Privacy Policy

Effective Date: 20 August 2025

Applies to: drophero.app (site & app), the DropHero Chrome extension(s), our Shopify app(s), and related services.

DropHero (“DropHero”, “we”, “our”, “us”) provides tools to generate original, rights-safe ad creatives and help merchants publish and analyze ads. We design our systems around data minimization, user control, and compliance.

Contact (Privacy): support@drophero.app
Security contact: security@drophero.app

privacy policies

Term of Use

  1. Roles under GDPR
  2. Data we collect (minimal necessary)
    1. 2.1 Account & billing
    2. 2.2 Service/operational data
    3. 2.3 Shopify (Merchant & Merchant’s Customer Data)
    4. 2.4 Meta/Facebook Platform Data (when you connect)
    5. 2.5 Chrome extension data (Google)
    6. 2.6 Marketing/communications & website analytics
  3. Why we use data (purposes & legal bases)
  4. Retention
  5. Sharing & subprocessors
    1. 5.1 International transfers
  6. Your rights
  7. Cookies & tracking
  8. Shopify-specific disclosures
  9. Meta/Facebook Platform disclosures
    1. 9.1 Permissions we may request and why
    2. 9.2 How we use Meta data
    3. 9.3 Tokens & security
    4. 9.4 Revoke access
    5. 9.5 Meta data deletion (required by Meta)
    6. 9.6 OAuth transparency
  10. Chrome Web Store / Extension (“Data Disclosure”)
    1. 10.1 What the extension collects (only when you use it)
    2. 10.2 How we use it
    3. 10.3 Sharing/sale
    4. 10.4 Retention & control
  11. Affiliates & referrals
  12. Security
  13. Children
  14. Your choices & controls
  15. Data Subject Requests & Deletion
  16. Changes to this Policy
  17. Links & references (for reviewers)
  18. Annex A — Shopify Uninstall & Deletion
  19. Annex B — Meta Permissions & Example Data
  20. Annex C — Chrome Extension Permissions (typical)

1. Roles under GDPR

  • Controller. We act as data controller for your DropHero account, billing, support, and our own marketing/analytics.
  • Processor. When our Shopify app processes Merchant’s Customer Data (e.g., product/catalog info you direct us to use in creatives/ads), we act as a processor on your instructions; you (the Merchant) remain controller.

2. Data we collect (minimal necessary)

We only collect what we need to provide and improve DropHero

2.1. Account & billing

  • Name, email, company, role, country, password hash/SSO ID, login timestamps.
  • Plan, subscription status, usage tier, feature flags.
  • Billing via Paddle (we don’t store full card details). VAT/tax info, transaction IDs, refunds/chargebacks.

2.2. Service/operational data

  • Projects you create, prompts, generated copy/creatives, assets you upload (images/video you own or are licensed to use).
  • Configuration: connected ad accounts, page IDs, Shopify store/app settings, affiliate ID.
  • Operational logs and error diagnostics (e.g., job IDs, timing, status codes) for reliability and abuse prevention.

2.3. Shopify (Merchant & Merchant’s Customer Data)

  • Merchant Data (controller): store URL, owner/admin contact, app configuration, subscription status, and app-level settings.
  • Merchant’s Customer Data (processor): product/catalog identifiers and attributes you choose to process (titles, descriptions, images/URLs, price fields as needed for creatives). We do not intentionally collect sensitive data.

2.4. Meta/Facebook Platform Data (when you connect)

Depending on features you enable, we may process:

  • pages_show_list: list of Pages you manage (ID, name, basic perms) to let you pick the “From Page.”
  • pages_read_engagement (optional): high-level organic Page engagement metrics (if you enable an organic overview).
  • business_management: allow selection of Business assets (ad accounts, Pages) for use in DropHero.
  • ads_management: create/edit/publish ads/creatives/ad sets/campaigns on your behalf.
  • ads_read: fetch ad insights (e.g., impressions, clicks, CTR, CPC, CPM, spend, actions/conversions) to display in dashboards.
  • Access tokens are encrypted, refreshed as needed, and removed on disconnect or after inactivity.

2.5. Chrome extension data (Google)

When you actively use the extension:

  • Content you select on a page (publicly visible text snippets and image URLs) to send to DropHero for creative generation.
  • Basic identifiers to authenticate API calls to your DropHero account
  • Usage diagnostics (success/failure codes, timestamps) for debugging.

