Privacy Policy

1. Information We Collect

1.1 Information You Provide to Us

When you create an account or use the Service, you may provide us with:

Note on Payment Data: We do not store your full credit card number. Payment processing is handled by our payment processor (Polar), which maintains its own privacy practices. We only receive limited payment information necessary to manage your subscription.

1.2 Information Collected Automatically

When you access the Service, we automatically collect:

Usage Data:

• Pages visited and features used
• Date and time of access
• Actions taken (uploads, deletions, etc.)
• Referral URLs
• A history of actions on your sites (creation, updates, deletion, suspension)
• Number of visits to your dashboard
• Error reports when something goes wrong in the application

Device and Technical Data:

• IP address
• Browser type and version
• Operating system
• Device type (desktop, mobile, tablet)
• Screen resolution (on our marketing website, supadrop.host, through OpenPanel)
• Language preferences

Location Data:

• Country and city, derived from IP address (on our marketing website, supadrop.host, through OpenPanel)
• We do NOT collect precise GPS location

Tracking Technologies:

• Conversion tracking pixels (only with your consent)
• These technologies help us measure the effectiveness of our advertising campaigns
• If you accepted marketing cookies on our website, we also send conversion events (sign-up, first site, checkout) from our servers to Meta, with your email address and user identifier in hashed form, your IP address and browser user agent
• Sign-up attribution (only with your consent): on your first visit after you accept, we remember the campaign that brought you (UTM parameters and referral code), the first page you landed on and the external website that sent you. The app reads this information once when you create your account, then deletes it
• Product analytics in the app (only with your consent): we measure how the app at app.supadrop.host is used (pages viewed, features used) with our self-hosted OpenPanel instance. This data is linked to your account identifier, never to your email address or name

Product Events: Our servers record key events in your account (sign-up, deployments, plan limits reached, checkout, subscription changes) to run and improve the Service. These events do not rely on cookies and are recorded on the basis of our legitimate interest.

1.3 Information from Third Parties

If you choose to sign in using Google, we receive:

We only receive information you have made public or authorized the provider to share with us.

1.4 Information We Do NOT Collect

• Sensitive personal data (race, religion, health, sexual orientation)
• Financial account numbers (handled by payment processor)
• Precise geolocation (GPS)
• Biometric data
• Data from children under 18

1.5 Visitors of Sites Hosted on Supadrop

When someone visits a site hosted on Supadrop, their browser sends technical data (such as IP address, browser user agent and requested URL) to our infrastructure providers, Cloudflare and, for custom domains, our server provider, in order to deliver the site and protect it against abuse.

If the site owner has enabled email capture, we also process, on behalf of the site owner:

• The email address entered by the visitor
• The verification status of the address and related dates
• A one-way hash of the visitor's IP address and a truncated browser user agent, used to prevent abuse
• A cookie named sdp_ec that remembers, for 30 days, that the visitor has verified an email address

For this data, the site owner is the controller and Supadrop acts as a processor. Visitors should contact the site owner to exercise their rights. If they cannot identify or reach the site owner, they can contact us at contact@supadrop.host and we will forward the request.

Supadrop does not use visitors' email addresses for its own purposes and does not send them marketing emails. The only email we send is the verification link requested by the visitor.

2. How We Use Your Information

2.1 To Provide the Service

• Create and manage your account
• Host and serve your websites
• Generate subdomains and QR codes
• Process payments and manage subscriptions
• Provide customer support

2.2 To Improve the Service

• Analyze usage patterns and trends
• Understand which campaigns and websites bring new users (only with your consent)
• Identify and fix bugs and errors
• Develop new features
• Optimize performance and user experience

2.3 To Communicate With You

• Send service-related notifications (account updates, security alerts)
• Respond to your inquiries and support requests
• Send transactional emails (payment confirmations, subscription reminders)
• Send tips about getting started, reminders before your trial ends, and occasional news about Supadrop features. You can opt out at any time from your account settings or with the unsubscribe link in these emails

2.4 To Ensure Security and Prevent Abuse

• Detect and prevent fraud, spam, and abuse
• Enforce our Terms of Use
• Protect the rights and safety of our users
• Comply with legal obligations

