Privacy Policy

Last updated: 13 June 2026

Plain English summary: We scan your promotional emails to find deals and send them to your WhatsApp — on demand, when you ask. We only look at your Promotions tab (Gmail) or commercial sender emails (Outlook). We never read personal emails, never sell your data, and never store your email content. After every scan we send you a receipt listing exactly which brands we read. You can permanently delete your account and all your data at any time by sending /delete on WhatsApp.

1. Who we are and how to contact us

Dropp is a personal deals service operated from London, United Kingdom. The data controller for your personal data is Dropp (trading name). You can contact us at hello@dropp.ltd.

For privacy-specific requests (subject access, deletion, complaints), please email us with "Privacy Request" in the subject line. We will respond within 30 days as required by UK law.

2. What personal data we collect

Data	Source	Purpose	Lawful basis (UK GDPR)
WhatsApp phone number	Messaging platform	Delivering your deals when you request a scan	Contract — necessary to provide the service
Display name (first name)	WhatsApp profile	Personalising messages	Contract — necessary to provide the service
Gmail address	Google OAuth (on connection)	Identifying your Google account; confirming Gmail access	Contract — necessary to provide the service
Gmail OAuth access & refresh tokens	Google OAuth	Accessing your Gmail Promotions tab on demand when you request a scan	Consent — you explicitly grant this via Google's OAuth screen
Microsoft account email address	Microsoft OAuth (on connection)	Identifying your Microsoft account; confirming Outlook access	Contract — necessary to provide the service
Outlook OAuth access & refresh tokens	Microsoft OAuth	Accessing your Outlook inbox on demand when you request a scan	Consent — you explicitly grant this via Microsoft's OAuth screen
Deal category preferences	Your selection during onboarding	Filtering deals to categories you care about	Contract — necessary to personalise the service
Activity timestamps (sign-up, email connected, deals sent, last active)	Service activity	Service improvement and diagnosing delivery issues	Legitimate interests — improving service quality
Country (inferred from phone number prefix)	Your phone number	Regional service improvement	Legitimate interests — understanding user geography

3. What we do NOT collect or store

We do not store the content of your emails. Email text is processed transiently in memory to extract deal information and is discarded immediately. Nothing is written to our database.
We do not access your inbox, sent mail, personal correspondence, financial emails, or attachments. For Gmail we only query the Promotions category. For Outlook we filter out any email sent from personal email domains (such as gmail.com, hotmail.com, icloud.com) so only commercial/promotional senders are processed.
We do not build profiles from your email content beyond the categories you explicitly select.
We do not use your data for advertising or sell it to any third party.
We do not use your email data to train AI models.

4. Google API Limited Use disclosure

Dropp's use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We access Gmail data only to identify promotional emails containing active discounts, which is the core function of the service you signed up for. We query the Gmail Promotions category exclusively — we never query your inbox, sent mail, or any other folder.
We do not transfer Gmail data to third parties except as strictly necessary to operate the service (see Section 6 — OpenAI processes email text transiently to extract deal details; the content is not retained by OpenAI through API usage).
We do not use Gmail data to serve advertisements.
We do not allow humans to read your email content. All processing is automated.
We do not use Gmail data to train machine learning models.

You can revoke Dropp's Gmail access at any time at myaccount.google.com/permissions.

5. Microsoft Graph API use

If you connect an Outlook or Microsoft 365 account, Dropp uses the Microsoft Graph API with the Mail.Read scope. Specifically:

We read email headers (sender address, subject, date) from your Inbox and Junk Email folders to identify potential promotional emails.
We immediately filter out any email sent from personal email domains (gmail.com, hotmail.com, icloud.com, yahoo.com, and similar) — only commercial senders are processed further.
We fetch the body text of remaining promotional candidates only (up to 60 emails per scan) and pass it to OpenAI transiently to extract deal information.
We do not access calendar, contacts, files, or any data outside of mail.
We do not use Outlook data to serve advertisements or train machine learning models.

You can revoke Dropp's Outlook access at any time at myaccount.microsoft.com/permissions or by sending /disconnect outlook on WhatsApp.

6. How we scan your emails

Dropp scans on demand — only when you send /sales on WhatsApp. There are no background scans or scheduled jobs running on your account.

