Privacy policy
Dropteam is a team of AI agents that helps Shopify merchants run their store's marketing, ads, customer support, social inbox, SEO and site improvements. It is operated by [COMPANY LEGAL NAME] (“we”, “us”). This policy explains what information Dropteam handles, why, who it is shared with, how long it is kept and how to have it deleted.
Dropteam is a business tool. Our customers are merchants. For data about the merchant's own customers (shoppers, people who comment on or message the merchant's Facebook Page or Instagram account), the merchant decides what is connected and we process it on the merchant's behalf.
Who this covers
- Merchants and their team members who sign in to Dropteam or install it from the Shopify App Store.
- People who connect a third-party account to Dropteam, such as a Facebook or Google login used to connect an ad account or a Page.
- The merchant's customers and audience, whose orders, support tickets, comments or messages reach Dropteam through the merchant's connected accounts.
What we collect and why
Your Dropteam account
- Name, email address and a hashed password (or your Shopify staff user id when you open Dropteam from the Shopify admin), to sign you in and send password resets and data-request notices.
- For each signed-in session: IP address and browser user agent, to keep you signed in and protect accounts.
- Your store settings, guardrails, approvals and the actions you or the agents take, kept in an audit log so every change can be traced.
From Shopify
When a merchant installs Dropteam, we read the store's orders and refunds, products, collections, inventory, online store content and themes. Order data is filtered before it is stored: we keep amounts, line items, discount codes, sales channel, marketing attribution (UTM parameters, ad click ids, landing page and referring site) and dates. We do not store shoppers' names, email addresses, phone numbers, postal addresses, notes, IP addresses or payment details. To recognise repeat customers we store a customer reference: a keyed hash of the shopper's email address made with a secret unique to each store, which cannot be turned back into the email address.
With the merchant's approval and within the merchant's guardrails, Dropteam can write to the store: product descriptions and SEO fields, image alt text, blog articles, URL redirects and files.
From accounts a merchant connects
Each connection is optional and can be disconnected at any time from the Connections page.
| Service | What we read | What we may change |
|---|---|---|
| Meta Ads (Facebook & Instagram ads) | The connecting person's Meta user id and name, the ad accounts they can access, ads, ad images and performance results. | Budgets; pausing, resuming and archiving ads; uploading new ads as paused. |
| Facebook Pages & Instagram | The connecting person's Meta user id, the Page and Instagram account chosen, and comments and direct messages on them: the text, the time, the post it belongs to, the commenter's public Instagram username (Facebook commenters and message senders get a pseudonymous handle instead of their name) and, for messages, the page-scoped id needed to reply. | Replying to comments and messages, hiding or liking comments, deleting our own replies. |
| Google Ads | Campaign and ad performance reports for the chosen account. | Budgets; pausing and resuming campaigns. |
| Google Search Console | Search performance for the store's site (read-only access). | Nothing. |
| Klaviyo | Campaign, flow, segment and metric performance figures. | Draft campaigns and flows, scheduling, coupons, segments, flow status. |
| Gorgias | Support tickets and their messages. Email addresses, phone numbers, street addresses and postal codes are removed from the text before it is stored; the customer's name, email, phone and address are never stored. | Replies, drafts, internal notes, tags, closing and reopening tickets. |
| GitHub | The theme repository the merchant chooses. | Branches and pull requests for theme fixes, which the merchant merges. |
| Microsoft Clarity | Aggregated site behaviour reports from Clarity's data export. | Nothing. |
Dropteam also visits the store's public web pages to check SEO, accessibility, speed and the checkout journey, the way a visitor's browser would.
Credentials
Access tokens and API keys for connected accounts and the Shopify installation are encrypted in our database, never shown back in the app, and removed when the account is disconnected.
How we use information
- To run the agents the merchant has turned on: analysing results, drafting replies, briefs, ads and content, and proposing or making changes within the merchant's guardrails.
- To show the merchant reports, approvals and an audit trail of everything that happened.
- To keep the service secure, prevent abuse and fix problems.
- To answer privacy requests (Shopify customer data requests and deletions, Meta data deletion requests).
We do not sell personal information, we do not use it for advertising, and we do not use it to train AI models.
Service providers we share information with
We use these providers to run Dropteam. They receive only what the task needs.
- Heroku (Salesforce): hosting for the app, its databases and stored files.
- Anthropic: the AI models behind the agents. They receive the information an agent works on, such as store figures, product details, support messages (with contact details removed) and social comments or messages.
- Google (Gemini) and OpenAI: image generation for ad concepts, when the merchant turns it on. They receive product photos, the reference ad image when concepts are generated from an ad, and a text description of the scene. No customer data.
- Shopify, Meta, Google, Klaviyo, Gorgias, GitHub and Microsoft: the platforms the merchant connects. We exchange data with them only as described above, under the merchant's own account.
- Our email delivery provider: to send password resets and notices to merchants.
We may also disclose information if required by law, or as part of a merger or acquisition, in which case this policy continues to apply.
Cookies
Dropteam sets a sign-in session cookie and, while you connect an account, a short-lived encrypted cookie that protects the connection step. Inside the Shopify admin, Dropteam uses Shopify session tokens instead of cookies. We do not use advertising or analytics cookies.
How long we keep information
- Store data is kept while Dropteam is installed. When a merchant uninstalls Dropteam, Shopify asks us to delete the store's data 48 hours later, and we delete it: orders, connected accounts and tokens, support and social data, generated content, files and agent history.
- Support tickets from Gorgias are deleted 35 days after their last activity, and all of them when Gorgias is disconnected.
- Customer data request exports are deleted after 30 days.
- Audit log entries are kept after uninstall as the record of what was done. They contain references (such as order numbers), not customers' contact details.
- Your Dropteam account (name, email, sessions) is kept until you ask us to delete it.
Deleting data and your rights
- Merchants can disconnect any account from the Connections page, and uninstalling Dropteam from Shopify deletes the store's data as described above.
- Shoppers: Dropteam answers Shopify's customer data requests and customer deletion requests for the merchant. Contact the store you bought from, or us.
- Facebook and Instagram users can remove Dropteam from their Facebook settings, which sends us a deletion request automatically. See Data deletion.
- Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to its use. Email [CONTACT EMAIL] and we will respond within the time the law requires.
Security
Each store's data is isolated in the database itself (row-level security), credentials are encrypted, the app is served over HTTPS only, and every change agents make goes through the merchant's guardrails and is recorded in an audit log.
Where information is processed
Dropteam runs in [HOSTING REGION]. Our providers may process information in other countries under their own safeguards.
Children
Dropteam is a tool for businesses and is not directed at children.
Changes
We will post any changes on this page and update the effective date. If a change is significant, we will tell merchants in the app or by email.
Contact
[COMPANY LEGAL NAME]
[ADDRESS]
[CONTACT EMAIL]