DRAFT — requires lawyer review. Not legal advice.
Dropwarden Privacy Policy
Effective date: TBD
This policy explains how TBD, TBD ("we", "us") handles personal data in
connection with Dropwarden, the website at dropwarden.com, the portal and web file client at
app.dropwarden.com, the API at api.dropwarden.com and the SFTP/FTPS service at sftp.dropwarden.com.
Contact for privacy questions and requests: [email protected] (subject "Privacy request").
EU representative (GDPR Art. 27): TBD. UK representative (UK GDPR Art. 27):
TBD.
1. Two roles: controller and processor
We are a controller for personal data we collect to run our business: website visitors, people who sign up, organization owners and admins, billing contacts, people who contact support or use chat, and recipients of our own emails. This policy covers that data.
We are a processor (a "service provider" under California law) for the files, folders, users, partners and activity that our customers manage in the Service ("Customer Data"). Our customer, the organization that invited you, is the controller. We process Customer Data only on its instructions, under our Data Processing Addendum. If you are a partner or end user of one of our customers and want to exercise your rights over Customer Data, please contact that organization. If you contact us, we will pass your request on to it.
2. What we collect (as controller) and why
| Category | Examples | Source | Purpose | GDPR legal basis |
|---|---|---|---|---|
| Account data | Name, email, password hash, 2FA status, federated login identifier (Google, Microsoft or SSO), organization name, role, locale, timezone | You | Create and secure your account, provide the Service | Contract (Art. 6(1)(b)) |
| Security and usage logs | IP address, login time and result, protocol, user agent, actions in the portal and API, rate-limit and abuse signals | Automatically | Security, fraud and abuse prevention (including trial abuse), troubleshooting | Legitimate interests (Art. 6(1)(f)) |
| Billing data | Billing name and address, email, tax ID, plan, invoices, payment status, last four digits and brand of card (from Stripe) | You and Stripe | Billing, tax, accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Usage metering | Storage used, number of credentials, download volume per organization | Automatically | Enforce Plan limits and bill overage | Contract |
| Support and chat | Messages, attachments you send us, chat widget identifiers | You | Answer questions, improve support | Contract; legitimate interests |
| Service emails | Email address, delivery, bounce and complaint status | Our email provider | Send account, security, billing and lifecycle emails; protect deliverability | Contract; legitimate interests |
| Marketing | Email address if you opt in to product news | You | Product updates | Consent (Art. 6(1)(a)); you can withdraw at any time |
| Website cookies | See the Cookie Policy | Automatically | Site operation; chat (if you consent) | Necessary: legitimate interests; non-essential: consent |
We do not collect payment card numbers. Card details go straight to Stripe through Stripe Checkout and the Stripe Customer Portal, and we never see them.
We do not intentionally collect special categories of personal data, and we do not use personal data for automated decisions that have legal or similarly significant effects on you.
3. How we handle Customer Data (summary)
Full terms are in the DPA. In short:
- We store files in object storage and process them only to provide the Service: transfer, storage, notifications, automations the customer configures, and automated malware scanning of uploads. No person at TBD looks at file contents unless an owner of the organization grants a time-boxed support session.
- We never log file contents. The audit log records events (who, what, when, IP address, protocol, file path and size), not what is inside files.
- A "read" means a completed download. Directory listings are not recorded as reads.
- Organizations can redact filenames in notifications, so that emails, chat messages and webhooks do not reveal file names.
- Audit events are kept for the audit retention period of the organization's Plan (30 (Starter) / 180 (Team) / 365 (Business) days on the organization's current Plan), then deleted automatically.
- If a trial is not converted, the organization is locked and its data is deleted 90 days after the lock. Locked paid organizations are deleted 90 days after the lock.
4. Who we share personal data with
We share personal data only with:
- Subprocessors and service providers that help us run the Service, listed with their purpose, data and location on our Subprocessors page: Oracle Cloud Infrastructure (hosting), Cloudflare (file and backup storage), Stripe (payments and tax), Amazon Web Services (email delivery) and Crisp (chat widget on our website and portal).
