Legal

Privacy policy

Dropplink is an attribution product made by Dropp. This policy explains what we collect about the brands that use it and their teams, and what our SDKs collect for those brands about the people who use their apps and websites.

Effective 27 October 2026 · Dropp Services Private Limited (CIN U62099HR2026PTC146867)

1. Who we are and our two roles

Dropplink is provided by Dropp Services Private Limited (CIN U62099HR2026PTC146867), registered at Unit B 1206, Signature Global Roselia, Sector 95A, Garhi Harsaru, Gurgaon 122505, Haryana, India (“Dropp”, “we”, “us”). A Dropplink account is a Dropp brand account, so the same account works on ondropp.app.

We have two roles, and this policy has a part for each:

  • Controller (data fiduciary under India's DPDP Act) for the brands that use Dropplink: their accounts, team members, billing and support, and visits to this website and the dashboard. See part A.
  • Processor (service provider under the CCPA, data processor under the DPDP Act) for the data our SDKs collect about the people who use a brand's app or website (“end users”). The brand decides what is collected and why; we follow its instructions under our Data processing addendum. See part B.

Part A. Brands, team members and visitors to our site

What we collect

DataWhere it comes fromWhy we use it
Work email, password (stored hashed), name and role of each team memberYou, when you sign up or are invitedTo create and secure your account and let your team sign in
Company name, registered business name, websiteYou, during setupTo set up your workspace and know who we're working with
Plan, subscription and payment statusYou and our payment provider, RazorpayTo bill you and keep your plan active. We never see or store full card or bank details
Apps, link domains, links, keys and settings, and who changed themYou and your team, in the dashboardTo run the service, and to keep a change history you can see in Settings
Support messages and feature requestsYouTo answer you and improve the product
Session cookie, theme and sidebar preferencesYour browserTo keep you signed in and remember your choices. See our cookie notice
Server logs: request time, path, status and browser typeYour browserTo keep the service secure and fix problems

Our legal bases

  • Contract: to provide the account and service you signed up for, and to bill you.
  • Legitimate interests: to secure the service, prevent abuse (such as phishing links) and improve it. You can object at any time.
  • Legal obligation: to keep invoices and tax records, and to answer lawful requests.
  • Consent under the DPDP Act, given when you create your account, for the purposes listed here. You can withdraw it by closing your account.

What we don't do

We don't sell your data or share it for advertising. This website and the dashboard run no analytics, advertising or other third-party tracking scripts. Our payment provider's script loads only when you open the payment window. App icons in the dashboard are loaded from the Play Store and App Store, which see a normal request from your browser.

How long we keep it

Account data is kept while your account is open. When you close it, we delete it within 30 days, except invoices and records we must keep by law (usually 8 years in India). Server logs are kept for no longer than we need them to keep the service secure.

Part B. End users of brands' apps and websites

Brands add our SDKs to their Android and iOS apps and to their websites. The SDKs record installs, deep link opens, events and website visits, so the brand can see which link, campaign, channel or creator brought each one. We process this data only for that brand, only on its instructions, and never to build profiles across brands, sell it or market to anyone.

Are you a user of an app or website that uses Dropplink? The brand that runs it decides how your data is used, and its privacy policy should name us. Please send your request to that brand first. If you write to us, we'll pass your request to the brand and help it answer.

What the app SDKs (Android, iOS, Flutter, React Native) collect

DataDetails
Install idA random id created by the SDK on the first launch after install. It isn't tied to the device's hardware or advertising ids.
App and SDK version, platformFor example 2.4.0, Android.
Device detailsModel (for example iPhone16,1), OS version, language and region setting (en-IN), time zone (Asia/Kolkata), screen size.
Play install referrer (Android only)The referrer Google Play passes to the app, which carries the Dropplink click id. Read until the install is attributed.
Deep linksThe link that opened the app.
EventsNames and properties the brand chooses to send (for example add_to_cart, with a product id), and revenue amounts and currency.
The brand's user id (optional)Sent with identify when the user signs in. Brands must use an opaque id, not an email or phone number; we reject ones that look like either.
Hashed email or phone (optional)If the brand passes them to identify, they're hashed with SHA-256 on the device. The plain values never leave the device.

What the website SDK collects

DataDetails
Visitor id and sessionA random id kept in the browser (first-party cookie and local storage), and a session that ends after 30 minutes without activity.
Pages and time on pagePage path and title, the referring site on the first page of a visit, and how long the page was visible.
Campaign tags and click idUTM tags and the Dropplink click id from the address the visitor landed on.
Events and the brand's user idAs for apps. Orders and revenue come only from the brand's server, never the browser.

