Privacy policy

Last updated 2 October 2026

This page explains what HyperDrop collects, why, who else sees it, and how to have it deleted. It describes what the app actually does today.

Who we are

HyperDrop is run by the HyperDrop team, based in the United Kingdom. We decide how your personal data is used, so we are its controller, and UK data protection law (the UK GDPR and the Data Protection Act 2018) applies.

For any privacy question or request, email okeatilade@gmail.com.

What we collect

Your account. If you sign in with Google, we receive your name, email address and profile picture from Google. If you don’t sign in, you use HyperDrop as a guest: we create an anonymous account with no name or email attached. Signing in later links Google to that guest account, so your brands come with you. Your crew setup (default garment, store layout, discount, sales tone and hand-off rule) is saved to your account.

Your brands. The idea you type, your answers and choices (audience, name, tagline, colours, product, price, sizes), the messages you send at each step, the research we run, the decisions made with you, and websites you give us as a reference. We also keep what we make for you: designs and images, store drafts, captions, launch videos and the record of your store build.

Connected stores. When you connect Shopify, we store your shop’s address, the access tokens Shopify gives us and the permissions you granted. When you connect Printify, we store your Printify access token and shop number. All of these tokens are encrypted before they are saved and are never sent back to your browser. Instagram and TikTok are linked on Upload-Post’s own page, so we never hold those passwords or tokens; we only see which accounts are linked.

Notifications. If you turn notifications on, we store your browser’s push subscription: an address at your browser’s push service and two keys used to encrypt messages to it. Your AI crew writes short notes (nudges) about your brand, and we record whether you have seen each one.

Buyers on your shop page. If a buyer uses the chat on a public shop page, we store their message, the reply, what the message was about, how much they hesitated on price, any discount code offered and whether they asked for a person. Links, email addresses and phone numbers are removed from the buyer’s message before it is stored. Buyers don’t sign in and we don’t ask for their name or contact details.

Security records. We use the IP address of everyone who uses HyperDrop, buyers included, to count requests, so one person or network can’t overload the service. An audit log records sign-ins, settings changes, store connections and disconnections, discount codes made by the shop chat and messages from Shopify, with the account id, session id, IP address and time. Our server logs record each request’s path, result and timing with a reference number and your account id; email addresses, phone numbers, tokens and keys are removed before a log line is written.

How we use it, and why we’re allowed to

We don’t sell your data, we don’t show ads, and we don’t use analytics or advertising trackers.

Who we share it with

We use these services to run HyperDrop. Each one gets only what it needs for its part.

Our server also fetches public web pages directly, such as competitor product pages and your own store’s product page. Those sites see our server, not you. We may also share data if the law requires it.

Design images and launch videos are stored at web addresses that are hard to guess but not secret: anyone with the link can open them. Shopify, Printify, Higgsfield and Upload-Post need to fetch them this way. Once you publish a store, its shop page on HyperDrop is public too.

International transfers

Several of these providers are based in, or process data in, the United States and other countries outside the UK. When your data leaves the UK, we rely on the safeguards those providers offer in their terms, such as standard contractual clauses with the UK addendum, or the UK extension to the EU-US Data Privacy Framework where the provider is certified.

How long we keep it

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to receive it in a portable format. You can object to uses based on our legitimate interests, and withdraw consent (such as for notifications) at any time. Email okeatilade@gmail.com and we will reply within one month.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put it right first.

Deleting your data

Email okeatilade@gmail.com from the address on your Google account. As a guest, send the link to your brand instead. We will delete your brands and everything attached to them (designs, videos, chats, nudges and store connections), your push subscriptions and your account. Audit log entries are kept, because they can’t be changed or removed once written. Products and posts already in your Shopify, Printify, Instagram or TikTok accounts stay there; remove them in those services.

A guest account lives in your browser. If you clear your browser data without signing in, you lose access to your guest brands, so email us if you want them deleted.

Cookies and local storage

We don’t use advertising or analytics cookies. We use only what the app needs to work:

You can clear all of this in your browser’s settings.

Children

HyperDrop is not for anyone under 18, and we don’t knowingly collect their data. If you think a child has used it, email us and we will delete their data.

How we protect it

Everything travels over HTTPS. The database only lets you read your own brands. Store tokens are encrypted before they are saved. Logs have personal details and secrets removed before they are written.

Changes to this policy

When HyperDrop changes what it collects or who it shares with, we will update this page and the date at the top.

Contact

The HyperDrop team, United Kingdom. okeatilade@gmail.com