Privacy policy

FlowDrop (“we”, “us”) operates the website and product at flowdrop.dev, including merchant dashboards and hosted storefronts on *.flowdrop.dev and custom domains you connect. This policy explains what we collect and why. It is written for people using FlowDrop and for platforms that review our apps (including Meta, TikTok, and similar).

This page is not legal advice. If you need advice for your own shoppers or jurisdiction, talk to a lawyer.

Who this covers

We handle two kinds of people:

• Merchants — you create an account, preview or publish a store, connect suppliers, payments, pixels, or social accounts, and generate copy or video.
• Shoppers — people who visit a store we host and may check out, join a waitlist, leave a review, or join loyalty. For shopper data, the merchant is typically the business they bought from. We host and process that data so the store can run.

What we collect from merchants

• Account details: name, email, hashed password, email-verification and password-reset tokens, and billing status.
• Store content you enter or generate: brand name, niche, catalog, layout, copy, images, domains, and short-form video (including character uploads you send to generation tools).
• Credentials you paste to run the product: supplier API keys, payment keys, pixel IDs, and similar integration secrets. Those stay under your account so we can call the services you connected.
• Connected platforms: if you connect TikTok, Instagram, Facebook, YouTube, or similar so we can publish videos you approve and read engagement metrics, we receive the tokens and account identifiers those platforms provide, plus publish results and public performance stats you ask us to show.
• Usage needed to operate and protect the service — for example an IP address on public preview generation, to limit abuse.

What we collect from shoppers (on stores we host)

Depending on what the merchant enables, a storefront may collect order details (name, email, shipping address, cart contents), waitlist or loyalty emails, product reviews, and cookie consent. Payment card data is handled by the checkout provider the merchant connects (for example Stripe or PayPal), not stored as card numbers on FlowDrop.

If a merchant enables Customer tracking, the shop may store a first-party visitor identifier and which video promo code a shopper used so the merchant can see visits and orders tied to that content. This does not record which social video someone watched off-site unless they open the shop with that video's link or code.

Merchants may also load their own analytics or ads pixels. Those vendors then collect data under the merchant’s settings and those vendors’ policies.

How we use it

• Create and host your storefront and dashboard.
• Send verification, password-reset, and operational email.
• Process subscriptions through our merchant of record (Polar).
• Generate copy, product rewrites, and video you request using AI and automated tools (see How we use AI).
• Publish to social accounts you connect — only after you approve a clip and choose where it goes. We do not post on your behalf without that approval.
• Read engagement metrics you ask us to display so you can see how posts performed.
• Keep the service secure, debug outages, and prevent abuse.

We do not sell your personal information.

Connected social accounts

When you connect a social or ads account, we use that connection only to provide FlowDrop: publish content you approve, and read the engagement metrics needed to show results in the dashboard. We do not use your connected accounts to post unrelated content, scrape your friends or followers for our own marketing, or sell access to your tokens. You can disconnect a platform in the product; you should also revoke access in that platform’s app settings.

Processors and sharing

We use vendors to host the app (including Vercel), store data (including our database and object storage), send email (Resend), bill subscriptions (Polar), generate AI copy and media (for example OpenRouter and video providers), look up or register domains (Porkbun), and sync supplier catalogs you connect. They only receive what they need to do that job.

We may share information if required by law, to prevent fraud or abuse, or as part of a merger or sale of the business, with notice where the law requires it.

Cookies

The marketing site and dashboard use cookies or similar storage for sign-in sessions and basic product function (for example remembering a preview draft). Merchant storefronts may show a cookie banner when the merchant turns that app on. See our Cookie policy for details. We do not run a separate FlowDrop advertising cookie on the marketing site.

Retention

We keep account and store data while your subscription is active and for a reasonable period after cancellation so you can export or restore. Pending signups that never complete payment expire. Logs used for rate limits are short-lived. Shopper orders stay with the merchant’s store until the merchant deletes the store or asks us to delete the account.

Privacy notice at collection (California & similar laws)

This summary is our “privacy nutrition label” for U.S. state privacy laws (including the California Consumer Privacy Act, as amended by CPRA). It describes FlowDrop’s practices for the last 12 months unless we say otherwise.

Sale or share for cross-context ads: We do not sell personal information and we do not share it for cross-context behavioral advertising as defined under California law.

Do Not Sell or Share My Personal Information: We do not sell or share personal information for monetary or other valuable consideration. You do not need to submit a separate opt-out request for FlowDrop’s own practices. If you are a shopper on a merchant’s store, that merchant’s analytics or ad pixels may have their own settings — contact the merchant.

Sensitive personal information: We do not use or disclose sensitive personal information for purposes other than providing the service, security, or as allowed by law.

Retention: See Retention above. Merchants can request deletion by email; shoppers should contact the merchant they bought from first.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal data, or to object to certain processing. Email hello@flowdrop.devand we will respond within 45 days where required by law. Signed-in merchants can export or delete their account from Dashboard → Account & connections.

European Economic Area & UK

For EEA/UK users, FlowDrop acts as a controller for merchant account data and as a processor for shopper data submitted through merchant stores. Our lawful bases include contract (providing the service), legitimate interests (security and fraud prevention), and consent where required (for example optional analytics on storefronts). You may have rights to access, rectify, erase, restrict, object, and data portability, and to lodge a complaint with your supervisory authority. International transfers rely on standard contractual clauses or equivalent safeguards offered by our subprocessors.

Children

FlowDrop is a business product. You must be 18 or older to create an account. We do not knowingly collect personal information from children.

International

We and our processors may handle data in the United States and other countries where we operate. If you access FlowDrop from elsewhere, you understand that information may be processed outside your home country, with safeguards our vendors provide.

Changes

We may update this policy. The “Last updated” date at the top will change. Continued use after an update means you accept the revised policy.

Contact

Privacy questions: hello@flowdrop.dev. This policy lives at https://www.flowdrop.dev/privacy.