Privacy Policy of MyDrop

Last updated: 06.08.2026

Thank you for choosing to be part of our community at MyDrop ("Company", "we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website mydrop.com.ua or use our services, including interaction with Instagram through the Instagram Messaging API. Please read this policy carefully. If you do not agree with the terms of this policy, please do not use our services.

1. Information We Collect

We collect personal information when you interact with our website or services, including but not limited to:

• Account Information: Name, email address, and other details provided when creating an account on our platform.
• Social Media Data: If you choose to connect your Instagram/Facebook account with our services, we may collect your Instagram/Facebook user ID, messages, profile information, and any data permitted by Instagram/Facebook API.
• Usage Data: We collect information about your interactions with our website and services, such as IP addresses, browser type, and usage patterns.
• Device Information: Information about the device you use to access our services, including the type of device, operating system, and version.
• Marketing and Attribution Data: Information about how you found us and which advertisement, if any, brought you to our website. This includes the page you visited before signing up, the website that referred you, campaign labels contained in the link you followed, advertising click identifiers assigned by advertising platforms, and analytics identifiers. Where you create an account, these values are stored together with your account so that we can understand which marketing activities lead to registrations and subscriptions. See section 4.3 and 4.4 for details.

2. How We Use Your Information

We may use the information we collect for various purposes, including:

• Providing and improving our services: To facilitate communication through Instagram/Facebook Messaging API and to ensure the services operate as expected.
• Personalizing your experience: To tailor the content and features of our website or services to your preferences.
• Marketing and advertising: To measure the effectiveness of our advertising, to understand which channels bring us customers, to show our advertisements to people who may be interested in our services, and to avoid showing advertisements to people who are already our customers.
• Security and fraud prevention: To detect, prevent, and address technical issues, potential threats, or illegal activities.
• Compliance with legal requirements: We may use your information to comply with applicable laws, regulations, and legal processes.

3. Sharing Your Information

We do not sell or rent your personal data to third parties. We may share your information in the following cases:

• With service providers: We may share your data with third-party providers that help us operate our website, process payments, or provide services. These providers are obligated to maintain the confidentiality of your data.
• For legal reasons: We may disclose your information where necessary to comply with a legal obligation or a lawful request by a court, law enforcement, regulator or other competent public authority, including authorities in Ukraine or other jurisdictions and including in the context of criminal investigations. Where permitted, we limit and pseudonymize the data disclosed; where the law prohibits it, we may be unable to notify you of such a disclosure.
• Business transfers: If our business is merged, acquired, or sold, your information may be transferred as part of that transaction.
• With advertising and analytics partners: We share limited data with Google and Meta for the purposes described in section 4.4. This includes events describing actions you took on our website (for example, that a registration or a subscription payment occurred), the analytics and advertising identifiers associated with them, and, for the purpose of building and excluding advertising audiences, contact details such as your email address in an irreversibly hashed form. We do not share the contents of your account, your customers' data, or your order data with these partners.

3.1 Merchant Data and Roles

Where a vendor or dropshipper uploads or processes personal data about their own customers or recipients through MyDrop, that user acts as the data controller and MyDrop acts as a processor on their behalf. Such users are responsible for having a lawful basis for the processing and for informing their own customers. This does not prevent MyDrop from responding directly to lawful requests from competent authorities.

4.1 Your Data and Instagram

If you connect your Instagram account with our services:

• We will only collect and use data that is necessary to provide the requested services and in compliance with Instagram's terms of use.
• We will not use Instagram data for any purpose that is not explicitly stated in this policy or required for the functionality of our services.
• We will adhere to all policies and guidelines set forth by Instagram in the use of Instagram Messaging API.

4.2 Your Data and Facebook

If you connect your Facebook account with our services:

• We will only collect and use data that is necessary to provide the requested services and in compliance with Facebook's terms of use.
• We will not use Facebook data for any purpose that is not explicitly stated in this policy or required for the functionality of our services.
• We will adhere to all policies and guidelines set forth by Facebook in the use of Facebook Messaging API.

4.3 Cookies and Similar Technologies

We and our partners use cookies and similar technologies to operate the website, to remember your session, and to understand where our visitors come from. The cookies we set ourselves are:

• Session and preference cookies: Required to keep you signed in and to return you to the correct page after authorisation. The service cannot function without them.
• Attribution cookies (named lp and ref): Record the last page of our website you visited before signing up and the external website that first referred you. Stored for 90 days.
• Advertising click cookie (named gclid): Records the click identifier assigned by an advertising platform when you arrive from an advertisement. Stored for 90 days.
• Campaign cookie (named utm): Records the campaign label contained in the link you followed.
• Partner cookie (named p): Records the referral link of a partner who introduced you to us, so that the partner can be credited. Stored for 30 days.

In addition, Google and Meta set their own cookies through the tags embedded in our website, including analytics and advertising identifiers used to recognise a browser across visits. These cookies are controlled by those providers under their own privacy policies.

You can block or delete cookies through your browser settings. Blocking session cookies will prevent you from signing in; blocking analytics and advertising cookies does not affect the functionality of the service.

4.4 Analytics and Advertising

We use the following third-party services to measure the effectiveness of our website and our advertising:

• Google Analytics and Google Tag Manager, to understand how visitors use our website.
• Google Ads, to measure which advertisements lead to registrations and subscription payments, and to bid for advertising placements accordingly.
• Meta Pixel and Meta advertising services, for the same purposes on Facebook and Instagram.

Where you have created an account, we record the advertising click identifier and the analytics identifier that were present at the time of registration, and we store them with your account. We use them to report back to the advertising platform that a registration or a payment took place, including from our servers rather than from your browser. This allows us to attribute a payment to the advertisement that preceded it even when the original browser cookie is no longer available, for example because it has expired or because you completed the payment on a different device.

We may also provide advertising platforms with contact details, such as your email address, in an irreversibly hashed form, so that the platform can build audiences of people similar to our existing customers and so that we can exclude existing customers from advertising campaigns. Hashing is performed before the data leaves our systems, so the contact details are never transmitted to the platform in a readable form.

We do not use these services to make automated decisions that produce legal effects concerning you, and we do not provide them with the contents of your account, your products, your orders, or personal data about your own customers.

If you prefer not to be included in this processing, you can block the relevant cookies through your browser settings and use the advertising controls and opt-out mechanisms offered by Google and Meta directly, which apply across all websites rather than ours alone. Your rights in respect of the data we hold about you, including the right to object to or restrict processing, are set out in section 7.

5. Data Retention

We retain your personal information only for as long as it is necessary to fulfill the purposes described in this Privacy Policy unless a longer retention period is required or permitted by law.

We may retain certain data for a longer period where required to comply with legal obligations, resolve disputes, enforce our agreements, or preserve information in response to a lawful request from a competent authority.

The marketing and attribution data described in section 1 is recorded once, at the moment your account is created, and is retained for as long as the account exists, because it forms part of the record of how that account came to be. Where an account is deleted, this data is deleted with it. The corresponding browser cookies expire on their own within the periods stated in section 4.3.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, use, or disclosure. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you.
• Correction: You have the right to request corrections to any inaccuracies in your personal information.
• Deletion: You can request that we delete your personal information, subject to certain legal obligations.
• Objection or Restriction: You can object to or request that we restrict the processing of your personal data in certain situations.

To exercise these rights, please contact us at [email protected].

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you either through email or through a notice on our website.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

[email protected]