Privacy Policy

Dropia.ai (https://www.dropia.ai) is an AI platform for product analysis, ad creative production and market research. This Privacy Policy explains which personal data we process, why, for how long, and what rights you have.

For any information about the service provider and data processing, email us at info@dropia.ai — we reply promptly.

We apply the Law on Personal Data Protection of the Republic of Serbia and, for users in the European Union, the General Data Protection Regulation (GDPR) to the extent it applies. Payments are handled by Polar as the seller (Merchant of Record), see the section on processors.

• Account data: email address, password (stored only as a hash), name, country and language. When you sign in with Google we receive the name and email address Google passes on.
• Proof of consent: the date and version of the Terms of Service you accepted when registering.
• Content you upload: product images, texts, prices and other inputs you send for analysis, creatives, video or ads.
• Generated content: analysis results, creatives, Studio images, video and voice recordings are stored in your account.
• Payment data: payments are handled by Polar. From it we receive your email address, name, subscription identifier and status. We never see or store card details.
• Connected accounts: when you connect an ad account or social networks we store account identifiers and access tokens, and the campaign data needed to display it in the app.
• Ad launch record: with every ad launch we store the time of confirmation and the version of the Terms in force, as proof that you confirmed the launch.
• Technical data: IP address, browser type and operating system, server logs and error reports. Used for operation, security and rate limiting.
• Visit analytics: Vercel Web Analytics records visited pages, referrer, country, device type and browser. It uses no cookies and does not track you across sites.
• Ad measurement (only with consent): if you accept Marketing, Meta, Google and TikTok receive events (page view, registration, purchase with amount) and identifiers the tool sets in your browser. We do not send your name or email.
• Communication: messages you send to our email address.

We send your content to AI services only to obtain the result you asked for.

• Temporary search images: an image sent to search and product-recognition services is placed temporarily and deleted immediately after the search is done.
• Generated content: creatives, Studio images, video and voice recordings are kept in your account until you delete them or delete your account. Images you uploaded to produce them may be kept alongside.
• No training: we do not use your content or generated results to train AI models and we do not sell them.
• Results are not a guarantee: AI results are estimates and suggestions; responsibility for using them is described in the Terms of Service.

The following categories of providers process data on our behalf. Each receives only what is needed for the specific service.

• Database and file storage: EU (Frankfurt): database, authentication and file storage.
• Application hosting: global network, including the US: serves pages and runs the application over a global server network, so requests (for example the IP address and technical data) may be processed in the US as well.
• AI services for analysis and content generation: models that analyse products, write text and create images, video and voice; they receive the content you send for processing.
• Payment processing (Polar, the seller): Polar is the seller and invoice issuer (Merchant of Record). It receives your email, name and payment details and is an independent controller for them, under its own privacy policy.
• Email delivery: transactional message service; receives the recipient email address and name and the message content.
• Social network and advertising platform integrations: when you connect them yourself, intermediaries and platforms (for example Meta and TikTok) receive access tokens, post or ad content and audience settings.
• Public data search and analysis: web and image search, product recognition and public ad collection services; they receive a temporary image or search terms, not your account data.
• Ad measurement (only with Marketing consent): Meta, Google and TikTok receive events about visits, registrations and purchases to measure advertising.

A list of specific processors is available on request at info@dropia.ai.

Processors use data only to provide the service and on our instructions; platforms you connect yourself (for example Meta) also operate under their own rules.

We do not sell personal data. Sharing is limited to the processors in section 4, to cases where law or a competent authority requires it, and to protecting the rights, property and safety of the service and its users.

Some processors (notably AI services and platforms) are located in the United States, so data may be processed there. Transfers are protected by standard contractual clauses or equivalent mechanisms provided by the service providers.

Necessary cookies and browser storage are always on because the site does not work without them. Analytics and Marketing are off until you choose otherwise: on your first visit we ask for your consent, and you can change the choice at any time through the "Cookie settings" link in the footer. We remember the choice in the dropia-consent cookie for 12 months; we ask again when the list of cookies changes.

Marketing cookies (Meta Pixel, Google Ads, TikTok Pixel) are set only after you consent to the Marketing category, and only if the tool is enabled on the site. They are used to measure advertising: to see how many registrations and purchases come from ad campaigns. The legal basis is your consent. We send these tools neither your name nor your email, only events (page view, registration, purchase with the amount in euros) and the identifiers the tool itself sets in your browser.

You can withdraw consent at any time ("Cookie settings" in the footer) and it is as easy as giving it. When you withdraw, we delete the cookies of those tools and reload the page. Withdrawal does not affect the lawfulness of processing before it. The tools also operate under their own privacy policies (Meta, Google, TikTok).

Vercel Web Analytics runs without cookies and without a persistent visitor identifier, so it does not require consent; it stays on even if you reject Marketing. You can delete cookies in your browser settings; without the session cookie you cannot sign in.

We send transactional messages without separate consent because they are part of the service: account confirmation and welcome, purchase and added-credits confirmations, account deletion notice and the result of launching an ad. The legal basis is performance of the contract.

We send marketing messages (tips, news and offers) only with your consent. You give consent explicitly: through the checkbox at sign-up (off by default), the "Emails with tips and news" switch in your account settings, or by joining the waitlist. The legal basis is consent. We keep the time, source and version of the consent.

You can unsubscribe at any time and it is as easy as subscribing: the "Unsubscribe" link in every marketing message (and the unsubscribe button in your email app), turning the switch off in settings, or a message to info@dropia.ai. After you unsubscribe we keep only a one-way hash of your address so that messages do not start again; transactional messages about your account still arrive.

• Account and content: while the account exists. Deleting the account deletes the data (see Data deletion).
• Temporary search images: deleted immediately after the search.
• Payment records: kept by Polar in line with tax and accounting regulations.
• Server logs: briefly, per the hosting provider settings.
• Email fingerprint after account deletion: we keep only a one-way fingerprint (hash) of the email address for 24 months after the account is deleted, solely to prevent reuse of free credits. The legal basis is legitimate interest. The address cannot be read from the fingerprint and nothing else about you is kept.
• Backups: deleted data may remain in database backups until their usual cycle ends; they are not used for operation.

• Access: a copy of the data we hold about you.
• Correction: correcting inaccurate data.
• Deletion: deleting your data and account.
• Restriction and portability: restricting processing and receiving your data in a common format.
• Objection: objecting to processing based on legitimate interest.
• Withdrawing consent: where processing is based on consent; for cookies through the "Cookie settings" link in the footer.
• Complaint: you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs), and, if you are in the EU, with the competent authority in your country.

Send your request to info@dropia.ai or delete your account yourself: Data deletion. We reply within 30 days.

• Data in transit is encrypted (TLS).
• Passwords are stored only as a hash.
• Card details are handled by Polar; we do not store them.
• Access to data is restricted, and access tokens of connected accounts are kept on the server.

No system is completely secure. If you suspect a security issue, contact us immediately at info@dropia.ai.

The service is intended for people over 18. We do not knowingly collect data from minors; if you believe we have, tell us and we will delete it.

We may change this policy. Changes are published on this page with a new update date, and for material changes we may also notify you by email.

For any information about the service provider and data processing, email us at info@dropia.ai — we reply promptly.

Email: info@dropia.ai · Website: https://www.dropia.ai

Data deletion: /data-deletion