2.5 To Comply With Legal Obligations

• Respond to legal requests (subpoenas, court orders)
• Maintain records as required by law (tax, accounting)
• Report illegal content to authorities when required

3. Legal Bases for Processing (GDPR)

Under the GDPR, we must have a legal basis to process your personal data. We rely on the following:

Your Right to Withdraw Consent and to Object

Where we rely on consent, you can withdraw it at any time through the "Cookie preferences" link in the footer of our website, or by contacting us at contact@supadrop.host. Your choice applies to both our website and the app, so withdrawing it once is enough. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Where we rely on legitimate interest, you can object at any time. For onboarding and product emails, you can do so by:

• Updating your email preferences in your account settings
• Clicking "unsubscribe" in these emails
• Contacting us at contact@supadrop.host

Automated Decision-Making

We automatically analyze uploaded content to protect visitors against phishing and fraud. When this analysis finds a high risk, a site on an account without an active paid plan can be suspended automatically, without prior human review. This decision is necessary to enforce our Terms of Use and protect third parties.

You are informed by email when this happens. You can contest the decision and obtain a review by a person by contacting contact@supadrop.host. Account bans and all other decisions affecting your account are made by a person.

We do not use profiling that produces legal effects concerning you.

4. How We Share Your Information

We do NOT sell your personal information. We share data only in the following circumstances:

4.1 Service Providers (Sub-processors)

We use trusted third-party services to operate Supadrop:

Custom domain names are included in SSL certificates, which are recorded in public Certificate Transparency logs.

All service providers are contractually obligated to:

• Process data only on our instructions
• Implement appropriate security measures
• Assist us in responding to your rights requests
• Delete or return data when the relationship ends

4.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or subpoenas
• Government or regulatory requests
• Legal proceedings involving Supadrop

4.3 Business Transfers

If Supadrop is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

4.4 Public Content

Websites you host on Supadrop are publicly accessible by default. Any content you upload becomes publicly available at your subdomain or custom domain. We are not responsible for the privacy of content you choose to make public.

5. International Data Transfers

Supadrop is based in Belgium (European Union). However, some of our service providers operate outside the EU/EEA.

When we transfer personal data outside the EU/EEA, we ensure appropriate safeguards are in place:

Cloudflare: While Cloudflare is a US company, we configure our services to store data in EU data centers where possible.

Content Delivery Network (CDN)

To ensure fast loading times worldwide, websites you host on Supadrop are served through Cloudflare's global CDN.

What this means:

• Storage: Your website files are stored on Cloudflare R2 servers located in the European Union
• Distribution: When visitors access your site, copies may be temporarily cached on Cloudflare edge servers around the world
• Nature of data: This applies only to the static files you upload and choose to make publicly accessible

Important: By uploading content to Supadrop, you acknowledge that this content will be publicly accessible and distributed globally via CDN.

6. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy.

6.1 Retention Periods

6.2 After Account Deletion

When you request the deletion of your account:

• You have 24 hours to cancel the request
• After 24 hours, your sites are taken offline and their files are deleted, and emails captured on your sites are deleted
• Your paid subscription, if any, is cancelled
• Your email address, name and profile picture are deleted from our systems, and the link with your Google account is removed
• We keep an anonymised account record and the history of actions on your former sites, to prevent abuse and fraud
• Payment records are kept for the legally required period
• Data remaining in backups is deleted when those backups expire

6.3 Free Trial Expiration

At the end of the 15-day free trial, if you do not subscribe to a paid plan:

• Your sites are taken offline immediately and visitors see an offline page
• You receive an email when the trial expires and a reminder 2 days before deletion
• After 7 days, your sites, their files and any captured emails are permanently deleted
• Your account remains accessible to subscribe and start fresh

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

7.1 Technical Measures

• Encryption in transit: All data transmitted via HTTPS/TLS
• Encryption at rest: Database encryption
• Access controls: Role-based access, principle of least privilege
• Authentication: Sign-in through Google, so no Supadrop password is stored. Two-factor authentication is managed in your Google account
• Hashing: API keys, email verification tokens and visitors' IP addresses are stored only in hashed form
• Database isolation: Row-level security on all database tables
• Infrastructure: Hosted on secure, certified platforms

