Privacy Policy

1. Who we are

This Privacy Policy governs how we, Drool Limited and our affiliates ("Drool Community", "we", "our" or "us"), collect, use and store information about you ("User", "you"). Your privacy is important to us, and we are committed to a platform that meets a high standard of user privacy.

Drool Limited is a company registered in England and Wales under company number 12979799, with its registered office at 8 Sycamore Street, London, England, EC1Y 0SW. For any privacy question, or to exercise your rights, contact us at alex@drool.design.

"Personal Data" means any information that can be used, on its own or with other data, to identify a living individual. This policy explains our practices under UK data protection law (the UK GDPR and the Data Protection Act 2018) and, where it applies to you, the EU GDPR.

2. Scope of this policy

This policy describes how we process information we collect about or from you through our website at drool.community and the member hub (our "Digital Platforms" or the "Service"), and when you otherwise interact with us. By accessing or using the Service, you agree to this policy. If you do not agree with it, you may not use the Service.

3. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The latest version is always shown here, with the date at the top. If we make significant changes to how we use your Personal Data, we will notify you, for example by a notice on the Service or by email. Your continued use of the Service after a change means you accept the updated policy.

4. Information we collect

Account and application data: when you apply or create an account we collect credentials such as your email, name and password, and the information you give us about your studio, role and work. If you sign in via Google or Apple, we store the associated user ID and email address to verify your identity.

Billing data: if you take out a paid plan we collect details needed to process payment, such as your billing name and contact details. Our payment processor handles your card details. We do not store full card numbers, only limited information such as the last four digits, plan and payment status.

Content data: the quotes, projects, files, links, comments and other content you create in the Service, which may include personal data about your own clients that you choose to add.

Usage and log data: our servers log data each time a device accesses them, including pages visited, time spent, IP address, browser and device information and other usage metrics. This helps us monitor, troubleshoot, secure and optimise the Service.

5. How and why we use your data (legal bases)

To provide the Service: creating and running your account, delivering the tools, and letting you share work with your clients. Legal basis: performance of our contract with you (Article 6(1)(b) UK GDPR).

To take payment and manage your membership, including renewals, receipts and failed-payment recovery, and to meet our tax and accounting obligations. Legal basis: performance of our contract, and compliance with our legal obligations (Article 6(1)(c)).

To keep the Service secure, prevent fraud and abuse, and improve it. Legal basis: our legitimate interests in operating a safe, reliable product.

To communicate with you about your account, security and important changes; and, where you opt in, to send you community news, updates and marketing. Marketing is optional and based on your consent, which you can withdraw at any time.

6. Personal data about your clients

When you use the Service to quote, collect feedback from, or share work with your own clients, you decide what personal data about them to add. For that data you are the data controller and we act as your processor, handling it only to provide the Service to you and on your instructions. You are responsible for having a lawful basis and any permissions needed, and for giving your clients any privacy information they are entitled to. Our Data Management document explains where we act as controller and where we act as processor.

7. Cookies and analytics

We use cookies and similar technologies that are necessary to run the Service, for example to keep you logged in and your session secure. Session cookies expire when you close the Service. You can disable cookies in your browser, but this may limit functionality.

Before placing any non-essential cookies (for example analytics), we seek your consent through a cookie banner and you can change your choice at any time. We use third-party analytics services to understand usage and performance; these providers may collect data such as IP addresses, device and browser types and activity metrics.

8. How we share your data

We do not sell your personal data. We share it with trusted service providers who help us run the Service, including our payment processor (Stripe), our transactional email provider, our hosting, database and authentication providers, and our analytics tooling, under contracts that require them to protect it.

We may disclose personal data where required by law or in response to lawful requests by public authorities, which we validate before disclosing. In the event of a merger, acquisition or asset sale, your information may be transferred to the new entity, subject to the commitments in this policy.

9. International transfers

Some of our providers may process data outside the UK or EEA. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the International Data Transfer Agreement / Addendum, or Standard Contractual Clauses approved by the European Commission, so your data stays protected to UK/EU standards.

10. How long we keep it

We keep your Personal Data until we no longer need it, until you delete it, or until you send a valid deletion request, after which we securely delete or anonymise it. We may keep it for longer where required for legal, regulatory, tax or accounting reasons, to keep an accurate record of our dealings in case of complaints, or where there is a realistic prospect of litigation. Billing records are typically kept for at least six years.

11. Security

We implement technical, organisational and security measures designed to protect your data against loss, misuse, unauthorised access, disclosure, alteration and destruction, appropriate to the nature of the data and the risks involved. No system is completely secure, however, and we cannot guarantee absolute security or that data transmitted over the internet will not be intercepted. Your own security matters too: please keep your login details safe and use secure devices and networks.

12. Your rights

Under UK (and, where applicable, EU) data protection law you have the right to: access the Personal Data we hold about you; have it corrected if it is inaccurate or incomplete; have it deleted in certain circumstances; restrict or object to how we use it; data portability; and, where we rely on consent, to withdraw that consent at any time. Some of these rights are subject to exemptions or limitations.

To exercise any of these rights, email alex@drool.design. We will respond within one month. We may ask for information to verify your identity, and in limited cases may charge a fee or decline where a request is manifestly unfounded or excessive or would affect the rights of others.

13. Children

The Service is intended for professional use by adults and is not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Marketing and deleting your account

When you sign up you may choose to opt in to marketing communications (such as emails or community updates). This consent is optional and you can withdraw it at any time, by using the unsubscribe link, changing your settings, or emailing alex@drool.design. Transactional emails about your account (such as security, billing and support) are essential and cannot be opted out of.

If you would like us to permanently delete your account and associated data, email alex@drool.design. We aim to process deletion requests within 30 days, subject to any data we must retain by law.

15. Complaints and contact

If you believe your data protection rights have been infringed, you have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; if you are in the EU/EEA, your local data protection authority. We would appreciate the chance to resolve any concern first.

This Privacy Policy is effective as of the date shown at the top. Questions? Email alex@drool.design or write to Drool Limited, 8 Sycamore Street, London, England, EC1Y 0SW.