Gmail: We connect using your stored OAuth token and search for emails in the Promotions category from the past 7 days. We retrieve the subject line, sender address, and body text of those emails. This text is passed to OpenAI's API to identify active discount codes and sale announcements. Email content is processed in memory only — never written to our database.

Outlook: We connect using your stored OAuth token and read email headers from your Inbox and Junk Email folders from the past 7 days. Emails from personal email domains are immediately discarded. The body text of the remaining promotional candidates (up to 60) is passed to OpenAI transiently. Email content is processed in memory only — never written to our database.

Only the extracted deal summary (e.g. "20% off at ASOS — code SAVE20") is included in your WhatsApp message.

After every scan, you receive a scan receipt on WhatsApp listing every brand whose emails were read — so you can verify exactly what was accessed.

🔍

Code publicly monitored by Bearer Our source code is automatically scanned for privacy compliance on every update and every 6 hours. Anyone can verify what we access.

7. Third-party data processors

We use the following companies to operate the service. Each acts as a data processor on our behalf under contractual terms:

Processor	Purpose	Data shared	Location
Twilio Inc.	Sending and receiving WhatsApp messages	Your phone number; message content (deal summaries and scan receipts)	United States
OpenAI, L.L.C.	Extracting deal information from email text	Email text (transient — not stored by OpenAI via API)	United States
Railway Corp.	Hosting our application and database	All account data (stored in database)	United States
Google LLC	Gmail API access	OAuth tokens; email content (via API during scan, not stored)	United States
Microsoft Corporation	Outlook / Microsoft Graph API access	OAuth tokens; email content (via API during scan, not stored)	United States

Data transfers to these US-based companies are made under Standard Contractual Clauses (SCCs) / UK International Data Transfer Agreements (UK IDTA), which provide appropriate safeguards under UK GDPR. Twilio Privacy Policy · OpenAI Privacy Policy · Railway Privacy Policy · Microsoft Privacy Statement

8. Data retention

Active accounts: We retain your personal data for as long as your account is active and for up to 12 months after your last activity.
Deleted accounts: When you delete your account (via /delete or email request), all personal data is permanently removed from our database within 30 days. Your Gmail and Outlook OAuth tokens are revoked immediately.
Backup data: Encrypted database backups may retain data for up to 90 days after deletion before being overwritten.

9. Security

We take reasonable technical and organisational measures to protect your data, including:

HTTPS encryption for all data in transit
PostgreSQL database with access restricted to the application
OAuth tokens stored in the database (not in logs or environment variables)
No employee access to email content — all processing is automated

No system is 100% secure. If we discover a data breach that risks your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours and inform affected users without undue delay.

10. Your rights under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, email hello@dropp.ltd — we will respond within 30 days.

Right of access — request a copy of the personal data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure ("right to be forgotten") — delete your account and all data by sending /delete on WhatsApp, or by emailing us.
Right to restriction — ask us to stop processing your data while a dispute is resolved.
Right to data portability — receive your data in a structured, machine-readable format (e.g. JSON).
Right to object — object to processing based on legitimate interests (e.g. analytics). We will stop unless we have compelling legitimate grounds.
Right to withdraw consent (Gmail) — you gave consent for Gmail access via Google's OAuth screen. You can withdraw it at any time at myaccount.google.com/permissions, which immediately revokes our access. Or send /disconnect on WhatsApp.
Right to withdraw consent (Outlook) — you gave consent for Outlook access via Microsoft's OAuth screen. You can withdraw it at any time at myaccount.microsoft.com/permissions, which immediately revokes our access. Or send /disconnect outlook on WhatsApp.
Rights related to automated decision-making — Dropp does not make automated decisions that produce legal or similarly significant effects on you.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@dropp.ltd and we will do our best to resolve it.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113

12. Children

Dropp is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with their data, please email us and we will delete it promptly.

13. Cookies

Our website (dropp.ltd) uses a single session cookie during the email authorisation flow (Gmail or Outlook). This cookie is temporary, expires when you close your browser, and contains no personal data — it only tracks the state of the OAuth authentication process. We do not use tracking, analytics, or advertising cookies.

14. Changes to this policy

We will update this policy as the service evolves. If we make material changes (e.g. collecting new categories of data, adding new processors), we will notify you via WhatsApp at least 14 days before the change takes effect. Continued use of Dropp after that date constitutes acceptance of the updated policy.

15. Contact

Data controller: Dropp, London, United Kingdom
Privacy enquiries: hello@dropp.ltd