Privacy Policy

1. Who we are

This Privacy Policy governs how we, Drool Limited and our affiliates ("Drool Client Management", "we", "our" or "us"), collect, use and store information about you ("User", "you"). Your privacy is important to us, and we are committed to a platform that meets a high standard of user privacy.

Drool Limited is a company registered in England and Wales under company number 12979799, with its registered office at 8 Sycamore Street, London, England, EC1Y 0SW. For any privacy question, or to exercise your rights, contact us at alex@drool.design.

"Personal Data" means any information that can be used, on its own or with other data, to identify a living individual. This policy explains our practices under UK data protection law (the UK GDPR and the Data Protection Act 2018) and, where it applies to you, the EU GDPR.

2. Scope of this policy

This policy describes how we process information we collect about or from you through our website at www.drool.management and the member hub (our "Digital Platforms" or the "Service"), and when you otherwise interact with us. By accessing or using the Service, you agree to this policy. If you do not agree with it, you may not use the Service.

3. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The latest version is always shown here, with the date at the top. If we make significant changes to how we use your Personal Data, we will notify you, for example by a notice on the Service or by email. Your continued use of the Service after a change means you accept the updated policy.

4. Information we collect

Account and application data: when you apply or create an account we collect credentials such as your email, name and password, and the information you give us about your studio, role and work. If you sign in via Google or Apple, we store the associated user ID and email address to verify your identity.

Billing data: if you take out a paid plan we collect details needed to process payment, such as your billing name and contact details. Our payment processor handles your card details. We do not store full card numbers, only limited information such as the last four digits, plan and payment status.

Content data: the quotes, projects, files, links, comments and other content you create in the Service, which may include personal data about your own clients that you choose to add.

Usage and log data: our servers log data each time a device accesses them, including pages visited, time spent, IP address, browser and device information and other usage metrics. This helps us monitor, troubleshoot, secure and optimise the Service.

How you found us: when you first arrive on our website we record the page you landed on, the site that referred you and any campaign tags or advertising click identifiers in the link you followed (for example from a Meta, Reddit or Google ad). If you go on to create an account, this is stored against it so we can see which of our advertising brings people to the Service.

5. How and why we use your data (legal bases)

To provide the Service: creating and running your account, delivering the tools, and letting you share work with your clients. Legal basis: performance of our contract with you (Article 6(1)(b) UK GDPR).

To take payment and manage your membership, including renewals, receipts and failed-payment recovery, and to meet our tax and accounting obligations. Legal basis: performance of our contract, and compliance with our legal obligations (Article 6(1)(c)).

To keep the Service secure, prevent fraud and abuse, and improve it. Legal basis: our legitimate interests in operating a safe, reliable product.

To communicate with you about your account, security and important changes; and, where you opt in, to send you product news, updates and marketing. Marketing is optional and based on your consent, which you can withdraw at any time.

To measure our advertising: to understand which campaigns and adverts lead people to sign up, start a trial or subscribe, and to report that back to the advertising platform that showed the advert (see section 7). Legal basis: our legitimate interests in advertising the Service effectively; where consent is required for the technologies involved, your consent.

6. Personal data about your clients

When you use the Service to quote, collect feedback from, or share work with your own clients, you decide what personal data about them to add. For that data you are the data controller and we act as your processor, handling it only to provide the Service to you and on your instructions. You are responsible for having a lawful basis and any permissions needed, and for giving your clients any privacy information they are entitled to. Our Data Management document explains where we act as controller and where we act as processor.

7. Cookies, analytics and advertising

Essential cookies: we use cookies that are necessary to run the Service, for example to keep you logged in, keep your session secure and remember choices you make in the hub. You can disable cookies in your browser, but this will stop parts of the Service working.

Attribution cookie: on our public website we set a small first-party cookie (drool_attr, kept for 30 days) recording the page you landed on, the referring site and any campaign tags or advertising click identifiers in the link you followed. It contains no name, email or other identifying information. If you create an account it is used once, to record how you found us, as described in section 4.

Product analytics: to see which parts of the hub help studios and where people get stuck, we record what you do in the hub (for example signing in, adding a client or sending a quote) against your account and send it to Mixpanel, our product analytics provider, together with your account id, name, email address, studio name, device type and browser. We don't send Mixpanel your IP address, the content you create in the Service, or anything about your own clients. This follows the same cookie choice as the tools below: if you choose essential cookies only, nothing is sent.

Analytics: we use Google Analytics on our public website and in the hub to understand usage and performance. Google may collect your IP address, device and browser type and activity metrics. You can opt out with Google's browser add-on (tools.google.com/dlpage/gaoptout) or by blocking third-party cookies.