7.2 Organizational Measures

• Limited employee access to personal data
• Confidentiality agreements with staff and contractors
• Regular security reviews and updates
• Incident response procedures

7.3 Your Responsibility

You are responsible for:

• Keeping the Google account you use to sign in secure
• Keeping your API key secret
• Logging out on shared devices
• Reporting suspicious activity

7.4 No Guarantee

Despite our efforts, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. In case of a data breach affecting your personal data, we will notify you and the relevant authorities as required by law.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us provide and improve the Service.

8.2 Types of Cookies We Use

Cookies used by Supadrop:

Analytics without cookies: Our marketing website uses a self-hosted OpenPanel instance. It does not set cookies, collect personal data or track you across sites. In the app, OpenPanel product analytics run only if you accepted, as described in section 1.2.

One choice for the website and the app: When you accept or reject on our website, your choice is stored in the supadrop_consent cookie, shared by supadrop.host and app.supadrop.host, for 6 months. You answer once and the app follows the same choice. After 6 months, we ask again. If you reject or later withdraw your consent, the sd_attr attribution cookie is deleted and no attribution or product analytics data is collected. If you close an announcement banner, that choice is stored in your browser's local storage (supadrop_announcement_dismissed).

8.3 Managing Cookies

You can control cookies through:

• Browser settings: Most browsers allow you to block or delete cookies
• Our cookie banner: Accept or reject non-essential cookies when you first visit
• Cookie preferences: Change or withdraw your choice at any time, for both the website and the app, via the "Cookie preferences" link in the footer

Note: Blocking essential cookies may prevent you from using the Service.

8.4 Do Not Track

We do not currently respond to "Do Not Track" browser signals, as there is no industry standard for this feature.

9. Social Logins

9.1 Available Options

You can create an account or log in using:

• Google

9.2 What We Receive

When you use social login, we receive basic profile information (email, name, profile picture) that you authorize the provider to share.

9.3 What We Don't Do

• We don't post anything on your behalf
• We don't access your contacts or friends
• We don't receive your password

9.4 Managing Social Connections

Google is currently the only way to sign in to Supadrop, so it cannot be disconnected while you keep your account. You can revoke Supadrop's access from your Google account settings, which will prevent you from signing in, or delete your Supadrop account from your account settings.

10. Your Privacy Rights

10.1 Rights Under GDPR (EU/EEA Users)

If you are in the European Union or European Economic Area, you have the following rights:

10.2 How to Exercise Your Rights

You can exercise your rights by:

1. Self-service: From your account settings you can update your display name, manage marketing emails and delete your account. From each site, you can export and delete captured emails. For a copy of your account data, contact us by email.
2. Email: Contact us at contact@supadrop.host

If you are a visitor of a site hosted on Supadrop and gave your email address through email capture, please contact the owner of that site first (see Section 1.5).

We will respond to your request within 30 days. If we need more time (up to 60 additional days for complex requests), we will inform you.

10.3 Right to Complain

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority.

Belgian Data Protection Authority:
Autorité de protection des données (APD)
Rue de la Presse 35
1000 Brussels
www.autoriteprotectiondonnees.be

11. Children's Privacy

Supadrop is not intended for children under 18 years of age.

We do not knowingly collect personal information from children under 18. If we discover that we have collected data from a child under 18, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at contact@supadrop.host.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties.

This includes:

• Websites you host on Supadrop (you control their content)
• Payment processors
• Payment pages hosted by Polar
• Social login providers
• Any external links

We encourage you to review the privacy policies of any third-party services you use.

13. Changes to This Policy

13.1 How We Notify You

• Minor changes: Updated "Last Updated" date at the top of this policy
• Material changes: Email notification and/or prominent notice on the Service

13.2 Your Acceptance

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy. If you do not agree with the changes, you should stop using the Service and delete your account.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Supadrop
Edmond Daoust
VAT: BE1016281965

Email: contact@supadrop.host
General support: contact@supadrop.host

We aim to respond to all inquiries within 30 days.