Privacy Policy

This Privacy Policy explains how Clear Data Decisions, LLC (operating DropRoom, "we", "us") collects, uses, shares, and protects your information.

1. Information We Collect

• Account information: the email address you provide at sign-up/sign-in; if you use Google sign-in, the name, email, and avatar returned by Google. DropRoom supports both email/password and Google sign-in.
• Organizer (团长) information: shop name, shop URL (subdomain), city, contact details (e.g., WeChat name, support email), and the payment-method information you choose to display to buyers (e.g., your own Zelle/WeChat handles — your own collection channels).
• Buyer information: name, contact (WeChat and/or phone), and any shipping name and address you choose to provide when joining a group order.
• Order & group-buy records: the items, color/size, quantity, and status you order, plus the arrival/notified/payment/shipping/tracking statuses an organizer manually records to coordinate fulfillment.
• Usage & device data: pages visited, actions taken, browser, operating system, device type, and IP address, plus coarse (city-level) location inferred from IP (not precise GPS).
• Communications: messages or support requests you send us.

We do not collect buyer payment card or bank account numbers. Buyer-to-organizer payments are handled by the parties off-platform (see Terms §6).

2. How We Use Your Information

• To provide and operate the DropRoom coordination platform
• To help organizers turn supplier lookbooks into orderable products and manage the "arrived → notified → payment logged → shipped/pickup" fulfillment flow
• To send you email notifications related to your activity (arrival, payment reminders, waitlist promotion, shipped/ready-for-pickup)
• To improve the platform and user experience, troubleshoot, and detect and prevent abuse and fraud
• To comply with legal obligations and respond to your support requests

Where applicable, our legal bases include performing our contract with you, our legitimate interests in operating and securing the platform, compliance with law, and your consent where required.

3. How We Share Information

We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We share only:

• With organizers: a buyer's name, contact, shipping details, and group-order participation are visible to the organizer running that group so they can coordinate collection and fulfillment. DropRoom enforces database row-level security (RLS) to isolate each organizer's data — one organizer cannot access another's.
• Service providers (processing data on our behalf under contract, per their own privacy policies):
  • Supabase — database, authentication, file storage (US infrastructure)
  • Google — third-party sign-in (only if you choose Google)
  • Resend — sending transactional notification emails
  • Cloudflare Turnstile — bot protection at sign-up/checkout
  • Vercel — website hosting and basic traffic analytics
  • Sentry — error monitoring (reported data is scrubbed; session recording/replay is disabled)
  • A future payment processor (e.g., Stripe) — only if and when we charge organizers a platform fee (not currently enabled)
• Business transfers: in a merger, acquisition, or asset sale, your information may transfer as part of the transaction, subject to this Policy.
• Legal: where required by law, or to protect the rights, property, and safety of users and the platform, or to address fraud/abuse.

AI processing handles images only, never buyer personal information. If we use visual AI (via providers such as OpenRouter) to turn supplier lookbooks into product lists, only the lookbook images are sent to the model; buyers' names, contact details, addresses, and orders are never sent to any third-party AI model.

4. Payments & Financial Information

• DropRoom does not handle buyer-to-organizer money at all — no collection, custody, escrow, or settlement. All amounts, payment methods (e.g., the organizer's own Zelle), timing, and related disputes are the parties' responsibility off-platform. Payment/shipping statuses shown on the platform are manual coordination text entered by the organizer; DropRoom does not verify, authorize, or audit them.
• Platform fees: DropRoom is currently free (Open Beta) and does not charge organizers a platform fee. If we introduce fees in the future, they will be charged only to organizers via a third-party PCI-compliant processor; that transaction is separate from and unrelated to buyer↔organizer payments, and we do not store full card numbers on our own servers.

5. Storage, International Transfer & Security

• Where stored: your data is stored on infrastructure located in the United States (Supabase / Vercel). If you use DropRoom from outside the U.S. (e.g., mainland China), your information will be transferred to and stored in the U.S. and subject to U.S. law. By using the platform you understand and consent to this transfer.
• Security measures: encrypted connections (HTTPS), database row-level security (multi-tenant isolation), and least-privilege access.
• Important: no method of internet transmission or storage is 100% secure. We take reasonable measures but cannot guarantee absolute security.
• Breach notification: if a security incident affecting your personal information occurs, we will notify you and relevant regulators as required by applicable law.

6. Data Retention

We retain your data while your account is active. After account closure, we delete or anonymize your personal information within a reasonable period, though we may retain some records to meet legal, financial, dispute-resolution, or fraud-prevention needs. To preserve the integrity of other users' business records, your historical transactions in others' group orders may be retained in anonymized form (e.g., "Deactivated user").

7. Your Rights

You may:

• Access and update your profile information anytime in account settings
• Delete your account (personal information deleted or anonymized, see §6)
• Opt out of non-essential marketing communications (transactional notices tied to your orders/group buys excepted)
• Request a copy of the personal information we hold about you

California residents (CCPA/CPRA): you have the right to know the categories of personal information we collect, to request deletion, to request correction, and not to be discriminated against for exercising these rights. We do not sell or "share" (for cross-context advertising) your personal information. Residents of other states or countries may have similar rights under local law.

To exercise any of these rights, email legal@droproom.net; we may need to verify your identity first.

8. Minors

DropRoom is not directed to individuals under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact legal@droproom.net and we will delete it.

9. Cookies & Analytics

We use essential cookies and local storage to keep you signed in and remember preferences (e.g., language), and Vercel's basic traffic analytics to measure usage. We do not use third-party advertising cookies, do not track you across sites, and do not use session recording/replay. Because we do not track across sites, we do not currently respond to browser "Do Not Track" signals.

10. Third-Party Links & Services

The platform may contain links or references to third parties (e.g., an organizer's own payment link, external images). We do not control and are not responsible for their privacy practices or content; please review their policies.

11. Changes to This Policy

We may update this Policy from time to time and will notify users of material changes through the platform. Continued use after changes means you accept the updated Policy.

12. Contact Us

Questions or complaints about this Privacy Policy: legal@droproom.net, or Clear Data Decisions, LLC, Knoxville, Tennessee, USA.