Introduction
SHOPDROP (PRIVATE) LIMITED (“Shopdrop”, “we”) provides an online store builder and the tools that come with it, including features that use artificial intelligence. This policy explains how we collect and use personal information about merchants who use Shopdrop, visitors to our website, and anyone who contacts us. It also explains our role when we handle information about the customers of stores built on Shopdrop.
Merchants and their customers
When you sign up and run a store, we decide how your account information is used, and we are its controller.
When someone shops at a store built on Shopdrop, the merchant decides how that customer’s information is used. The merchant is the controller and we are a processor acting on the merchant’s instructions, including when a merchant uses our tools, AI features among them, to work with order or customer information. We do not use those customers’ information for our own purposes and we do not market to them.
If you bought from a store built on Shopdrop and want your information changed or removed, ask that store. We will pass a request on if you cannot reach them, but the decision is theirs.
What we collect and why
We collect information when you sign up, when you use Shopdrop, and when you contact us.
| What we collect | How we use it |
|---|---|
| Information about you and your business: your name, email address, phone number and country, and your Google account identifier and profile picture if you sign in with Google. Your password is stored only as a one-way hash. | To create and run your account, confirm it is you, contact you about your account and the service, and set your currency and tax treatment. |
| What you add to your store: products, images, prices, pages, theme settings and domain, and the orders and customer records your store receives. | To host and run your store, process its orders and provide the features you use. |
| What you give our AI features and what they produce: your requests and conversations, the files, pictures and links you share, notes kept about your store so you do not have to repeat yourself, suggested changes and what is needed to undo them, and the images and other content created for you. | To provide the AI features you use, and to let you review, undo and reuse their results. |
| Your plan, billing period, subscription status and invoice history. Card details go directly to our payment provider; we receive only a reference, the last four digits and whether a payment worked. | To charge for the service, issue receipts and keep tax and accounting records. |
| Your IP address, browser and device, approximate country, the pages you view and the actions you take, and server and error logs. | To show the right prices, keep the service secure, prevent fraud and abuse, fix faults, and understand how the service is used so we can improve it. |
| If you use our mobile app: the notification token your phone gives the app, a random identifier the app creates when it is installed, the app and operating system versions, and the phone’s language and time zone. | To send the notifications you choose, such as new orders, to your phone, and to stop sending them when you sign out. |
| If you connect an AI assistant, such as Claude, ChatGPT or Grok: which assistant it is, when you connected it and what you allowed it to do. We also keep a record of each action it takes: what it did, when, and whether it worked. The record leaves out your messages, what the assistant asked for and what it received. | To let the assistant work on your store, show you what it did, let you undo changes or disconnect it, and keep your store secure. |
| Messages you send us, including through our contact form: your name, email address, the store it concerns and your message. | To reply to you. Contact form messages go to our support inbox and are not saved in our database. |
We rely on these legal bases:
- Our contract with you, to run your account, your store and the features you use, and to take payment.
- Legitimate interests, to keep the service secure, prevent fraud and abuse, understand and improve how it is used, reply to messages, and remember details about your store between AI conversations.
- Legal obligation, to keep tax and accounting records.
- Consent, where we ask for it, for example for marketing email. You can withdraw it at any time.
Service emails, such as a failed payment, a security event or a change to this policy, are part of the service, so you cannot unsubscribe from them while you have an account.
When we share information
We do not sell personal information. We share it with service providers that help us run Shopdrop, and only so they can provide their services to us:
- hosting, database and file storage providers, in the European Union and on global networks;
- content delivery, security and spam-protection providers, on global networks;
- our payment provider, which sells our subscriptions as merchant of record and handles tax and receipts, in the UK and the European Union;
- email delivery providers, in the European Union;
- error monitoring providers, in the European Union, to find and fix faults;
- sign-in and phone verification providers, when you choose to use them;
- app notification providers, on global networks, to deliver the notifications you choose to your phone, which can include order and review details;
- analytics providers, to understand how our website and merchant portal are used; and
- artificial intelligence providers, in the United States and elsewhere, to power our AI features.
Our service providers may use their own sub-processors to provide their services. The providers we use are listed on our service providers page.
We also share information where the law requires it, to protect people or our service, and if the business is ever sold or merged, in which case we would tell you before your information moved.
Artificial intelligence
Some Shopdrop features use artificial intelligence, including models provided by third-party AI providers. When you use one, we send the provider what is needed to complete your request, such as your message, the files you choose and relevant information about your store. When you ask about orders or customers, the relevant order and customer details are included, with customers’ email addresses and phone numbers partly hidden.
Our AI features make suggestions; they do not make decisions with legal or similarly significant effects about anyone, and changes to your store are made only when you approve them. We do not use your information or your customers’ information to train AI models.
