(b) We pass this data to others only to run those features (Section 12), to follow the law, or to protect against fraud, abuse, malware, spam or security threats. We may also pass it on as part of a merger or sale of the business, but only if you agree first.
(c) We do not sell this data. We do not use it, or pass it on, for advertising, including personalised advertising. We do not use it to decide whether you can get credit or a loan.
(d) No person at DropSync reads this data, except when:
- you agree to it for specific data, for example when you ask support to look into a problem;
- we need to for security, for example to investigate abuse;
- we need to find and fix a fault in the Service that may affect you, for example in our nightly check for listings that look wrong. We then look only at what we need;
- the law requires it; or
- the data is combined and made anonymous for our internal operations.
18. Your rights
18.1 Your rights under UK and EU law. You have the right:
(a) to be told how we use your data (this policy);
(b) to get a copy of your data (access);
(c) to have wrong data corrected;
(d) to have your data deleted;
(e) to ask us to limit how we use your data (restriction);
(f) to get the data you gave us in a common format, or to have it sent to someone else, where we use it under a contract or with your consent (portability);
(g) to object (see the box below);
(h) to withdraw your consent at any time. This does not affect what we did before you withdrew it;
(i) not to be subject to decisions based only on automated processing that have legal or similarly significant effects (Section 11); and
(j) to complain to a regulator (Section 23).
Your right to object. You can object at any time to our use of your data when we rely on legitimate interests (Section 10). We must then stop, unless we have strong legitimate reasons that override your interests, rights and freedoms, or we need the data for a legal claim. You can object to direct marketing at any time, for any reason. We must then stop using your data for marketing. To object, email hello@dropsync.io, or use the unsubscribe link in our newsletter.
18.2 How to use your rights. Email hello@dropsync.io. We may ask you to confirm who you are, for example by writing to us from your Account email address. Using your rights is free. We will reply within one month. If a request is complex, or we get many requests, the law lets us take up to two more months. If we need this extra time, we will tell you why within the first month.
18.3 We handle requests by hand. We do not yet have a button in the Web App to download or delete all your data. We handle each request by hand.
18.4 Things you can do yourself.
(a) Clear your listing records in My Products.
(b) Disconnect AliExpress.
(c) Cancel your Plan in the Web App.
(d) Unsubscribe from marketing emails (Section 16.4).
(e) Remove the Extension, or clear its data, to delete what it stores in your browser.
(f) Clear your browser's site data for the Website and the Web App.
18.5 Cancelling is not deleting. When you cancel your Plan, we do not delete your data. If you want us to delete it, ask us.
18.6 Limits. Some rights have limits. For example, we may keep records that the law requires, or data that we need for a legal claim. Stripe keeps its own payment records under its own rules. If we cannot do all that you ask, we will tell you why.
18.7 Buyer Data. For Buyer Data, we act on the seller's instructions. If you are a buyer, contact the seller (Section 7.9). If you are a seller and a buyer asks you to use their rights, we will help you.
18.8 Someone acting for you. Someone else can make a request for you if you give them permission. We may ask for proof of that permission.
19. US privacy rights
19.1 Requests from anyone. We answer privacy requests from anyone, wherever they live. You can ask to know what data we hold about you, to get a copy, to correct it or to delete it. Email hello@dropsync.io. We will not charge you, or treat you differently, for using your rights.
19.2 Selling and sharing. We do not sell personal data for money. But some US state laws use a wider meaning of "selling" and "sharing". Under those laws, Google's tags on the Website (including the Merchant Center tag) and the Shopify app pixel in Section 15.3 may count as "selling" or "sharing" for targeted advertising. To opt out:
(a) refuse marketing cookies in the cookie banner, where it appears;
(b) block cookies in your browser (Section 15.7); or
(c) contact us at hello@dropsync.io.
19.3 Tracking by other companies. Google, Shopify, Rewardful and the provider of the Shopify app pixel in Section 15.3 can collect information about your online activity over time and across different websites when you use our sites.
19.4 Do Not Track. Our sites do not respond to Do Not Track signals (Section 15.8).
19.5 California. The kinds of personal data we collect are in Sections 3 to 9. The kinds of companies we share it with are in Section 12. How we tell you about changes is in Section 22. The effective date is at the top of this policy.
20. Children
20.1 DropSync is for adults who run a selling business. You must be at least 18, or the age of majority where you live if that is higher (Terms of Service, Section 2.4).
20.2 We do not knowingly collect data from anyone under 18. If you think a child has given us data, email hello@dropsync.io and we will delete it.
21. Security
21.1 What we do.
(a) Data travels between your browser and our servers over encrypted connections (HTTPS).
(b) Google encrypts our database and file storage.
(c) Firebase stores passwords in hashed form. We never see your password.
(d) Our sign-in cookie cannot be read by page scripts, is sent only over HTTPS, and lasts 24 hours.
(e) Extension sign-in codes last 60 seconds, and we store only a hashed copy.
(f) Database rules limit what each signed-in user can read. Only the people who run DropSync and approved support operators can use our admin tools.
(g) We review our own code for security problems and work to fix what we find.
21.2 No promise of perfect security. No system is fully secure. We cannot promise that data will never be lost, misused, or accessed without permission.
21.3 What you can do.
(a) Use a strong password that you do not use anywhere else.
(b) Sign out on shared computers.
(c) Install Extension updates when they come out (Terms of Service, Section 22.2A).
(d) Take care with screenshots, screen-shares and Auto Order Links. They can show Buyer Data.
(e) Tell us at once at hello@dropsync.io if you think someone has accessed your Account (Terms of Service, Section 6.5).
21.4 If something goes wrong. If a personal data breach is likely to put you at risk, we will tell you. We will tell the regulator when the law requires it. If a breach affects Buyer Data, we will tell the seller, so the seller can decide what to do.
22. Changes to this policy
22.1 We will update this policy when the Service or the law changes. We will update it before we use personal data for a new purpose.
22.2 We will post the new version on this page and change the version number and effective date at the top.
22.3 If a change is important, we will tell customers by email or in the Web App before the change applies.
23. Complaints
23.1 If you are unhappy with how we handle your data, please contact us first at hello@dropsync.io. We want to put it right.
23.2 In the UK, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call the ICO helpline on 0303 123 1113.
23.3 In the EU or EEA, you can complain to the data protection authority in the country where you live or work, or where the problem happened. The European Data Protection Board lists these authorities at edpb.europa.eu.
23.4 Elsewhere, you can contact your local privacy regulator. In the USA, you can contact your state's attorney general.