The extension does not read passwords, private messages, or payment card data.

2.6. Marketing/communications & website analytics

Depending on features you enable, we may process:

  • Email interactions (opens/clicks) via our ESP.
  • Affiliate attribution via GoAffPro (cookies/parameters).
  • Privacy-respecting analytics (aggregated, pseudonymized where feasible).

We do not sell personal data.

  • Provide the service (authenticate, run features, generate creatives, connect integrations): Contract (Art. 6(1)(b) GDPR).
  • Create/publish ads & read insights you request (Meta APIs): Contract (Art. 6(1)(b)).
  • Billing, tax, fraud/abuse: Legal obligation/Legitimate interests (Art. 6(1)(c)/(f)).Display relevant content
  • Support & incident response: Legitimate interests (Art. 6(1)(f)).
  • Product analytics/improvement (aggregate): Legitimate interests (Art. 6(1)(f)).
  • Marketing communications (opt-out anytime): Consent or Legitimate interests (Art. 6(1)(a)/(f)).
  • Compliance & security: Legal obligation/Legitimate interests (Art. 6(1)(c)/(f)).

For Shopify processor data, we only process under your instructions via the Shopify API and terms.

4. Retention

  • Account/billing: active account duration, then up to 90 days for closure/chargebacks; financial records 7–10 years if required by law.
  • Operational logs: 30–90 days (shorter for raw logs, longer for aggregates).
  • Meta tokens/caches: deleted on disconnect or after 30 days of inactivity.
  • Shopify processor data: only while needed to deliver the feature, then deleted/anonymized within 30 days of uninstall or request.
  • Extension diagnostics: 30–90 days.

5. Sharing & subprocessors

We share data only with vendors that help deliver DropHero, each under a DPA and (if applicable) Standard Contractual Clauses (SCCs) for international transfers.


Core vendors (illustrative):

  • Paddle (payments, tax, invoicing)
  • GoAffPro (affiliate tracking & payouts)
  • n8n (workflow automation)
  • [Hosting provider] (app/database hosting)
  • [Email service provider] (transactional & marketing email)
  • [Error/Crash & Logging] (e.g., Sentry/observability)
  • [Analytics] (privacy-respecting, aggregate)

We may disclose data if required by law, to protect rights/safety, or in a merger/acquisition (with safeguards). We do not sell data.


5.1. International transfers

When data leaves the EEA/UK we rely on:

  • Adequacy decisions (where available) or
  • SCCs plus supplementary measures (encryption, access controls).

You can request details at support@drophero.app.

6. Your rights

Subject to applicable law, you can access, rectify, erase, restrict, object, port your data, and withdraw consent at any time. We may verify identity. For data where we act as processor (e.g., Merchant’s Customer Data via Shopify), we will refer you to the Merchant/controller.

To exercise rights: support@drophero.app or https://drophero.app/data-requests.

7. Cookies & tracking

  • Essential cookies for login/session, security, fraud prevention.
  • Affiliate cookies/parameters (GoAffPro).
  • Optional analytics (aggregate usage).

Manage via our cookie banner and your browser settings.

8. Shopify-specific disclosures

  • Role: We are controller for Merchant account/support/billing data; processor for Merchant’s Customer Data you direct us to process via the app.
  • Minimized access: We request the least privileges necessary. You can revoke/uninstall anytime in Shopify admin.
  • Deletion after uninstall: Processor data is deleted or anonymized within 30 days of uninstall or written request (retaining only legally required billing records).
  • Subprocessors: see Section 5; DPAs in place, SCCs for extra-EEA transfers.

9. Meta/Facebook Platform disclosures

When you connect Meta, we may request the following permissions only to power features you choose:

9.1. Permissions we may request and why

  • pages_show_list - to show a simple Page picker so you can select the From Page for ads/campaigns.
  • pages_read_engagement (optional) - to display high-level organic Page engagement alongside ad performance if you enable it.
  • business_management - to list/select Business assets (ad accounts, Pages) the user manages.
  • ads_management - to create/edit/publish ads/creatives/ad sets/campaigns on your behalf.
  • ads_read - to fetch ad insights (impressions, clicks, CTR, CPC, CPM, spend, actions/conversions) to populate analytics.

