Privacy Policy

1. Who we are (data controller)

The controller responsible for the personal data described in this policy is:

• Controller: BlickDrop
• Privacy contact: privacy@blickdrop.com

2. What data we collect

We process personal data about two groups of people, and it is helpful to keep them separate:

(a) Account users

People who register a BlickDrop account (typically designers and studios). We process:

• Email address and display name
• A hashed password (we never store passwords in plain text), or a third-party identifier if you sign in with Google (OAuth)
• Time zone
• IP address and technical request metadata, collected automatically when you use the service
• Content you upload — design files, images, comments, and annotations

(b) Share-link visitors

People who open a project share link without registering an account (typically a designer's clients and reviewers). We process:

• The name you enter so your comments can be attributed to you
• Your email address, only if you choose to provide it to receive project update emails (this is optional)
• Your browser time zone, used to localise times in emails
• IP address and user-agent, and the time you accessed the link, recorded in an access log for security and abuse prevention
• A strictly-necessary session cookie so you don't have to re-enter your name on every page (see “Cookies” below)

(c) Product usage analytics

For both groups above, we keep a small amount of first-party, pseudonymous usage data so we can understand which features are used and improve the product. Each record is a single event describing an action taken in the app — for example, “opened compare view” — together with:

• The event name and the time it happened
• A pseudonymous identifier for the account or share-link visitor who triggered it (an internal id — never your name or email)
• A reference to the project the action related to, where applicable

These records contain no IP addresses, no names, and no message or comment content. The analytics run on our own infrastructure; nothing is shared with third-party analytics or advertising providers. Our legal basis is our legitimate interest in understanding how features are used so we can improve the product — Art 6(1)(f). If you have a BlickDrop account you can object and turn this off at any time in your account settings (Art 21). Share-link visitors can object by contacting privacy@blickdrop.com, and we will delete the events attributed to them.

3. Why we process it, and our legal basis

Under Art 6(1) GDPR, every purpose has a legal basis:

4. Who we share data with (processors)

We do not sell personal data. We use a small number of sub-processors to run the service, each acting on our instructions as our processor:

• Resend — delivery of transactional and digest email (United States)
• Sentry — error and performance monitoring, where enabled
• Cloud hosting & database infrastructure — runs the application and stores your account data and uploaded files

Each provider processes personal data only to deliver its service to us and on our instructions. We do not use your content to train machine-learning models, and we do not share it with advertisers.

5. International data transfers

Some processors named above are located outside the European Economic Area (for example, email delivery transits the United States). Where personal data is transferred outside the EEA, we take steps to ensure it remains protected by an appropriate safeguard recognised under Chapter V of the GDPR (Art 44 and following). You can request more information about these safeguards using the contact details above.

6. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it. Current windows:

7. Cookies

BlickDrop uses only strictly-necessary cookies — the ones required to run the app and keep it secure. Under ePrivacy Art 5(3) these are exempt from consent, so there is no cookie banner to click through. We do not use advertising or cross-site tracking cookies, and our analytics do not use cookies either:

• On our public marketing pages we measure anonymous, aggregate traffic with a self-hosted, cookieless analytics tool (Umami) that runs on our own servers. It sets no cookies, stores no personal identifiers, and shares nothing with third parties.
• Inside the app, our first-party product analytics (see section 2) set no additional cookies — they reuse the strictly-necessary session that is already in place.

The cookies we set are:

• Authentication session — keeps you signed in to your account
• Share client-session — remembers a share-link visitor so they don't re-enter their name on every page; persists for up to 30 days only if the visitor ticks “remember me”, otherwise it lasts for the session
• Theme preference — remembers light/dark mode

8. Your rights under the GDPR

If you are in the EU/EEA you have the following rights over your personal data (Arts 15–22):

• Access — obtain a copy of the data we hold about you (Art 15)
• Rectification — correct inaccurate or incomplete data (Art 16)
• Erasure — have your data deleted (Art 17)
• Restriction — limit how we process your data (Art 18)
• Portability — receive your data in a structured, machine-readable format (Art 20)
• Objection — object to processing based on legitimate interest (Art 21)
• Withdraw consent — where we rely on consent (e.g. project-update emails), withdraw it at any time, without affecting prior processing

To exercise any of these rights, email privacy@blickdrop.com. You also have the right to lodge a complaint with a supervisory authority — in the EU, the data protection authority in your country of residence or work.

9. Children

BlickDrop is a professional creative-review tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Data security

We use industry-standard measures to protect personal data, including encryption in transit, access controls, and hashed password storage. No system is completely secure, but we work to safeguard your information and will notify you and the relevant authority where required by law in the event of a data breach that affects your personal data.

11. Changes to this policy

We may update this policy as the service evolves or the law changes. Material changes will be posted on this page with a new “last updated” date above.