Connecting your own AI assistant
You can connect an AI assistant you use to your Shopdrop store, on any plan. Shopdrop works with Claude (by Anthropic), ChatGPT (by OpenAI) and Grok (by xAI). You add Shopdrop from your own account with that assistant, using Shopdrop’s connector address. You sign in with Shopdrop and choose what the assistant may change: products and collections, orders, discounts and marketing, store design, and pages and search, and whether it may use your credits. It can always read your store. That includes your customers’ names and orders. Customers’ email addresses and phone numbers stay partly hidden.
Your assistant receives what it asks for through the connection, while you use it. That means details of your store, and the photos you add through its upload card. Those photos are stored with your store’s other files. Its provider (Anthropic, OpenAI or xAI) handles what it receives, under its own terms and privacy policy. Connecting an assistant is your choice, like any other tool you use for your store, and you remain the controller of your customers’ details. Some things stay out of reach. The connection can’t take payments, change where your customers’ payments go, see your payment providers’ keys, or change your plan, billing or password.
Everyday edits in the areas you allowed, such as a product description, your draft design or an order’s status, apply straight away. Bigger changes, such as new prices, archiving products, changes to more than 10 items at once, switching theme or publishing your design, wait until you tap Apply on a card in the chat. The same goes for credits. If you allowed them, studio photos, color versions and logo sets start only when you tap the card, at the price it shows, within your plan’s limits and credits. They are made by the same AI providers as Shopdrop’s own AI features.
If an assistant sends extra details with a request, such as a rough location, a language or an anonymous ID, we don’t log or store them.
Settings → Connected apps lists each assistant you connected, with its last few actions and the changes you approved on its cards. Design edits are also in your editor’s history. You can disconnect an assistant there at any time, and it loses access within seconds. Changing or resetting your password, or closing your account, disconnects every assistant.
Where information is stored
Your store’s database is held in the European Union, and files and images are stored and delivered through a global network. Our team works from a country outside the UK and the European Economic Area that has no EU or UK adequacy decision, and accesses information from there. Some of our service providers are in the United States or other countries. Your information may therefore be transferred outside your country, including outside the UK and the European Economic Area. Where it is, we rely on safeguards such as the standard contractual clauses where our providers offer them.
How long we keep information
We keep personal information for as long as we need it for the purposes in this policy, to meet legal obligations, to resolve disputes and to enforce our agreements. In particular:
- Your account and stores: while your account is open. If you close your account, we keep it for 90 days so you can sign in and reopen it, and no one else can use your email address. We then permanently erase your account and your stores, with everything in them.
- AI conversations: deleted six months after the last message, or sooner if you delete them. Other content from our AI features is kept until you delete it or ask us to; some of it is deleted sooner, after set periods of up to 12 months.
- Database backups: kept for seven days.
- Invoices and tax records: six years, because the law requires it.
- Server and security logs: up to 12 months.
- Connected AI assistants: the record of what each assistant did, 12 months. Sign-in codes are deleted a day after they expire, and sign-in tokens 30 days after they stop working. The details of a connection, such as which assistant and what it may do, are kept with your account.
- Support email, including contact form messages: two years from the last message.
You can ask us to delete your information sooner, and we will, except where the law requires us to keep it.
Your rights
Depending on where you live, you can ask us for a copy of your information, ask us to correct or delete it, restrict or object to how we use it, or send it to another provider, and you can withdraw a consent you gave. Some of these rights apply only in certain circumstances, and the law may limit them. You can also complain to your data protection authority.
Many of your details can be viewed and changed in the merchant portal. For anything else, email info@shopdrop.pro from the address on your account. We respond within 30 days and do not charge for it.
Cookies and analytics
We use cookies and similar technologies, such as your browser’s local storage, to keep you signed in, keep a shopping basket and remember your choices. Our website and merchant portal also use analytics services to understand how they are used; they use cookies and receive information such as your IP address and device.
In the merchant portal we also record sessions: the pages you open, where you click and scroll, and what the screen shows, so we can see where the portal is hard to use and fix it. Recordings leave out passwords, payment keys and one-time codes.
In the EU, the UK and Switzerland we ask before using analytics. You can change this anytime under Your choices.
Individual stores may add their own analytics or advertising tags. Those are the merchant’s choice and their policy governs them.
Your choices
How we protect information
We use technical and organizational measures to protect personal information, including encryption in transit and at rest, one-way hashing of passwords, separation of each store’s data, and access limited to the people who need it. When our team needs to open a merchant’s account to investigate a problem, that access requires a stated reason, is time limited and is recorded. No method of storing or sending information is completely secure, but if a breach affects your personal information, we will tell you and the relevant authority within the time the law allows.
Children
Shopdrop is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.
Changes to this policy
We update this policy as the service changes. For a significant change we will let you know, for example by email or in the merchant portal, before it takes effect. The date at the top shows the current version.
How to reach us
SHOPDROP (PRIVATE) LIMITED. Privacy questions and requests go to info@shopdrop.pro. If your question is about how a store handles your information, contact that store.