What we store
- Account: your email, name, phone (optional) and organisation name.
- Jobs: the map pin (latitude/longitude), site label, job title, tasks, hazards, transcript, gate/access code and notes, recipient phone/email, and the share status timeline.
- Media: voice notes and photos you attach, held in private storage and served only through short-lived signed links.
- Billing: Stripe session ids and what you bought. Card details never touch our servers.
30-day purge
Audio, photos (including proof-of-completion photos and notes added by contractors) and precise location are permanently deleted 30 days after a job is completed or when its link expires. Two automated jobs run every night: a database job (03:00 UTC) replaces the transcript, access code, notes and media references with a purge marker, and a storage job (03:30 UTC) deletes the actual audio and photo files, including any files no longer referenced by a job. Expired or purged job links show an "expired" page and cannot be reopened.
Masking
Gate codes and access notes are masked on the contractor page and only revealed on an explicit tap, re-masking automatically after 30 seconds. Recipient phone numbers are partially masked in your job list.
Who processes your data
- Google Gemini transcribes and structures your audio, photos and notes into a job card. Media is sent for processing and not used to train models under the API terms.
- Stripe handles payments and subscriptions.
- Supabase hosts the database, authentication and file storage.
- OpenFreeMap / OpenStreetMap serve map tiles (your IP reaches their servers when a map loads).
Contractor links
Job pages are marked no-index for search engines and send no referrer. Anyone with the link can open it until it expires — share responsibly.
Your rights
You can edit your details in Settings, delete individual jobs, and cancel unsent jobs at any time. Right to be forgotten: Settings → Delete my account immediately and permanently removes your login, profile, jobs, voice notes, photos, saved sites, wallet, credit history and payment records, and invalidates every contractor link you sent. Stripe retains its own payment records as required by financial regulations.
Contact
Questions about privacy: contact DropIt via the address shown on dropit.fyi.