9.2. How we use Meta data

  • To let you pick Pages and Ad Accounts, create/publish ads, and display performance insights you request.
  • We do not read Page messages, private content, or sell Meta data. We do not use Meta data to build profiles unrelated to DropHero’s functionality.

9.3. Tokens & security

  • Access tokens are stored encrypted, refreshed securely, and deleted on disconnect or after 30 days of inactivity. Access is restricted by role and logged.

9.4. Revoke access

  • In Facebook: Settings → Business Integrations (remove DropHero).
  • In DropHero: Settings → Connections → Disconnect Meta.

9.5. Meta data deletion (required by Meta)

  • In-app: Settings → Privacy → Delete Meta data (removes tokens, cached insights, Page/Account mappings within 24 hours).
  • Online form: https://drophero.app/meta-data-deletion (submit email + account ID; we confirm and erase within 24–72 hours).
  • Or email support@drophero.app with the subject “Meta data deletion.”

9.6. OAuth transparency

  • During the Meta OAuth flow we display links to this Privacy Policy and the Meta Data Deletion page, and we show the permissions we request and the features that use them.

10. Chrome Web Store / Extension (“Data Disclosure”)

10.1. What the extension collects (only when you use it)

  • User-selected website content (public text snippets, image URLs) to send to DropHero for creative generation and campaign setup.
  • Account identifier/token to authenticate calls to your DropHero account.
  • Diagnostics (timestamps, error/success codes) for reliability.

10.2. How we use it

  • Solely to provide the requested functionality (generate creatives, prepare drafts, speed up campaign setup).

10.3. Sharing/sale

  • We do not sell extension data. We do not share it with data brokers. Data may be processed by our hosting/processing vendors solely to provide the service (see Section 5).

10.4. Retention & control

  • Minimal logs auto-expire in 30–90 days.
  • Disable site access in Chrome’s extension settings or sign out to stop API calls.
  • We comply with the Chrome Web Store User Data Policy and, where applicable, Google’s “Limited Use” rules.

11. Affiliates & referrals

If you participate in our affiliate program (GoAffPro):

  • We process affiliate IDs, cookies/params, clicks, attributed signups/sales, and payouts.
  • We disclose rates and payout terms in the affiliate portal.
  • Fraud monitoring is applied to protect merchants and DropHero.

12. Security

We use TLS in transit, encryption at rest where supported, secret management, role-based access, least-privilege, logging/monitoring, and routine backups. No system is 100% secure; report vulnerabilities to security@drophero.app. We will notify you and regulators of significant incidents as required by law.

13. Children

DropHero is not intended for individuals under 16 (or the minimum age in your jurisdiction). We do not knowingly collect children’s data.

14. Your choices & controls

  • Access/rectify/erase/port your data (subject to law).
  • Object/restrict where applicable.
  • Unsubscribe from marketing anytime.
  • Disconnect integrations (Shopify/Meta) in Settings.
  • Delete your account: Settings → Privacy → Delete account or via https://drophero.app/data-requests.

15. Data Subject Requests & Deletion

Submit requests at support@drophero.app or via https://drophero.app/data-requests.
For Meta-specific deletion, see Section 10. For Shopify processor data, we will coordinate with the Merchant/controller.

16. Changes to this Policy

We may update this Policy to reflect product or legal changes. We’ll post updates here and notify you of material changes (e.g., in-app or by email). Continued use after the effective date means you accept the updated Policy.

Annex A — Shopify Uninstall & Deletion

  1. Immediately disable processing and scheduled jobs for your store.
  2. Queue deletion/anonymization of processor data within 30 days.
  3. Retain only legally required billing/transaction records.

If you reinstall within the retention window, some settings may be recoverable; otherwise you must reconnect and re-authorize.

Annex B — Meta Permissions & Example Data

  • pages_show_list: Page IDs, names, basic permissions.
  • pages_read_engagement (optional): high-level metrics (reach, reactions, comments) for organic view.
  • business_management: Business/asset IDs for selection.
  • ads_management: ad creative fields (copy, media references), ad/ad set/campaign settings you configure.
  • ads_read: insights fields such as impressions, clicks, spend, cpc, cpm, ctr, actions, and conversion summaries.

Annex C — Chrome Extension Permissions (typical)

  • Minimal permissions: limited host access to relevant pages; runs on user-initiated action.
  • No background scraping: no obfuscated code; no remote code execution.