This Privacy Policy explains how Droplytics Ltd collects, uses, shares and protects personal data when you visit droplytics.io, create an account, subscribe, use Market Radar, build or operate a storefront, use Ad Studio, connect integrations, contact us or otherwise use the Droplytics Platform.

1. Who we are

Droplytics Ltd (company number 17081668), registered at Flat 3, Nico House, 8 Station Square, Romford, Essex, England, RM2 6BY, is the controller unless we state that we act as processor. Contact support@droplytics.io. This Policy is intended to comply with the UK GDPR as amended, Data Protection Act 2018, Data (Use and Access) Act 2025 and, where relevant, PECR.

2. Scope and roles

This Policy covers visitors, account holders, prospective customers, subscribers, support contacts and Platform users. Where a business User controls its customers' data and Droplytics processes it solely on documented instructions, that User may be controller and Droplytics processor under appropriate processing terms.

3. Personal data we collect

Account and profile data includes name, email, authentication, business, plan, preferences, saved products, brands, ads, watchlists, stores and settings. Billing data includes billing identity, address, tax information, payment status, plan, transaction identifiers, invoices, trials and renewals; we do not intend to store full card numbers. Technical data includes IP, device, browser, operating system, timestamps, approximate location, logs, searches, clicks and diagnostics. Store and integration data includes configuration, branding, products, prices, domains, orders, payouts and information exchanged with enabled supplier, payment, e-commerce and advertising services. We also process communications, support, marketing preferences and information you submit.

4. How we collect data

We collect data directly from you, automatically through the website and Platform, from permitted cookies and similar technologies, and from connected providers or integrations you choose to use.

5. Purposes and lawful bases

We process data to create accounts and provide subscriptions (contract and legitimate interests); process payments, trials, renewals and refunds (contract and legal obligation); operate storefront, supplier, fulfilment, payment and advertising integrations (contract, legitimate interests or processor instructions); prevent fraud and secure the Platform (legitimate interests and legal obligation); provide support and enforce terms; analyse and improve performance; send service communications; conduct lawful direct marketing; and meet tax, accounting, regulatory and court requirements.

6. AI-assisted features and automated processing

Automated systems may generate or rank product insights, supplier matches, demand or risk indicators, advertising concepts, creative and copy, and security or fraud signals. We do not intend solely automated decisions producing legal or similarly significant effects for ordinary Users. If that changes, required information, human intervention and contest rights will be provided.

7. Cookies and storage/access technologies

Cookies, local storage, pixels, scripts and tags may support authentication, security, preferences, functionality, analytics and advertising measurement. Where PECR requires consent, our consent interface will request it before non-essential storage or access. Data (Use and Access) Act 2025 low-intrusion exceptions may apply, while transparency remains required. Choices can be changed through available controls or device settings.

8. Direct marketing

We send product news, offers or education only where permitted under data-protection law and PECR. Unsubscribe through a message or support@droplytics.io. Necessary service, billing and security communications may continue.

9. Sharing personal data

We may share data as necessary with cloud, database, delivery, security and monitoring providers; payment and fraud providers; email, support and analytics providers; supplier, fulfilment, advertising and e-commerce integrations; advisers, insurers, auditors, investors or purchasers under confidentiality; and authorities where legally permitted. We do not sell personal data as a commodity. Processors receive contractual safeguards; independent controllers apply their own notices.

10. International transfers

For processing outside the UK, lawful safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or another permitted mechanism, with supplementary safeguards where needed.

11. Retention

Data is kept only as reasonably necessary to provide services, maintain security, resolve disputes and meet legal, tax and accounting duties. Account data is generally retained for the account life plus a reasonable recovery and dispute period; billing data for legally required periods; support records according to the issue and limitation periods; security logs for a proportionate limited period; and marketing preferences as needed to respect choices. Anonymised data may be retained.

12. Security

Appropriate measures may include access controls, authentication, encryption in transit or at rest where appropriate, logging, monitoring, backups, supplier controls and least-privilege access. No online system is completely secure.

13. Your data-protection rights

Depending on circumstances, you may have rights to information, access, correction, erasure, restriction, portability, objection to legitimate-interest processing and direct marketing, withdrawal of consent, and safeguards for qualifying automated decisions. Rights may have legal conditions or exemptions and identity verification may be required. Email support@droplytics.io.

14. Data-protection complaints

Complain to support@droplytics.io. We will facilitate and acknowledge qualifying complaints as legally required and respond without undue delay. You may also complain directly to the UK Information Commissioner through ico.org.uk.

15. Children

The Platform is for people aged 18 or over. We do not knowingly offer accounts to children and will take appropriate action if data was collected in breach of this restriction.

16. Third-party links and services

Third-party websites and integrations may act as independent controllers under their own privacy information. Review their notices before enabling an integration or providing data.

17. Changes to this Policy

We may update this Policy as the Platform, providers or law changes. We will publish the current version and take any additional legally required step for a material change, including notice or consent where required.

18. Contact

Droplytics Ltd, Flat 3, Nico House, 8 Station Square, Romford, Essex, England, RM2 6BY. Email: support@droplytics.io. Website: droplytics.io.