Privacy Policy

Last updated: 24 October 2026

Important: This privacy notice is not ready to be treated as final until the operator confirms its legal identity, actual service providers, cookie inventory, data-retention periods and production data flows. The sections below describe the intended scope and identify details that still need verification; they must be checked against the live service.

DropMatch is an affiliate management platform for brands and promoters. This Privacy Policy explains what personal data we process, why we process it, and how we handle that data when you use DropMatch or when DropMatch processes order information for an affiliated Shopify store.

1. Who we are

DropMatch operates the DropMatch platform at https://dropmatch.net/. For privacy questions or requests concerning personal data processed by DropMatch, contact us at dropmatch.contact@gmail.com.

2. Personal data we process

Depending on how you use DropMatch, we may process:

3. Why we process this data

We use personal data to:

4. Shopify data

When a merchant connects a Shopify store to DropMatch, DropMatch may receive order data from Shopify. We process this information only to provide the affiliate attribution, sales reporting, and commission functionality of the platform.

In particular, DropMatch currently stores the customer's first name, last name, and email address together with relevant order and attribution information. We do not use this information for unrelated advertising or sell it to third parties.

5. Affiliate tracking

When a visitor follows a DropMatch affiliate link, we create a unique visit token to attribute a later Shopify order to that affiliate visit. The token may be stored in the visitor's browser and in the connected Shopify cart so that attribution can continue through checkout.

We may also record information about affiliate clicks, including the IP address associated with the click, for attribution, security, and operational purposes.

6. Sharing of personal data

We share personal data only where necessary to provide the DropMatch service, operate connected integrations, comply with legal obligations, or protect the rights and security of DropMatch and its users.

Merchant users may receive access to order and attribution information relevant to their own campaigns and stores. We do not sell personal data.

7. Data retention

We retain personal data only for as long as it is reasonably necessary for the purposes described in this policy, including providing the service, maintaining accounting and commission records, resolving disputes, preventing fraud, and meeting legal obligations. When data is no longer required, we take reasonable steps to delete or anonymise it.

8. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or loss. Data transmitted to DropMatch is protected using HTTPS where supported by the service.

9. Your rights

Depending on applicable privacy law, you may have rights to request access to, correction or deletion of your personal data, restriction of processing, or other rights provided by law. You can contact us at dropmatch.contact@gmail.com to make a privacy request.

10. Third-party services

DropMatch integrates with Shopify to receive and process order information for connected stores. Those services may have their own privacy policies and terms. We recommend reviewing the applicable policies of any third-party service you use with DropMatch.

11. Changes to this policy

We may update this Privacy Policy when the DropMatch service, our data practices, or applicable requirements change. The latest version will always be published on this page, together with its effective date.

12. Contact

If you have questions about this Privacy Policy or how DropMatch handles personal data, contact:

DropMatch
dropmatch.contact@gmail.com

13. Roles and responsibilities under data-protection law

The party that determines why and how personal data is processed is generally responsible for its controller obligations for that processing. A brand using DropMatch may independently determine purposes for customer and campaign data in its store. DropMatch’s role may differ by feature and arrangement. Where DropMatch processes personal data only on a merchant’s documented instructions, the parties may need a separate data-processing agreement setting out the subject matter, duration, purpose, data types, data subjects, security, subprocessors, assistance and deletion or return obligations. The actual roles must be confirmed for each integration.

14. Legal bases for processing

Where the GDPR applies, personal data must be processed on a valid legal basis. Depending on the purpose and facts, a basis may include performance of a contract, compliance with a legal obligation, legitimate interests after balancing those interests against individual rights, or consent where consent is genuinely required and valid. The appropriate basis must be assessed for each processing purpose; this policy does not claim that one legal basis applies to all data. Where consent is relied on, it must be freely given, specific, informed, unambiguous and withdrawable.

15. Data minimisation and accuracy

DropMatch aims to process only data reasonably needed for account administration, affiliate attribution, reporting, security and support. Merchants should not send unrelated customer notes, sensitive personal data or unnecessary checkout fields through an integration. Users should keep their account details accurate and tell us when corrections are needed. We may ask for reasonable evidence before changing account or order records where doing so is necessary to prevent fraud or preserve audit integrity.