What our servers add when a link is tapped or an SDK calls us

DataDetails
Hashed IP addressWe never store the IP address. We keep an HMAC-SHA256 hash made with a salt that changes every day; the salt is deleted after 9 days, after which the hash can't be linked to an IP.
Browser and device typeWorked out from the browser's user agent: OS, browser, device type and model.
Coarse locationCountry, region and city, from Cloudflare, which carries our traffic. Not precise location.
SourceThe site or app the link was tapped in (for example Instagram), from the referrer and the link itself.

How attribution works

On Android, an install is matched to a tap through the Play install referrer. When there's no referrer (for example on iOS), we may match an install to a recent tap by comparing device and network signals, such as the hashed IP address and the device type, within a short window. The match is kept with the install, so the brand can see why it was credited in the Install debugger.

What we never collect

  • Advertising ids (Google Advertising ID, Apple IDFA).
  • Contacts, photos, files or other apps on the device.
  • Precise (GPS) location. Only country, region and city, worked out from the network by Cloudflare.
  • Raw IP addresses. We keep only a salted hash, and the salt is deleted after 9 days.
  • Plain email addresses or phone numbers. If a brand passes them to identify, they're hashed (SHA-256) on the device.
  • Event properties that contain an email address or a phone number. They're dropped on the device and again on our server.

How long we keep it

DataKept for
Link clicks (hashed IP, browser and device type, coarse location, source)30 days
Daily salts used to hash IP addresses9 days, after which a hash can't be linked back to an IP
Event ids used to drop duplicate events8 days
Website sessions and website events90 days
App events, website visitors and user activity timelines395 days (about 13 months)
Installs and identified users (install id, device details, attribution, the brand's user id, hashed email or phone)While the app is in the brand's project, until the brand deletes that user or closes its account

A brand can delete a user's events and identity at any time with our deletion API, and we delete a brand's data when it closes its account, as set out in the DPA.

End users' choices

  • Brands can turn off events and identify in their app for a user who opts out (setTrackingEnabled(false)), and can start the SDK only after consent.
  • On websites, brands can run the SDK in consent mode, where nothing is stored or sent until the visitor accepts in the brand's cookie banner.
  • The website SDK honours Global Privacy Control: when a browser sends it, nothing is stored or sent.

2. Your rights

Depending on where you live, you have rights over your personal data. We answer within 30 days, or sooner where the law requires.

LawYour rights
India: Digital Personal Data Protection Act, 2023Access a summary of your data, correct and complete it, erase it, withdraw consent, nominate someone to act for you, and raise a grievance with our grievance officer and then the Data Protection Board of India.
EU and UK: GDPR and UK GDPRAccess, correction, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and a complaint to your local data protection authority.
California and other US states: CCPA and similar lawsKnow what we collect, delete, correct, and opt out of sale or sharing. We don't sell or share personal data, and we won't treat you differently for using your rights.

Brands and team members: email [email protected] from your account's address. End users: please contact the brand first (part B). If you write to us, we'll forward your request to the brand and help it answer.

3. Who we share data with

We use a small number of providers (sub-processors) to run Dropplink, such as our database and hosting providers. They may use the data only to provide their service to us. The full list, with what each does and where, is on our sub-processors page. We may also disclose data when the law requires it, or to a buyer if Dropp is sold, under this policy.

4. International transfers

Our database and servers are in India. Some providers are in other countries, including the United States. When personal data from the EU, the UK or Switzerland is processed outside those places, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our DPA, and we transfer data out of India only where the DPDP Act allows it.

5. Security

Traffic is encrypted with TLS, our database provider encrypts data at rest, access to production is limited to the people who need it, and IP addresses and identifiers are hashed as described above. No system is perfectly secure; our security page lists what we do and how to report a vulnerability.

6. If something goes wrong

If we become aware of a breach that affects personal data, we tell the brands affected without undue delay and within 48 hours, with what we know, so they can meet their own duties. For brands' account data, we notify the affected people and the authorities where the law requires it, including the Data Protection Board of India.

7. Children

Dropplink is a business product, not for children. It isn't designed for apps or websites directed at children under 13, or under 16 in the EU and UK. A brand that runs one must not use Dropplink there with identify turned on, and must have the parental consent its local law requires (in India, verifiable consent of a parent for anyone under 18). If we learn that we hold a child's data in breach of this, we'll work with the brand to delete it.

8. Contact and grievance officer

Grievance officer: Jai Shree Tiwari, Dropp Services Private Limited, Unit B 1206, Signature Global Roselia, Sector 95A, Garhi Harsaru, Gurgaon 122505, Haryana, India. Email [email protected]. We aim to resolve grievances within30 days. For anything else, write to [email protected].

9. Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell brands by email or in the dashboard at least 30 days before it takes effect.