Privacy Notice

This notice explains what information the BrandDrop platform holds about you, where it comes from, what we do with it, and the choices you have.

It describes the service as it is actually built today, not features we might add later.

Account details: your email address, password (stored only in the hashed form our authentication service keeps, never as readable text), display name, contact email, and whether the account is a creator or a brand.

Creator profile: your bio, location, categories, links to your social accounts and portfolio, rate or availability notes if you add them, and the audience figures you report yourself.

Brand profile and campaigns: brand name, website, category, description, and the campaigns you draft or publish including budget and deliverable descriptions.

Activity between members: applications you send or receive, invitations, message requests, the messages inside a conversation, and records of collaborations you accept, including the terms recorded at acceptance.

Preferences and settings you choose, such as whether your profile is discoverable.

Support requests and reports: what you write to us through the Support page, together with the name and email you supply there.

Consent records: a timestamp and the version of the terms you were shown when you set up your account or confirmed you are 18 or over.

Technical records generated by our hosting and authentication services: request and error logs, sign-in events, session tokens, and approximate technical details such as browser type. These exist so the service can run and so we can investigate faults and abuse.

Membership billing references from our payment provider: a customer and subscription reference, the plan status, trial and renewal dates, and whether a payment succeeded or failed.

To provide the features you asked for: showing profiles and campaigns to the people they are meant to reach, delivering messages, and recording collaborations.

To sign you in and keep your session secure, and to send the service emails that come with an account, such as email confirmation and password reset.

To operate brand membership, including starting a trial, taking a payment you consented to, and handling cancellation.

To answer your Support messages and to look into reports of misuse, fraud, or safety problems.

To keep the business records we need, such as billing and dispute records.

Public by design: a campaign a brand has published can be viewed by anyone visiting the site, without an account, and is shown in public browsing.

Member-visible by design: a creator profile you have set to discoverable is shown to other signed-in members of the platform in browsing and search.

Participant-only by design: private messages, applications, invitations, and the details of a collaboration are meant to be visible only to the people taking part in them, plus limited authorised review as described below.

Not published: your email address, password, support messages, consent records, and billing references are not shown on public profiles or campaigns.

Hosting, database and file storage: our cloud backend provider, which stores account, profile, campaign, message, and collaboration records.

Authentication: the sign-in service provided with our hosting platform, which holds your credentials and session records. The emails it sends on our behalf — such as your verification code and password reset — are delivered through the platform's managed email delivery service.

Other notification and support emails: Resend, an email delivery service, used for the emails the app itself sends, such as notification and owner-support messages.

Payments: Stripe, used only for brand membership. Card details are entered on Stripe's own payment pages. BrandDrop does not receive or store full card numbers or security codes; we keep only the references and status described above.

Providers process information to deliver the services we ask them for. They may also independently process limited technical or payment data for their own security, fraud-prevention, or legal purposes, under their own privacy notices. We may also disclose information where the law requires it, or where it is genuinely necessary to protect the rights and safety of members or the platform.

A small number of authorised administrators can access account, application, and support records where that is needed for support, billing, safety, or abuse investigation. Access of this kind is limited to what the task requires.

Your conversations are not public and are not used as marketing material, but they are stored in our database and are technically readable by that authorised access. We do not use end-to-end encryption, and we will not claim otherwise.

Anyone you share information with on the platform may keep their own copy of it. We cannot retrieve or delete what another member has legitimately received from you.

Essential only: we store your sign-in session so you stay logged in, plus small preference values needed for the interface to work. These are required for the service to function.

We do not currently include any third-party advertising pixels or marketing trackers in the site's code, and we do not intend to add them without telling you and giving you a choice. If we later add optional analytics or marketing tracking, it will be described here and it will be optional.

Our hosting and payment providers may set their own technical or fraud-prevention identifiers as part of delivering their service.

You can edit your profile at any time, and you can control whether a creator profile is discoverable.

You can ask us to give you a copy of your information, to correct it, or to delete your account and information, by writing to us through Support. So that we do not hand your data to someone else, we will ask you to confirm control of the account email — a proportionate check, not more documentation than the request warrants.

Some information has to be kept even after a deletion request: records needed for billing, tax, and payment-dispute purposes, and records needed to enforce a safety measure. Deletion is not instantaneous — copies can persist in routine backups for a period before those backups are cycled out.

Service messages such as email confirmation, password reset, and important account or billing notices are part of having an account and are not marketing. Any optional marketing email would be separate and would include an unsubscribe link. We do not currently promise scheduled digests or alert emails.

BrandDrop is for people aged 18 and over. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe we have, tell us through Support and we will remove it.

Information is held with established cloud providers, transmitted over encrypted connections, protected by password-based authentication, and separated by database access rules so that accounts can only reach the records they are entitled to. Passwords are stored hashed by the authentication service.

No online service can be guaranteed secure, and we will not claim to be. If a breach affects you, we will tell you what we know and what to do.

Each version of this notice carries a revision identifier, shown at the top of this page. When we change it we publish a new revision and, where the change is material, bring it to your attention rather than replacing it quietly.

The current way to reach us about anything on this page is the Support page. A direct public contact address and the registered operator name are still being finalised and will be added here once confirmed.