- Destinations our customers choose, such as a customer's Slack or Microsoft Teams workspace, webhook URL, identity provider or own storage bucket. These are not our subprocessors. The customer decides to send data there.
- Authorities or other parties when required by law, to protect rights, safety and security, or in a merger or acquisition (with notice to you).
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
5. International transfers
We host the Service in the Oracle Cloud region us-sanjose-1 and use providers that may process data in
the United States and other countries. When personal data from the EEA, the UK or Switzerland is
transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses
(Commission Decision (EU) 2021/914), the UK International Data Transfer Addendum, and, where the
recipient is certified, the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask
us for a copy of the relevant safeguards.
Customers can choose to store files in a Cloudflare R2 bucket located in the EU jurisdiction. Files on such organizations are stored in the EU but still pass through our compute region during transfer unless the customer uses a dedicated instance in an EU region.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the account exists. Deleted, or anonymized where records must be kept, when you delete your account or your organization is deleted |
| Organization data (controller side, e.g. owner and billing contacts) | Until the organization is deleted, following the lock periods above |
| Security logs | As long as needed for security, then deleted (target to be set in legal review) |
| Billing and tax records | As long as tax and accounting law requires (for example 7 years) |
| Support and chat messages | Up to 24 months after the conversation, unless needed for a dispute |
| Marketing consent | Until you withdraw it, plus proof of consent and opt-out |
| Encrypted database backups | Expire automatically within 35 days |
| Deletion record | A record that an organization was deleted, with no personal data, kept indefinitely as evidence |
7. Security
We encrypt data in transit (TLS 1.2 or later, modern SSH ciphers, FTPS with explicit TLS only) and at rest, require multi-factor authentication for our staff, limit staff access, and keep an append-only audit log. See the Security Overview.
8. Your rights under GDPR and UK GDPR
If GDPR or UK GDPR applies, you have the right to access your personal data, correct it, delete it,
restrict or object to processing (including direct marketing), receive it in a portable format, and
withdraw consent at any time without affecting earlier processing. Many of these you can do yourself in
the portal (profile, data export, account deletion). Otherwise email [email protected]. We answer within one
month, extendable by two months for complex requests. We may need to verify your identity.
You also have the right to complain to a supervisory authority, for example the authority in the EU country where you live or work, or the UK Information Commissioner's Office.
9. Notice for California residents (CCPA/CPRA)
This section applies to California residents and supplements the rest of this policy.
Categories collected in the last 12 months (as controller), with the sources and purposes in section 2:
- Identifiers (name, email, IP address, account identifiers);
- Customer records and commercial information (billing address, plan, invoices, payment status);
- Internet or network activity (logins, portal and API activity, website interactions);
- Coarse geolocation derived from IP address;
- Professional information (organization name and role);
- Sensitive personal information: account login credentials (email or username with password or key). We use it only to authenticate you and secure the Service, which California law permits without a right to limit.
We disclose these categories for business purposes to the service providers listed in section 4.
We do not sell or share personal information. We have not sold or shared personal information (as those terms are defined in the CCPA/CPRA) in the last 12 months, and we do not knowingly sell or share personal information of consumers under 16. We honour Global Privacy Control signals as a request to opt out, though we have nothing to opt you out of.
Your rights. You may request to know what personal information we collect, use and disclose; to
access a copy; to delete it; and to correct it. You will not be discriminated against for exercising these
rights. Send requests to [email protected]. We verify requests by confirming control of the account email
and may ask for more information where needed. An authorized agent may submit a request with your
signed permission. We respond within 45 days, extendable by 45 days with notice.
We do not offer financial incentives for personal information.
For Customer Data, we act as a service provider. Please send requests to the organization that controls the data.
10. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.
11. Changes
We will post changes here and update the effective date. For material changes we will email account owners before they take effect.
12. Contact
TBD, TBD. Email: [email protected].