Skip to content

Legal

Privacy policy

How we collect, use, share and protect personal information, and the choices you have.

Last updated

On this page

1. Who we are and what this policy covers

Droplet, Inc. (“Droplet”, “we”, “us” or “our”) provides a revenue assurance platform that helps finance and RevOps teams find underbilling and missed revenue. This Privacy Policy explains how we handle personal information when you visit this website, start a trial, contact us or use Droplet.

We handle personal information in two different roles:

  • As a controller, we decide how and why we use information about visitors to this website, people who contact us, and the people who create and use Droplet accounts for their organization. Most of this policy describes that use.
  • As a processor (or service provider), we handle the data our customers connect to Droplet, such as contract, CRM, usage and billing records, on their instructions. The customer decides what to connect and why, and is responsible for that data. See Customer Data.

This policy doesn't cover other websites and services that we link to or that you connect to Droplet. Their own policies apply.

2. Information we collect

The information we collect depends on how you interact with us.

  • Account and profile

    Examples
    Name, work email, company, job title, your role in the workspace, and sign-in details such as a hashed password or single sign-on identifier.
    Where it comes from
    You, or your organization's administrator.

  • Customer Data

    Examples
    Contracts and their terms, CRM accounts and contacts, usage records, invoices and payments.
    Where it comes from
    The systems you connect, such as Salesforce, HubSpot, Supabase and Stripe.

  • Billing

    Examples
    Billing contact and address, plan, invoices and payment status. Card details are collected by our payment processor, and we don't store them.
    Where it comes from
    You, and our payment processor.

  • Usage and device

    Examples
    Pages and features used, actions in the workspace, log data, IP address, browser and device type, and approximate location.
    Where it comes from
    Collected automatically when you use this website or the Service.

  • Communications

    Examples
    Messages to sales or support, including through the contact form, survey answers, and your marketing preferences.
    Where it comes from
    You.

  • Other sources

    Examples
    Publicly available business information, and details from partners and integration providers about a connection you set up.
    Where it comes from
    Public sources and our partners.

The Service doesn't need payment card numbers, bank account details, government ID numbers or other sensitive categories of personal data, and we ask you not to send them. We don't knowingly collect them.

3. How we use information

We use personal information for the purposes below. Where the GDPR or the UK GDPR applies, the table also shows the legal basis we rely on.

  • Provide the Service

    What it involves
    Creating and securing accounts, connecting your systems, running audits, producing findings, cases, reports and alerts, and giving support.
    Legal basis
    Contract; legitimate interests.

  • Billing and administration

    What it involves
    Taking payment, issuing invoices, managing your plan and keeping financial records.
    Legal basis
    Contract; legal obligation.

  • Security and fraud prevention

    What it involves
    Monitoring for misuse, enforcing our terms, keeping an audit trail and fixing faults.
    Legal basis
    Legitimate interests; legal obligation.

  • Improve the Service

    What it involves
    Understanding how features are used, fixing problems, building new capabilities, and using aggregated and de-identified data.
    Legal basis
    Legitimate interests.

  • Communicate with you

    What it involves
    Replying to questions, sending service and security notices, and, where you've opted in or the law allows, product news and offers.
    Legal basis
    Contract; legitimate interests; consent where required.

  • Comply with the law

    What it involves
    Responding to legal requests, meeting tax, accounting and regulatory duties, and establishing or defending legal claims.
    Legal basis
    Legal obligation; legitimate interests.

Droplet's findings are for your team to review. We don't use personal information to make automated decisions that have legal or similarly significant effects on individuals.

4. Customer Data

Customer Data is the data our customers connect to Droplet. We process it only to provide the Service to that customer, on the customer's instructions, which include the settings they choose and our agreement with them. We connect with read permissions only, so Droplet never edits invoices, contracts or customer records in your systems.

Customer Data is encrypted in transit and at rest and kept separate from every other customer's data. We don't sell it or use it for advertising, and we limit staff access to the people who need it to give support or keep the Service secure. We offer a data processing addendum (DPA) to customers that need one, including the standard contractual clauses for international transfers where they apply.

If you want to see, correct or delete personal information that sits in a customer's workspace, please contact that customer. We'll help them respond to your request.

5. How we share information

We share personal information only as described here:

  • Service providers (subprocessors). Companies that help us run Droplet, under written contracts that require them to protect the information and use it only for us. They include providers of cloud hosting and infrastructure, payment processing, email and communications, customer support, analytics and error monitoring, and security. A current list of subprocessors is available on request.
  • Services you connect. When you connect a system or ask for an alert, for example in Slack, we exchange data with it as you direct.
  • Your organization. Account administrators can see the activity and information of the people in their workspace.
  • Advisers and authorities. Lawyers, auditors and insurers and, where the law requires it or to protect rights, safety and security, courts and public authorities.
  • Business changes. A buyer or investor, and their advisers, if Droplet is involved in a merger, financing, acquisition or sale of assets. We'll tell you if your personal information becomes subject to a different privacy policy.
  • With your consent, or at your direction.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We may share aggregated or de-identified information that can't reasonably be used to identify you.

