1. Scope of this policy
This policy covers the FaveDrop apps, websites and support channels. It explains what we collect, why we collect it, who receives it and how long we keep it.
Merchants and payment providers also process some of this data as independent controllers under their own privacy policies, for example to fulfil your order or to run a payment.
2. What we collect
- Account data: name, phone number, email address, preferred language and city.
- Order data: items, amounts, delivery address, contact details, notes for the merchant, and your order history.
- Payment data: the method used, the status, and a reference from the payment provider. We never store full card numbers or wallet credentials.
- Device and usage data: device type, app version, IP address, crash reports and which pages you viewed.
- Location data: only while you are choosing a delivery address or following a live order, and only with your permission.
- Support data: the messages, call records and attachments you send us.
3. Why we use it
- To create and secure your account and verify it by one-time code.
- To take, route and fulfil your order, and to pass what is needed to the merchant and the courier.
- To take payment, detect duplicate charges and process refunds.
- To provide support and keep a record of what was agreed with you.
- To detect fraud, abuse and automated attacks against the platform.
- To meet accounting, tax and consumer protection obligations.
- To send service messages about your orders. Marketing messages are sent only where you have opted in, and you can opt out at any time without losing access to the service.
4. Who we share it with
- The merchant you order from, which receives the items, your delivery address and the contact details needed to fulfil the order.
- The courier assigned to your delivery, which receives the address, your first name and a masked phone number.
- Payment providers, which process the transaction and return its status to us.
- Cloud hosting, messaging and analytics providers acting on our instructions under a written contract.
- Authorities, where disclosure is legally required, and only to the extent required.
- We do not sell your personal data, and we do not share it with advertisers for their own purposes.
5. International transfers
Our infrastructure may process data outside the country you order in. Where that happens we rely on transfer safeguards recognised by the applicable law, restrict access to staff who need it for their role, and require the same protection from our processors as we apply ourselves.
6. How long we keep it
- Order, payment and refund records: kept for the period local tax and commerce law requires, typically five to ten years.
- Account data: kept while your account is open, then deleted or anonymised within 90 days of closure, except where a retention obligation applies.
- Support conversations: 24 months. Device and security logs: 12 months.
7. Your rights
- Get a copy of your data, correct it, delete it, restrict or object to a particular use, and receive an export in a portable format.
- Withdraw a consent you gave, such as location access or marketing, without affecting processing already carried out.
- Complain to the data protection authority of your country.
- Make a request in account settings or by writing to privacy@favedrop.net. We respond within 30 days and may first ask you to verify your identity, so that nobody else can request your data.
8. Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to hold your basket, and optional analytics cookies to understand how the service is used. You can manage the optional ones in settings. Strictly necessary cookies cannot be switched off without breaking sign-in and checkout.
9. Children
The service is not intended for people under 17, and we do not knowingly collect their data. If we find that an account belongs to a child we close it and delete the data, except records we are required to keep.
10. How we protect it
Data is encrypted in transit. Sign-in credentials and payment secrets are never stored in readable form, and access to production data is limited to named staff, logged and reviewed. If a breach affects you, we notify you and the regulator within the deadline the law sets.
11. Changes to this policy
The revision date at the top of this page always reflects the current version. Material changes are announced in the app before they take effect so that you can review them.
12. Contact
Questions about this policy or about your data: privacy@favedrop.net. General support: support@favedrop.net.