Privacy Policy

Droplist is a storefront for home bakers. This policy explains what personal data we hold, why we hold it, who else sees it, and what you can ask us to do about it.

As with our terms, there are two audiences here. Bakers have an account with us. Customers do not — you order from a baker without signing up for anything.

Droplist is operated by Droplist Ltd, a company registered in England and Wales, with its registered office at 71-75 Shelton Street, London WC2H 9JQ. Droplist Ltd is the data controller for the personal data described here, and getdroplist@gmail.com reaches us about any of it.

Given by you when you sign up and as you set your shop up:

• your email address, which is also how you sign in
• your business name and your shop link
• your own name,
• your country, timezone and currency
• your shop profile: a short bio, a logo, a cover photo, an Instagram handle, and a public contact email if you would rather customers wrote to a different address
• your fulfilment details: the general collection area shown publicly, the exact collection address shown only to customers who have paid, any delivery note, and your delivery charge
• the photos and descriptions you upload for your items

Created as you use Droplist:

• your drops, items, prices and stock
• the orders placed with you, and the customer details attached to them
• your payouts, refunds and the balance owed to you
• your service-fee setting and identifiers that link your account to your records at our payment provider
• ordinary technical records — sign-in attempts, and errors when something breaks

Two things we never hold: your card details and your bank details. Both are given straight to Stripe, and neither reaches Droplist's own systems.

If you joined the waitlist or signed up, we may email you about Droplist itself — what is new, and occasionally an offer. Every one of those has an unsubscribe link, and unsubscribing changes nothing about your account.

Emails you cannot unsubscribe from are the ones the service itself depends on: your sign-in link, order alerts, payout and refund updates. Those are part of running your shop rather than marketing.

You do not have an account with Droplist and there is no password. When you place an order we hold:

• your name and email address
• your phone number, if you give one
• your delivery address, if you chose delivery
• what you ordered, what it cost, and whether you chose collection or delivery
• the collection slot you picked, where the drop offers slots
• identifiers that link your order to the payment record at our payment provider

We never see your card details. Payment happens on Stripe's own checkout page, and your card number never touches Droplist.

Your basket, before you check out is not sent to us until you order.

We do not send customers marketing email, and we do not sell or rent anyone's details.

The baker you ordered from sees your name, your email address, your phone number and delivery address if you gave them, what you ordered, and your collection slot. They need all of it to make your order and get it to you.

The baker is an independent business, not a Droplist employee. They are responsible for how they handle your details once they have them, and for answering you about their own kitchen, ingredients and allergens.

In data protection terms, the baker and Droplist are separate controllers rather than joint ones — we each decide for ourselves what we do with your details. We decide how Droplist handles them. Once your order reaches the baker, what they do with your details is their own decision and their own responsibility. If you want a baker to delete what they hold about you, ask them directly, and tell us if they do not.

If you give us your email address on this site, we store it with our email provider so we can tell you when there is something worth telling you. We also record which link or campaign brought you here, where that is available. You can unsubscribe from any of those emails, and doing so removes you from the list.

Droplist is a custom-built product running on industry infrastructure. A small number of specialist providers handle personal data on our behalf; they act on our instructions and may not use it for anything of their own. These are the categories, and what each one is for:

Ask us and we will tell you which provider sits behind any of these. Beyond them, we share personal data only where we are legally required to, or where it is necessary to establish or defend a legal claim.

Droplist does not run advertising and does not track you across other websites. What is stored on your device is:

• For bakers, a sign-in cookie that keeps you signed in to your dashboard, plus the security cookies that go with it. Without these you cannot sign in.
• For customers, your basket, kept in your browser's own storage until you check out or clear it.
• A small note of whether you have dismissed a message in the dashboard, kept only for the current browser tab.
• Whatever our anti-abuse check needs on the sign-in and waitlist pages, in order to tell a browser from a bot.
• Measurements of page views and page speed, used to see how the site is performing.

All of that is either needed for the site to work or is a measurement of the site itself. There is no advertising or profiling cookie here.

• Orders, payments, refunds and payouts are kept for around six years, because we are required to keep business and tax records.
• A baker's account is kept while the account is open. Closing an account anonymises it and shuts the shop, but does not remove the order and payment records behind it, for the reason above.
• Sign-in links expire quickly, and expired ones are cleared out.
• Waitlist and marketing contacts are kept until you unsubscribe.
• Error reports are kept for our provider's standard retention period, and are configured not to contain personal data.

Some of these providers are based outside the UK, or store data outside it. Where that happens, the transfer is covered by a mechanism the UK recognises — an adequacy decision, or the UK's international data transfer agreement or addendum.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct it if it is wrong
• delete it, where we are not required to keep it
• restrict what we do with it, or object to us doing it
• give you, or another provider, a portable copy of data you gave us
• stop sending you marketing, at any time

Email getdroplist@gmail.com and we will answer within one month. There is no charge.

The one limit worth being upfront about: we cannot delete the record of a completed order on request, because we are required to keep it. We can remove what is not part of that record.

Bakers sign in with a one-time link rather than a password, so there is no password of yours for us to lose. Card and bank details are handled by Stripe and never stored by us. Access to the live database is limited to the people who run Droplist. A baker's exact collection address is never shown publicly — only to a customer who has paid.

No system is perfectly secure. If a breach affects you and is likely to be a risk to you, we will tell you, and the ICO, as the law requires.

Droplist is not intended for children. Bakers must be 18 or over. We do not knowingly collect data about children, and if you believe we have, please tell us and we will remove it.

We may update this policy. The date at the top says when it last changed, and where a change materially affects bakers we will email them.

Email getdroplist@gmail.com with anything about this policy, or to exercise any of the rights above. A person answers.