6. Cookies and similar technologies

This website doesn't set cookies, and it doesn't load analytics, advertising or other third-party scripts. It stores one item in your browser: your light or dark theme choice, and only if you pick one. Our Cookie policy has the details, including what the Droplet application uses once you sign in.

7. International data transfers

Droplet is based in the United States, and we and our service providers may process personal information there and in other countries. Those countries may have data protection laws that differ from the laws where you live.

When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that hasn't been recognized as providing adequate protection, we use safeguards approved by law, such as the European Commission's standard contractual clauses and the UK addendum, together with extra measures where needed. You can ask us for a copy of the safeguards that apply.

8. How long we keep information

We keep personal information for as long as we need it for the purposes in this policy, and then we delete or anonymize it. The usual periods are below. They can be longer where the law requires us to keep records, or where we need the information to resolve a dispute or enforce our terms.

  • Account and profile

    How long we keep it
    While your account is active, and for up to 90 days after it closes.

  • Customer Data

    How long we keep it
    While your subscription is active. After it ends you can export your findings and reports for 30 days, and we delete Customer Data from our active systems within 90 days of the end date, and from backups as they expire. A trial workspace that doesn't become a subscription is deleted 30 days after the trial ends.

  • Audit log

    How long we keep it
    For the retention period that comes with your plan. Enterprise customers can set a custom period.

  • Billing and tax records

    How long we keep it
    For as long as tax and accounting law requires, typically up to seven years.

  • Support and sales communications

    How long we keep it
    For up to three years after our last interaction with you.

  • Website and server logs

    How long we keep it
    For up to 90 days.

  • Marketing preferences

    How long we keep it
    Until you unsubscribe, plus a minimal record so that we respect your choice.

9. How we protect information

We use technical and organizational measures designed to protect personal information against loss, misuse and unauthorized access:

  • Encryption of data in transit and at rest.
  • Isolation of each customer's data from every other customer's.
  • Read-only connections to your systems.
  • Role-based access, and an audit log of actions in the workspace on the plans that include it. Enterprise adds advanced permissions and SSO.
  • Staff access limited to the people who need it.

No system is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll tell you and the relevant authorities as the law requires. Security documentation and questionnaires are available on request: read our security overview or contact us.

10. Your rights and choices

Depending on where you live, you may have the right to:

  • Access a copy of the personal information we hold about you.
  • Correct information that is inaccurate or incomplete.
  • Delete your personal information, in the cases the law provides for.
  • Restrict or object to certain uses, including processing based on our legitimate interests and direct marketing.
  • Receive your information in a portable format.
  • Withdraw consent at any time, where we rely on it.
  • Not be discriminated against for using your privacy rights.

To use a right, contact our privacy team. We may need to verify your identity first and, if someone makes a request for you, to check that they're authorized. We respond within the time the law requires, normally within 30 days, and if we need longer we'll tell you why.

Marketing. You can opt out of marketing emails at any time with the link in each message, or by contacting us. We'll still send service and security messages.

Complaints. If you're in the European Economic Area, the United Kingdom or Switzerland, you can complain to your local data protection authority. We'd appreciate the chance to resolve your concern first.

11. Information for specific regions

California. In the past 12 months we collected the categories of personal information described in Information we collect: identifiers, commercial information, internet and network activity, and professional information. We collect them from you, your organization and automatically, use them for the purposes in How we use information, and disclose them to the service providers in How we share information. We don't sell or share personal information as the California Consumer Privacy Act defines those terms, and we don't knowingly sell or share the personal information of anyone under 16.

European Economic Area, United Kingdom and Switzerland. Droplet, Inc. is the controller of the personal information described in this policy, other than Customer Data, for which it is a processor.

Elsewhere. If the law where you live gives you rights that this policy doesn't mention, contact us and we'll honor them as the law requires.

12. Children's privacy

Droplet is built for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 16. If you think a child has given us information, contact our privacy team and we'll delete it.

13. Changes to this policy

We may update this policy as our practices or the law change. We'll post the new version here with a new “Last updated” date and, for material changes, tell you by email or in the Service before they take effect.

14. Contact us

For questions about this policy, or to use your rights, contact our privacy team. Droplet, Inc. is the controller of the personal information described here, other than Customer Data.

See also our Terms of Service and our Cookie policy.