Privacy Policy

Dripsy ("Dripsy," "we," "us") sends scheduled sequences of text messages and emails on behalf of the businesses and individuals who use it (each, an "Account"). This policy explains what information we collect, why, and how it's handled — both for the people who sign in to Dripsy and for the contacts an Account sends messages to through it.

Dripsy is currently invite-only: there's no public sign-up, and every Account is provisioned by us directly. If that changes, this policy will be updated to reflect it.

Information we collect

We collect information in three broad groups:

• Account and user information. When we provision an Account, we collect the name of the business or person it belongs to and the email address and password (stored as a salted hash, never in plain text) of each person who signs in to it.
• Recipient information, provided by an Account. Accounts add their own contacts ("Recipients") to send messages to — typically a name, phone number, and/or email address. We don't collect this directly from Recipients; it's provided to us by the Account that added them. See "Message recipients" below for how this is handled.
• Message content and delivery records. The text, subject lines, and any linked image URLs an Account writes into a campaign, plus records of when each message was sent, its delivery status, and the identifiers our delivery providers return for it. We don't currently host uploaded media ourselves — a linked image is sent as a URL to wherever the Account already hosts it.

Our hosting provider also keeps standard server logs (IP address, user agent, request timestamps) for operating and securing the service. We don't run advertising or analytics trackers on this site or in the Dripsy app, and we don't use cookies to track you across other sites. Signing in to the app stores a session token in your browser's local storage, not a cookie.

How we use information

• To operate the service: authenticate sign-ins, run scheduled sends, and show delivery status.
• To communicate with Account holders about their Account, including service and security notices.
• To enforce fair-use limits (like per-Account send quotas) and prevent abuse.
• To debug and improve the service, using aggregated or de-identified data where practical.
• To meet legal obligations, such as responding to a lawful request from a regulator or court.

How we share information

We don't sell personal information, and we don't share it for advertising purposes. We do share it with a small set of providers who deliver the service on our behalf, each acting under its own privacy and security commitments:

• Twilio — to deliver text messages.
• SendGrid (Twilio) — to deliver emails, including account invites and password resets.
• Render — to host the application and its database.
• Amazon Web Services (S3) — to store any message media an Account links to.

We may also disclose information if required by law, to protect the rights and safety of Dripsy, our users, or the public, or in connection with a merger, acquisition, or sale of assets — in which case we'll make reasonable efforts to notify affected Accounts first.

Message recipients

Dripsy is a tool: Accounts use it to message contacts of their own choosing, for their own purposes. In privacy terms, the Account is the controller of its Recipients' information, and Dripsy processes it on the Account's behalf to send the messages the Account schedules. Each Account is responsible for having a lawful basis and, where required, consent to message the Recipients it adds.

If you've received a message sent through Dripsy and want it to stop, the fastest path is to reply directly to whoever sent it or use whatever opt-out instructions appeared in the message. You can also contact us at the address below; we'll pass your request to the relevant Account and mark you opted out in our systems so no further scheduled messages go to you through Dripsy.

Data retention

We keep Account, Recipient, and message data for as long as the Account is active, plus a limited period afterward for backups, legal, and accounting purposes. An Account can ask us to delete its data at any time; we'll do so except where we're required to keep it (for example, delivery records needed to resolve a billing or compliance dispute).

Security

We use industry-standard safeguards — encrypted connections (TLS), access controls, and hashed passwords among them — to protect the information we hold. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

Your rights

Account holders can review and correct their Account's data directly in the app, or by contacting us. If you're a Recipient and want to know what information an Account has about you, ask that Account directly — they control it. Depending on where you live, you may also have rights to access, correct, or delete personal information under laws like the GDPR or state privacy laws; contact us and we'll route your request appropriately.

Children's privacy

Dripsy isn't directed at children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we'll delete it.

International transfers

Dripsy's infrastructure runs in the United States. If you're accessing Dripsy from outside the US, your information will be transferred to and processed there.

Changes to this policy

We'll update the date at the top of this page when this policy changes, and for material changes we'll make a reasonable effort to notify active Accounts directly.

Contact us

Questions about this policy, or a request related to your information? Write tohi@trydripsy.com.