We take your privacy seriously. This policy explains what data we collect, why we collect it, and how we protect it. We never sell your personal data to third parties.
Droppilot is operated by Smit Group d.o.o., a company registered in Slovenia. When we refer to "we", "us" or "our" in this policy, we mean Smit Group d.o.o.
For any privacy-related questions, contact us at: privacy@getdroppilot.com
We collect different types of data depending on how you use Droppilot:
| Data Type | What We Collect | Why |
|---|---|---|
| Account data | Name, email address, hashed password | To create and manage your account |
| Business data | Revenue, orders, ad spend, profit figures from your stores | To power your P&L dashboard |
| Shopify data | Order details, line items, revenue — via Shopify OAuth | To calculate COGS and profit automatically |
| Meta Ads data | Ad spend by campaign — via Meta API | To show accurate ROAS and profit |
| Gmail data | Customer support emails (subject, body, sender) — via Gmail OAuth | To power AI customer support replies |
| Usage data | Pages visited, time spent, features used | To improve the product |
| Device data | Browser type, IP address (hashed), device type | For security and analytics |
| Payment data | Subscription plan, billing status — processed by Stripe | To manage your subscription |
We do not store your full credit card details. All payment processing is handled by Stripe, which is PCI-DSS compliant.
We use your data exclusively to provide and improve the Droppilot service:
We never use your data to train AI models for third parties, sell it to advertisers, or share it with any party not listed in this policy.
Droppilot uses AI services (Claude by Anthropic) to generate customer support email replies and business insights. When you use AI features:
You can disable AI features at any time in your account settings.
Droppilot integrates with the following third-party services:
Your data is stored on servers located in Germany (Hetzner Cloud, Frankfurt). We implement the following security measures:
We retain your data for as long as your account is active. Specifically:
When you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons.
As a user in the European Union, you have the following rights under GDPR:
To exercise any of these rights, contact us at privacy@getdroppilot.com. We will respond within 30 days.
Droppilot uses minimal cookies and tracking:
We do not use advertising cookies or cross-site tracking.
If you enable push notifications, we store your browser's push subscription token to send you alerts. You can revoke this permission at any time in your browser settings or in the Droppilot settings page.
Droppilot is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service at least 14 days before they take effect. Your continued use of Droppilot after changes take effect constitutes your acceptance of the new policy.
For any privacy-related questions or to exercise your rights:
If you are not satisfied with our response, you have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec): www.ip-rs.si