16. Detailed account information

Account data may include a username, email address, role, profile image or avatar, authentication provider identifiers and account status, depending on enabled features. Passwords should be stored as password hashes rather than readable text. Authentication events and session-related data may be processed to keep accounts secure. Do not send passwords, authentication codes or recovery secrets to support. Where third-party sign-in is used, the information received depends on the provider’s authorisation flow and the permissions granted.

17. Clicks, visit tokens and attribution

Affiliate links may carry campaign or promoter identifiers. DropMatch may create a random visit token and store it in a browser or pass it to a connected store to associate a later order with a prior click. Depending on implementation, event records may include timestamps, campaign identifiers, referral details, IP addresses or technical metadata. Attribution is probabilistic in practical terms and may fail because of browser restrictions, deleted storage, device changes, blocked scripts, store configuration or incomplete events. The exact data fields and retention periods should be documented from the production implementation.

18. Order and customer data

For connected Shopify stores, the service may receive order identifiers, order numbers, store domain, order date, currency, totals, line items, status and customer name or email as described above. Such data should be limited to what is needed for attribution, commission calculations, fraud review, reporting and support. Merchants remain responsible for having an appropriate legal basis and providing any required privacy information to their customers. Merchants must not use DropMatch order data for unrelated marketing unless they independently establish a lawful basis and meet all applicable requirements.

19. Data sharing with brands and promoters

Access should be limited to the campaigns, stores and reporting functions relevant to a user’s role. A brand may see campaign-related performance and order information for its own store. A promoter may see performance information needed to understand their referrals and commissions. The exact fields visible to each role depend on the current product design. Users must not export, disclose, sell, combine or reuse data outside authorised purposes. Access controls and role permissions should be reviewed as the platform evolves.

20. Service providers and subprocessors

DropMatch may rely on hosting, database, email delivery, authentication, ecommerce, error-monitoring or other infrastructure providers. Such providers may process data to provide their contracted services. The operator should maintain an accurate list of providers, their purposes, locations and transfer safeguards where required. This policy does not invent a complete vendor list; it should be updated to reflect the providers actually enabled in production. Providers should be selected and monitored in a manner appropriate to the sensitivity and volume of the data.

21. International transfers

Personal data may be processed in a country other than the country where the individual lives, depending on the location of DropMatch infrastructure and service providers. Where the GDPR applies, transfers outside the European Economic Area must comply with applicable transfer rules, which may include an adequacy decision, standard contractual clauses and supplementary safeguards where required. The operator must identify actual hosting and provider locations before making a definitive statement about transfer destinations or mechanisms.

22. Retention criteria

There is no single retention period suitable for every category. Account data may be kept while an account is active and for a limited period afterward to handle security, disputes and legal obligations. Attribution events may be retained for reporting and fraud prevention. Financial and commission records may need to be kept for statutory accounting periods. Security logs should be retained only as long as justified by operational and legal needs. The operator should define actual periods or objective criteria for each category, configure deletion jobs where appropriate, and avoid keeping identifiable data indefinitely merely because storage is inexpensive.

23. Deletion, backups and residual copies

When data is deleted from active systems, copies may remain temporarily in backups, disaster-recovery systems or security logs until those systems rotate or are securely overwritten. Such copies should not be used for ordinary purposes and should remain protected. Deletion may be delayed or limited where data must be retained to comply with law, establish or defend legal claims, resolve a commission dispute or prevent fraud. Where data cannot be deleted immediately, the restriction and reason should be explained when required.

24. Security controls

Appropriate safeguards may include access controls, role separation, password hashing, secure sessions, HTTPS, software updates, backups, logging and least-privilege access. The precise controls should match the risks and be verified in production. No website or internet transmission can be guaranteed completely secure. Users should use unique passwords, secure their email accounts, keep devices updated and report suspected account compromise promptly. Credentials and production secrets should never be placed in public repositories or shared in support messages.

