Privacy Policy

Last updated: October 2026

1. Introduction and Scope

dropsolace ("dropsolace," "we," "us," or "our"), operator of dropsolace.com, provides a compliance automation service that helps data brokers registered with the California Privacy Protection Agency ("CPPA") meet their obligations under the California Delete Act (California Civil Code § 1798.99.86) and the Delete Request and Opt-Out Platform ("DROP").

This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit dropsolace.com (the "Site") or use our services (collectively, the "Service"). It applies to information we collect for our own purposes — for example, when you visit the Site, apply for an account, or communicate with us.

This Privacy Policy does not apply to data that our customers process through the Service, such as hashed consumer identifiers retrieved from DROP and associated processing records. We process that data solely as a "service provider" on behalf of our customers, as described in Section 4 below.

Our Service is directed to businesses, not consumers, and is intended for users located in the United States.

2. Information We Collect

2.1 Information You Provide to Us

When you apply for or use an account, we collect:

• Business contact information: your name, work email address, and company name;
• Registration information: your CPPA data broker registration ID and related registration details;
• Communications: the content of emails or other messages you send to us.

2.2 Information Collected Automatically

When you visit the Site, our web servers automatically record standard technical information, including your IP address, browser type and version, and date, time, and pages accessed. We use this information solely to operate, secure, and troubleshoot the Site (for example, to detect abuse or diagnose errors). We do not use this information to profile, track, or advertise to you.

2.3 Information from Third Parties

If you subscribe to a paid plan, our third-party payment processor collects and processes your payment information directly. We receive from the processor only limited information needed to confirm your subscription status (such as a transaction confirmation and billing country). We do not receive or store your full payment card number.

3. How We Use Information

We use the information described in Section 2 to:

• Evaluate account applications and verify CPPA registration status;
• Create, maintain, and secure your account;
• Provide, operate, and improve the Service;
• Send you service-related communications, including onboarding instructions, processing-cycle reports, security notices, and responses to your inquiries;
• Process billing and manage subscriptions;
• Comply with applicable laws, regulations, and legal processes;
• Detect, prevent, and respond to fraud, abuse, and security incidents.

We do not use your personal information for advertising, and we do not use it to train machine-learning or artificial-intelligence models.

4. Data We Process on Behalf of Customers (Service Provider Role)

When our customers use the Service to process DROP deletion requests, we act solely as a "service provider" as defined in the California Consumer Privacy Act ("CCPA"). With respect to such customer data:

• We process hashed consumer identifiers and related processing records only on behalf of, and as instructed by, the customer;
• We do not use, retain, disclose, or combine such data for our own purposes or for the purposes of any third party;
• We do not "sell" or "share" such data, as those terms are defined in the CCPA;
• We retain processing logs for a limited period (currently up to twenty-four (24) months) solely to make them available to the customer, after which they are permanently deleted.

The customer remains the "business" responsible for such data, including the obligation under California Civil Code § 1798.99.86(e)(3) to maintain audit reports and related materials for at least six years. Our practices regarding customer data are governed by our Terms of Use.

5. Cookies and Tracking

We use only cookies and similar technologies that are strictly necessary to operate the Site and the Service (for example, to maintain your login session and protect against cross-site request forgery).

We do not use third-party analytics services, advertising cookies, social-media trackers, or any cross-site tracking technologies. We do not track you across other websites, and we do not permit third parties to collect information about your use of the Site for their own purposes.

6. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We disclose personal information only to the following categories of recipients, and only as needed to operate the Service:

• Hosting and infrastructure providers that operate the servers on which the Service runs;
• Email delivery providers that transmit service-related emails on our behalf;
• Payment processors that process subscription payments (acting as merchant of record);
• Professional advisers (such as lawyers or accountants) where necessary;
• Government authorities, regulators, or courts, where disclosure is required by law, subpoena, or other legal process, or where reasonably necessary to protect our rights, your safety, or the safety of others.

Each service provider engaged by us is contractually required to use personal information only to provide services to us and to protect it appropriately.

If we are involved in a merger, acquisition, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to the commitments in this Privacy Policy.

7. Data Retention

We retain the personal information described in Section 2 for as long as your account is active and thereafter as reasonably necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When you close your account, we delete or de-identify your account information within a reasonable period, except where retention is required by law.

Processing logs generated on behalf of customers are retained as described in Section 4 and in our Terms of Use.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, hashing of consumer identifiers, access controls, and logging of administrative access. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA with respect to the personal information we collect for our own purposes:

• Right to know: to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes of collection, and the categories of third parties to whom we disclose it;
• Right to access and data portability: to request a copy of your personal information in a portable format;
• Right to correct: to request correction of inaccurate personal information;
• Right to delete: to request deletion of personal information we have collected from you, subject to legal exceptions;
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

Because we do not sell or share personal information, the rights to opt out of sale or sharing are not applicable to our practices, and opt-out preference signals (such as Global Privacy Control) do not require any action on our part.

To exercise your rights, contact us at service@dropsolace.com. We will verify your request using the information associated with your account and respond within forty-five (45) days, as required by law; if we need additional time (up to another 45 days), we will notify you. You may use an authorized agent to submit a request, subject to verification of the agent's authority.

Note on customer data: if your request concerns data that one of our customers processes through the Service (for example, a deletion request you submitted via DROP), please direct your request to that customer or to the CPPA's DROP platform, as we process such data only on the customer's instructions.

10. Data Storage Location

Data processed in connection with the Site and the Service is stored on servers located in the United States, operated by our hosting providers. We do not knowingly transfer your personal information to, or store it in, any other country.

11. Children's Privacy

The Service is a business-to-business compliance tool and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us personal information, please contact us and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, notify account holders by email or by a notice within the Service. Your continued use of the Service after the effective date of an update constitutes acknowledgment of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

dropsolace
Email: service@dropsolace.com
Website: https://www.dropsolace.com