Privacy Policy

This Privacy Policy explains how [LEGAL ENTITY NAME], a company incorporated in Israel ("DropRenew", "we", "us", "our"), collects and uses personal data when you use the DropRenew website and application (the "Service"). For data about your use of the Service, DropRenew is the data controller. This Policy forms part of our Terms of Service.

We serve users around the world. We treat the EU and UK GDPR as our baseline standard, and we also honour rights under the California Consumer Privacy Act (as amended by the CPRA), the Israeli Privacy Protection Law, 5741-1981, and other applicable laws.

[If we target the EU/EEA or UK at scale, confirm whether an Article 27 EU/UK representative and/or a data protection officer must be appointed, and insert their details.]

You give us

• Identity & account data — your name, email address, and, if you sign in with Google, your Google profile name and photo.
• Portfolio & registrar data — the domains, expiry dates, registrar information, valuations, notes, themes and related data you enter or connect, including any registrar API credentials you choose to store.
• Communications & feedback — messages, support requests and beta feedback you send us.

We generate

• Analysis outputs — valuations, scores, recommendations, alerts and signal analyses we produce for your portfolio.
• Account-lifecycle data — your role, onboarding and disclaimer status, and last-active time.

We collect automatically

• Usage & device data — pages viewed, actions taken, approximate location, browser and device information, and log data.
• Cookies & analytics — via Google Analytics and Microsoft Clarity (which records page interactions such as clicks, scrolling and navigation as part of heatmaps and session recordings). We also record error and performance diagnostics using our own server-side logging (no third-party error-monitoring service). See "Cookies & tracking" below.

Where we rely on consent, you can withdraw it at any time without affecting processing already carried out. Where we rely on legitimate interests, you can object (see "Your rights").

We use cookies and similar technologies. Strictly necessary cookies (for sign-in, security and basic functionality) are always on. Analytics and session-recording technologies are non-essential and load only after you consent, where consent is required by law.

You can withdraw or change your cookie choices at any time via our cookie settings, and you can also control cookies in your browser. For more detail, see Google’s and Microsoft’s own privacy notices.

Our cookie-consent banner gates both Google Analytics (via Google Consent Mode) and Microsoft Clarity (via Clarity’s Consent API): they are denied by default and load only after you opt in, in every region.

To run the Service we share limited data with the processors below. We do not sell your personal data, and we do not allow these providers to use your data to train their models except as noted.

Payments are only involved if you take a paid plan. Because Paddle is the merchant of record, it — not DropRenew — is the seller for that transaction and determines how it processes your payment data for its own legal, tax and fraud-prevention duties.

[Verify each provider’s current data-processing terms, retention and training stance, and put data-processing agreements / Standard Contractual Clauses in place where required. Keep this list current as providers change. Confirm with counsel how Paddle’s merchant-of-record role should be characterised — independent controller vs processor — and whether a separate controller-to-controller disclosure is required.]

We share personal data only: with the sub-processors above; where you direct us to (for example, a registrar you connect); where required by law or to protect our or others’ rights; and in connection with a merger, acquisition or asset sale (with notice). We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as defined by California law.

We and our providers may process your data in countries other than yours, including outside the EEA, the UK and Israel. Where we transfer personal data internationally, we rely on appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses.

Several of our providers — including Google, Microsoft, Anthropic, Vercel, Supabase and Resend — are based in or process data in the United States. For transfers from the EEA, the UK or Switzerland we rely on Standard Contractual Clauses (and, where applicable, a provider’s Data Privacy Framework certification) together with supplementary measures.

Paddle, our payments provider and merchant of record, is established in the United Kingdom and processes payment data internationally, including in the United States, under its own transfer safeguards.

We keep your personal data while your account is active. You can delete your account at any time from Settings.

When you delete your account, we soft-delete it and retain your data for a recovery (grace) period of 90 days, so you can return without losing your portfolio. After the grace period we permanently delete or anonymise your personal data — except data we must keep longer to meet legal, tax or accounting obligations, to resolve disputes, or to enforce our agreements. Backups are purged on their normal rotation cycle.

If you had a paid plan, we cancel your subscription when you delete your account, and we keep the billing records for that subscription (plan, dates and amounts) after the grace period as part of our legal and accounting obligations. Those records are retained separately from your portfolio data, which is deleted. Paddle keeps its own transaction records under its own policy.

You can export a copy of your data at any time (see "Your rights").

Subject to your local law, you can:

• Access the personal data we hold about you and obtain a copy.
• Export your data — a self-service download is available in Settings.
• Correct inaccurate or incomplete data.
• Delete your data and be forgotten — available in Settings, subject to the 90-day grace period and any legal retention.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent (for example, for analytics or optional emails) at any time.
• Turn off renewal alerts at any time in Settings, or unsubscribe from any alert email. Account and security emails cannot be turned off.
• Port your data to another service, where applicable.

California residents also have the rights to know, delete, correct, and opt out of the sale or sharing of personal information (we do not sell or share), and not to be discriminated against for exercising them. Residents of Israel have the right to review and correct their data under the Privacy Protection Law.

To exercise any right, use the tools in Settings or contact privacy@droprenew.com. You also have the right to lodge a complaint with your data-protection authority — in Israel, the Privacy Protection Authority; in the EEA/UK, your local supervisory authority.

We use technical and organisational measures to protect your data, including per-account isolation and row-level access controls, encryption of stored registrar credentials, and access limited to what is needed to operate the Service. No system is perfectly secure, and we cannot guarantee absolute security.

The Service is not directed to children and is intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Policy. If we make a material change, we will give reasonable notice (for example, by email or in-product) and update the date above. Continued use after the change takes effect means you accept the updated Policy.

Privacy questions and requests: privacy@droprenew.com.

[Insert registered entity name, company number, registered address, and DPO / EU-UK representative if appointed.]