25. Personal-data breaches

If a personal-data breach occurs, DropMatch will assess its nature, scope, likely consequences and applicable notification duties. Where the GDPR applies, a controller may be required to notify a supervisory authority within 72 hours after becoming aware of a breach unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Affected individuals may also need to be informed where the risk is high. The exact duties depend on the facts and the parties’ respective controller or processor roles.

26. Your rights and how to exercise them

Depending on applicable law, you may request access, rectification, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw consent without affecting the lawfulness of processing before withdrawal. Rights are not absolute and exceptions may apply. Contact dropmatch.contact@gmail.com with enough information for us to understand and verify your request. Do not include passwords or unnecessary sensitive information. We aim to respond within the period required by applicable law and will explain any lawful extension or refusal.

27. Identity verification and authorised requests

We may ask for proportionate information to verify identity or authority before disclosing, correcting or deleting personal data. We will not ask for your password. Where a request is made by an agent, we may request evidence of authority. Verification steps should be limited to what is reasonably necessary and should not create unjustified barriers to exercising rights.

28. Children and age limits

DropMatch is intended for people who are legally able to enter into the relevant agreement and use the service under applicable law. The operator should set and publish an age requirement appropriate to its users and legal obligations. We do not knowingly seek to collect children’s personal data in circumstances where such collection is unlawful. If you believe a child has supplied personal data inappropriately, contact us so the matter can be reviewed.

29. Cookies and similar technologies

Cookies or similar browser storage may be used for authentication, security, preferences and affiliate attribution. Technologies that are strictly necessary may be treated differently from analytics or marketing technologies under applicable law. Where consent is required for non-essential technologies, they should not be activated before valid consent and users should be able to change their preferences. The operator must audit the production site and integrations to identify all cookies, local storage keys, tags, lifetimes, purposes and recipients before publishing a definitive cookie inventory.

30. Analytics, marketing and communications

Service messages about account security, functionality or material service changes may be necessary to operate the account. Promotional communications, if introduced, require a separate assessment of the applicable direct-marketing and electronic-communications rules. Users should not be added to marketing lists merely because they registered for DropMatch. Any unsubscribe mechanism must work promptly, and suppression records may be retained to respect an opt-out. The operator should update this policy if analytics or marketing tools are added or materially changed.

31. Automated decisions and profiling

DropMatch may calculate attribution, commission totals or flag suspicious events using rules or software. These functions should not be described as making legally significant automated decisions unless that is actually how the product operates. If a feature begins making decisions solely by automated processing that produce legal or similarly significant effects, the operator must assess applicable transparency, safeguards and review rights before launching it.

32. Third-party websites and integrations

Links to third-party websites and integrations are provided for functionality or convenience. Those providers may collect information under their own notices and terms. DropMatch does not control independent third-party privacy practices. Users should review the relevant provider’s documentation and configure permissions carefully. Disconnecting an integration may stop future transfers but may not automatically delete records already received; deletion requests should be handled under the applicable retention rules.

33. Changes to this policy

We may revise this policy when the service, providers, data categories or legal requirements change. Each published version should show an accurate update or effective date and explain material changes in a clear manner. Where law requires notice or consent, we will use the appropriate process. Historical versions should be retained where needed to demonstrate what information was provided at a given time.

34. Complaints and supervisory authorities

If you have a concern, contact us first at dropmatch.contact@gmail.com. If the GDPR applies, you may also have the right to lodge a complaint with the data-protection supervisory authority in your habitual residence, place of work or the place of the alleged infringement. The relevant authority and any local contact details should be confirmed for the operator’s establishment and the user’s circumstances.

35. Details requiring operator confirmation

Before publication as a final notice, the operator should confirm its legal name and contact address, controller identity, hosting and service-provider list, international transfer arrangements, cookie inventory, retention periods, lawful bases for each processing purpose, and the exact data received from each Shopify permission scope. This policy intentionally avoids inventing those facts. The current privacy contact is dropmatch.contact@gmail.com.