Effective: November 3, 2026
DripDrop Privacy Policy
This Privacy Policy explains how 1A 2A, LLC, a Wyoming limited liability company ("Company," "we," "us," "our"), operator of DripDrop at dripdropai.com, collects, uses, shares and protects personal information. We are the "controller" (GDPR) and "business" (CCPA/CPRA, if applicable) for this data.
1. Information We Collect
- Account data: email address and magic-link authentication data (tokens, session identifiers) via Supabase.
- Billing data: name, billing address, subscription and invoice history, card brand/last four via Stripe. Stripe collects and processes your card at trial start; DripDrop does not collect full card numbers. No subscription charge is made until the 14-day trial ends. Cancel anytime before then through “Manage billing” to avoid the subscription charge.
- eBay data: eBay OAuth access/refresh tokens, seller account identifiers, listings, and order data, which includes your buyers' names, shipping addresses, and purchased items. We process buyer data on your behalf to fulfill orders; for buyer data you are the controller and we act as your processor.
- Fulfillment data: CJ Dropshipping order and tracking information.
- Mailing-list consent records: email, opt-in status, consent timestamp, source.
- Device and usage data: IP address, browser type, pages viewed, timestamps, and similar log data; cookies as described in our Cookie Policy.
- Communications: messages you send to support.
We do not knowingly collect information from children under 13 (or under 16 in the EEA/UK). We do not collect full payment card numbers; Stripe processes them.
2. How We Use Information and Legal Bases (GDPR)
| Purpose | Legal basis | |---|---| | Provide the Service, authenticate you, process subscriptions | Performance of contract | | Send transactional emails (sign-in links, receipts, trial reminders, price-change notices) | Contract; legal obligation | | Send marketing emails | Consent (withdrawable at any time) | | Security, fraud prevention, debugging, improving the Service | Legitimate interests | | Tax, accounting and legal compliance | Legal obligation |
3. Mailing List
We send marketing emails only if you opt in. We do not currently send marketing emails. Before we do, each will include our valid postal address and an unsubscribe link. We record your consent, including the date/time (timestamp), the form or page used. Every marketing email includes a one-click unsubscribe link; we process unsubscribes within 10 business days.
4. Subprocessors / Service Providers
| Provider | Purpose | Location | |---|---|---| | Lovable Cloud/Supabase | Database, hosting of account data, magic-link authentication | United States | | Stripe, Inc. | Payment processing, Checkout, customer billing portal | United States / global | | eBay Inc. | Marketplace API (listings, orders) | United States | | CJ Dropshipping | Product sourcing and fulfillment (receives buyer shipping details) | China and other countries where CJ operates warehouses |
We will update this list when providers change.
5. Sharing
When you place or fulfill an order, we share the order details (product, quantity, shipping name and address) with CJ Dropshipping so it can ship the order.
We do not sell personal information and do not "share" it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We disclose information to the service providers above under contract, when required by law or to protect rights and safety, and in connection with a merger, acquisition or asset sale.
6. International Transfers
We are based in the United States. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where a provider is certified.
7. Retention
We keep account data while your account is active, billing records as required by tax law, and consent records for as long as needed to prove consent.
8. Your Rights
EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent at any time, and the right to complain to your local supervisory authority.
California (CCPA/CPRA): the right to know/access the categories and specific pieces of personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share), the right to limit use of sensitive personal information (we do not use it for purposes requiring that right), and the right not to be discriminated against for exercising rights. Categories collected in the last 12 months: identifiers (email, IP), commercial information (subscription history), internet activity, and inferences only as described above; sources and purposes are described in Sections 1-2. You may use an authorized agent. We will verify requests by confirming control of your account email.
To exercise rights, email support@dripdropai.com. We respond within the time required by law (generally 30 days under GDPR, 45 days under CCPA).
9. Security
We use reasonable administrative, technical and physical safeguards, including encryption in transit. No system is perfectly secure.
10. Changes
We will post updates here with a new "Last updated" date and notify you of material changes.
11. Contact
1A 2A, LLC, a Wyoming limited liability company ("Company," "we," "us," "our")
Contact: support@dripdropai.com