Advertising measurement: we advertise on Meta platforms (Facebook and Instagram) and use the Meta Pixel on our public website and hub, together with Meta's Conversions API, so that Meta can tell us when someone who saw or clicked an advert goes on to create an account, start a trial or subscribe. The Pixel sets Meta cookies in your browser; the Conversions API sends Meta the event, your IP address and browser details, Meta's own browser and click identifiers, and your email address in hashed (one-way encoded) form so Meta can match it to an account you hold with them. We do not send Meta the content you create in the Service. You can control how Meta uses this data in your Facebook or Instagram ad settings. The client portal that your own clients use carries no analytics or advertising tags.

We also advertise on Reddit and use the Reddit Pixel on our public website and hub, together with Reddit's Conversions API, so that Reddit can tell us when someone who saw or clicked a Reddit advert goes on to create an account or subscribe. The Pixel sets Reddit cookies in your browser; the Conversions API sends Reddit the event, your IP address and browser details, Reddit's own browser and click identifiers, and your email address in hashed (one-way encoded) form so Reddit can match it to an account you hold with them. We do not send Reddit the content you create in the Service. You can control how Reddit uses this data in your Reddit account's privacy settings.

Your choice: the first time you arrive on one of our public pages we ask whether you accept all cookies or essential ones only, and remember your answer in a cookie (drool_consent) for a year. The analytics and advertising technologies above, including the server-side Meta and Reddit events and product analytics, run only if you accept all. To change your mind, delete that cookie in your browser and you will be asked again.

8. How we share your data

We do not sell your personal data. We share it with trusted service providers who help us run the Service, including our payment processor (Stripe), our transactional email provider, our hosting, database and authentication providers, and our analytics tooling, under contracts that require them to protect it.

For advertising measurement we share the limited data described in section 7 with Meta Platforms and Reddit (each as an independent controller of it under its own privacy policy), with Google (Google Analytics), and with Mixpanel, which processes product analytics on our behalf.

We may disclose personal data where required by law or in response to lawful requests by public authorities, which we validate before disclosing. In the event of a merger, acquisition or asset sale, your information may be transferred to the new entity, subject to the commitments in this policy.

9. International transfers

Some of our providers may process data outside the UK or EEA. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the International Data Transfer Agreement / Addendum, or Standard Contractual Clauses approved by the European Commission, so your data stays protected to UK/EU standards.

10. How long we keep it

We keep your Personal Data until we no longer need it, until you delete it, or until you send a valid deletion request, after which we securely delete or anonymise it. We may keep it for longer where required for legal, regulatory, tax or accounting reasons, to keep an accurate record of our dealings in case of complaints, or where there is a realistic prospect of litigation. Billing records are typically kept for at least six years.

11. Security

We implement technical, organisational and security measures designed to protect your data against loss, misuse, unauthorised access, disclosure, alteration and destruction, appropriate to the nature of the data and the risks involved. No system is completely secure, however, and we cannot guarantee absolute security or that data transmitted over the internet will not be intercepted. Your own security matters too: please keep your login details safe and use secure devices and networks.

12. Support access to your account

To help with a problem you report to us, or to investigate suspected abuse of the Service, an authorised member of our team may open your account and see the hub exactly as you see it, and may make changes on your behalf to resolve the problem.

Each support session requires a written reason, lasts no more than 30 minutes unless renewed, and is recorded in a log showing who opened your account, when, why, and every change made during it. Support sessions cannot change your password, your billing or subscription, or the members of your team, and cannot see your card details, which are held by our payment processor. You can ask us for the log of support sessions on your account at any time.

13. Your rights

Under UK (and, where applicable, EU) data protection law you have the right to: access the Personal Data we hold about you; have it corrected if it is inaccurate or incomplete; have it deleted in certain circumstances; restrict or object to how we use it; data portability; and, where we rely on consent, to withdraw that consent at any time. Some of these rights are subject to exemptions or limitations.

To exercise any of these rights, email alex@drool.design. We will respond within one month. We may ask for information to verify your identity, and in limited cases may charge a fee or decline where a request is manifestly unfounded or excessive or would affect the rights of others.

14. Children

The Service is intended for professional use by adults and is not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

15. Marketing and deleting your account

When you sign up you may choose to opt in to marketing communications (such as emails or product updates). This consent is optional and you can withdraw it at any time, by using the unsubscribe link, changing your settings, or emailing alex@drool.design. Transactional emails about your account (such as security, billing and support) are essential and cannot be opted out of.

If you would like us to permanently delete your account and associated data, email alex@drool.design. We aim to process deletion requests within 30 days, subject to any data we must retain by law.

16. Complaints and contact

If you believe your data protection rights have been infringed, you have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; if you are in the EU/EEA, your local data protection authority. We would appreciate the chance to resolve any concern first.

This Privacy Policy is effective as of the date shown at the top. Questions? Email alex@drool.design or write to Drool Limited, 8 Sycamore Street, London, England, EC1Y 0SW.