Who operates the service
DocDropIt LLC operates DocDropIt. Contact support@docdropit.com for privacy questions. A requesting business determines what it collects and why; DocDropIt provides the collection platform. Contact that business about its purpose or authorization.
Information processed
Account information includes email addresses, workspace names, password hashes, verification status, memberships, subscription identifiers and plan status. Request information includes client names and emails, checklist questions, text answers, uploaded files and metadata, review notes, dates and activity history. Authentication records include hashed tokens, time-limited client-code records, revocable sessions and, when enabled, encrypted authenticator secrets and hashed recovery codes.
Workspace email history includes request invitations and reminders. Account-reset links, verification links, team-invitation secrets and client verification codes are delivered privately rather than placed in that history. Providers may process connection/security logs. Application rate-limit counters use hashed identifiers.
Purposes and access
Information is used to authenticate accounts, deliver requests, verify clients, scan and store files, provide authorized downloads, send requested notifications, apply plan limits, manage subscriptions, investigate abuse and support the service. Uploaded documents and checklist contents are not sent to an AI service in the implemented workflow.
The requesting business’s authorized workspace members and the email-verified client can access that request according to their permissions. Owners manage team access. DocDropIt and its infrastructure providers can process data as necessary to operate and support the service. It is not end-to-end encrypted. Information may also be disclosed where legally required or reasonably necessary to address fraud, abuse or a security incident.
Service providers and locations
- Render: application, private scanner and scheduled jobs in Virginia.
- Supabase: PostgreSQL account and request metadata in Northern Virginia.
- Amazon S3: private file objects in Ohio.
- Resend: transactional email.
- Stripe: checkout, subscriptions and billing portal. Card entry occurs in Stripe’s interface; DocDropIt does not store card numbers or security codes.
- GoDaddy and Microsoft 365: support email.
The application uses configured U.S. infrastructure. Provider support, email and payment operations may involve other locations under their own terms. International-transfer and customer processing terms require review before use that depends on them.
Cookies and measurement
A signed session cookie supports sign-in, CSRF protection, temporary client verification and a selected plan. Signing protects integrity; it does not make cookie contents confidential. Documents and authenticator secrets are not placed in it. The current site installs no advertising pixels or third-party audience analytics. Providers may process operational telemetry.
Retention and deletion
Requests and files remain during paid service unless an owner deletes them. When paid access ends, the owner has a 30-day read-only recovery window. After that window, document records and files are queued for cleanup following fresh billing verification; failures are retried. Canceling does not itself delete the account, and closing a request does not delete its files. Client links expire 365 days after creation; this is an access limit, not a storage-retention promise. The scheduled job cleans expired authentication and rate-limit records.
Request deletion removes its checklist and activity and queues files for deletion; failures are retried. Request email history can remain until workspace deletion. Workspace deletion removes its requests, messages, invitations and memberships. A user account remains if used in another workspace. Provider backups, billing records and records required for legal/security purposes may remain under applicable retention requirements. Explicitly deleted files cannot be restored through the app. Backup copies, where configured, age out on their separate retention schedule; immediate backup deletion is not promised. No recovery guarantee beyond the implemented service scope is offered.
Your choices and requests
Owners can export request metadata and answers, download files individually and delete requests or eligible workspaces. Clients can pause reminders. Contact the requesting business about information it collected; contact support@docdropit.com for account access, correction, export, deletion or privacy requests. We may verify your authority and retain information where law permits or requires it.
Scope and updates
The service is for adult business users, not children. Early access is limited to fictional documents; sensitive/regulated records are not approved. Controls reduce risk but cannot eliminate it. We will identify the updated date when this notice changes. Material processing changes require review before introduction.