Skip to main content
Build the DropBTD

    Privacy Policy

    What personal data we process, why, and your rights.

    This Policy explains what personal data we process when you use buildthedrop.com and the Build the Drop platform, why, for how long and what rights you have. It is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

    1. DATA CONTROLLER

    • Controller: Oriol Martí Collell ("Build the Drop").
    • Tax ID (NIF): 45859350H.
    • Address: Sant Valentí, 2, 4-2 - 08221 - Terrassa (Barcelona) - Spain.
    • Privacy contact email: info@buildthedrop.com.

    2. WHAT DATA WE PROCESS

    • Account data: email, password (handled by our authentication provider; we never see it in plain text) or, if you sign in with Google, the identifier Google gives us. Also your language and notification preferences.
    • Your business data on the platform: your spaces, the stores and suppliers you connect (Shopify, AliExpress and others) and the access credentials those platforms give us, the products you import, your price rules and the orders you manage.
    • Billing data: your plan and subscription status. Payments are processed by Stripe; we do not store your card details.
    • Affiliate program: if you take part, the data needed to calculate and pay your commissions, handled by Stripe.
    • Support: the content of the tickets and bug reports you send us.
    • Help assistant (chatbot): the questions you type, which we send to an artificial intelligence model hosted in the European Union to generate the answer. We do not store them linked to your account.
    • Integration waitlist: your email, the integration you are interested in and your language, if you sign up to be notified.
    • Browsing data: technical data needed for the website to work securely and, only if you accept it in the cookie banner, usage data through Google Analytics. See the Cookie Policy for details.

    3. WHY WE USE IT AND ON WHAT LEGAL BASIS

    • Providing the service (creating and maintaining your account, connecting your stores and suppliers, importing products, syncing stock and prices, managing orders, sending you the service's emails and notifications): performance of the contract (Art. 6.1.b GDPR).
    • Charging your subscription and issuing invoices: performance of the contract and compliance with legal obligations (Art. 6.1.b and 6.1.c GDPR).
    • Answering your questions and support tickets: performance of the contract or, if you are not a customer, our legitimate interest in replying to you (Art. 6.1.f GDPR).
    • Security and fraud prevention: legitimate interest (Art. 6.1.f GDPR).
    • Letting you know when an integration is available (waitlist): your consent (Art. 6.1.a GDPR). We will only write to you for that notice.
    • Website usage analytics: your consent, given in the cookie banner (Art. 6.1.a GDPR).

    You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before.

    4. YOUR STORE'S CUSTOMER DATA

    When you connect your store, the platform receives your customers' order data (for example name, shipping address, email and phone number) so it can send orders to your supplier and track them. For that data, you are the controller and Build the Drop acts as a processor: we only process it on your instructions and to provide you with the service, under the data processing agreement included as Annex I of the Terms of Service.

    5. WHO WE SHARE DATA WITH

    We do not sell your data. We only share it with providers that deliver services to us and act as processors:

    • Amazon Web Services (platform hosting, authentication, email delivery and artificial intelligence), in the European Union region (Ireland).
    • MongoDB Atlas (database).
    • Stripe (payments, subscriptions and affiliate commission payouts).
    • Google (Google Analytics, only with your consent, and Sign in with Google if you choose it).

    In addition, when you connect a store or supplier (for example Shopify or AliExpress), we exchange with that platform the data needed for the service to work, on your instructions. Those platforms process the data under their own policies.

    We may also disclose data to public authorities when the law requires us to.

    6. INTERNATIONAL TRANSFERS

    Some of these providers are US companies or may access data from outside the European Economic Area. In those cases, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission.

    7. HOW LONG WE KEEP DATA

    • Account and platform data: while your account is active. If you close it, we delete the data, except what we must keep blocked to deal with possible legal liabilities.
    • Billing: for the period required by tax and commercial law (generally up to six years).
    • Support tickets: while needed to handle your request and, afterwards, for the limitation periods of possible liabilities.
    • Waitlist: until we notify you that the integration has launched or until you ask us to remove you, whichever comes first.
    • Analytics: for the retention period configured in Google Analytics.

    8. YOUR RIGHTS

    You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, by writing to info@buildthedrop.com and stating the right you want to exercise. We will reply within one month at most.

    If you think we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.

    9. MINORS

    Build the Drop is a service for professionals and is not aimed at children under 14. We do not knowingly collect data from children under that age.

    10. SECURITY

    We apply appropriate technical and organisational measures to protect your data, such as encrypted connections, access control and providers with high security standards.

    11. CHANGES TO THIS POLICY

    We may update this Policy to reflect changes to the service or the law. If the changes are significant, we will tell you by email or with a notice on the platform.

    Last updated: 17 October 2026.