Privacy policy
Draft for review. Last updated 11 November 2026.
Docdrop is run by the company that runs Docdrop. This policy explains what personal information we handle, why, and what your rights are under South Africa's Protection of Personal Information Act (POPIA) and the UK and EU General Data Protection Regulation (GDPR).
Two kinds of people use Docdrop
Customers create an account to share documents. For their account information we decide how it is used (we are the responsible party, or controller).
Readers open a link that a customer sent them. For readers' information the customer decides how it is used; we only store and process it on the customer's behalf (we are the operator, or processor). If you are a reader with a question about your information, the person who sent you the link is the right one to ask, and we will help them answer.
What we collect
From customers
- Name, email address and a scrambled (hashed) copy of your password.
- The documents you upload and the settings you choose.
- Payment records: amount, date and a reference from our payment provider. We never see or store your card number.
- The internet address and browser type used when you log in, to keep accounts secure.
From readers
- Your email address, if the sender asks for it, and any answers you give to the sender's questions.
- When you opened the document, which pages you looked at and for how long, and whether you downloaded it.
- Your internet address, and from it your approximate location (city and country), device type and browser.
- If the sender requires it, a record that you accepted their agreement.
Readers are told about this on the page where they enter their details, before the document opens.
Why we use it
- To provide the service: showing documents, enforcing each link's rules, and giving the sender their reading report.
- To keep the service secure and prevent abuse.
- To bill customers and keep the records the law requires.
- To email you about your account: confirmations, login links, and alerts you asked for.
We do not sell personal information, do not use it for advertising, and do not use tracking or advertising cookies.
Cookies
We set only cookies that the service cannot work without, so the law does not require us to ask for consent:
| Cookie | What it does | How long |
|---|---|---|
| dd_session | Keeps a customer logged in. | 30 days |
| dd_csrf | Protects forms from being submitted by another website. | 1 year |
| dv_(number) | Remembers that a reader has passed a link's checks (email, password, agreement), so they are not asked again. | 30 days |
| dd_flash | Shows a one-off message such as "Saved". | 1 minute |
Who else handles the information
- Our hosting provider, who runs the server everything is stored on.
- Our email delivery provider, who delivers the emails we send.
- Paystack, who processes card payments.
Approximate location is worked out on our own server from a database we download; reader internet addresses are not sent to anyone for this. Customers may choose to send their own visit records to tools they connect, such as Slack or a CRM.
Where it is stored and for how long
Information is stored on our server and in nightly backups. Account information is kept while the account is open. Visit records are kept until the customer deletes the link, the document or their account. Payment records are kept for as long as tax law requires. Backups are kept for 14 days.
Your rights
You can ask to see the information held about you, have it corrected or deleted, object to its use, or receive a copy. Customers can do most of this themselves in the dashboard. To make a request, email us. If you are unhappy with our answer you can complain to the Information Regulator (South Africa) or the Information Commissioner's Office (UK).
Changes
If we change this policy in a way that matters, we will tell customers by email before the change takes effect.