Privacy Policy

Account information: When you register, we collect your name, email address, and authentication credentials through Supabase Auth. If you sign in with a third-party provider, we receive the profile information that provider shares with us.

Subscription and billing data: Paid plans are processed by Stripe. We store your Stripe customer ID, subscription status, plan type, and billing history. We do not store full credit card numbers — payment details are handled directly by Stripe.

Product and workspace data: Content you create in KDDrop, including product names, descriptions, pricing inputs, catalog entries, generated copy, uploaded images, and campaign configurations, is stored in our database so you can access and manage your work.

Third-party integrations: If you connect Facebook/Meta Ads, we store encrypted OAuth tokens and the ad account metadata required to create and manage campaigns on your behalf. If you configure Chatea Pro or other integrations, we store the API credentials you provide, encrypted at rest.

Usage and technical data: We collect information about how you use the Service, including AI credit consumption, feature usage, IP address, browser type, device information, and error logs. We use Upstash Redis for rate limiting to protect the platform from abuse.

Cookies and local storage: We use essential cookies to maintain your session and remember your language preference (NEXT_LOCALE). Our Progressive Web App may cache static assets locally to improve performance.

We use your information to provide, operate, and improve KDDrop, including AI product generation, image creation, pricing calculations, catalog management, and Meta Ads campaign tools.

We use OpenAI and other AI providers to process the prompts and product data you submit. Generated outputs are returned to you and stored in your account when you save them.

We use Stripe to manage subscriptions, free trials, invoices, and the Customer Portal. We may send transactional emails related to your account, billing, or security.

We use aggregated and anonymized usage data to monitor performance, prevent fraud, enforce rate limits, and improve our features.

We do not sell your personal information to third parties.

Service providers: We share data with trusted processors that help us operate KDDrop, including Supabase (hosting and database), Stripe (payments), OpenAI and fal.ai (AI generation), Upstash (rate limiting), and Meta/Facebook (when you authorize ad account access). These providers process data only as needed to deliver their services to us.

Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, users, or the public.

Business transfers: If KDDrop is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

With your direction: When you connect third-party services or publish campaigns to Meta, we share only the data required to perform the action you request.

We retain your account and workspace data for as long as your account is active. If you delete products or catalog entries, we remove them from active storage in accordance with our backup and deletion procedures.

Billing records may be retained as required for tax, accounting, and legal compliance.

If you close your account, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law or legitimate business purposes such as dispute resolution.

We implement industry-standard safeguards, including encryption in transit (HTTPS), encrypted storage of sensitive tokens (such as Facebook and API credentials), row-level security in our database, and access controls for internal systems.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing.

You can update your profile information from your account settings. You can manage your subscription and payment methods through the Stripe Customer Portal.

You can disconnect third-party integrations (such as Meta Ads) from within KDDrop, which revokes our access to those tokens.

To exercise privacy rights or submit a data request, contact us at support@kddrop.app. We will respond within a reasonable timeframe.

KDDrop is operated from Latin America and may use service providers located in the United States and other countries. By using the Service, you acknowledge that your information may be processed in jurisdictions that may have different data protection laws than your country of residence.

KDDrop is intended for users aged 18 and older. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the Service.

Your continued use of KDDrop after changes become effective constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our data practices, contact us at support@kddrop.app.