Overview
aidrop.it is operated by AIDROP Technologies, Avenue "Solidarności" 117/615, 00-140 Warsaw, Poland — a company established in the European Union. This page explains how the General Data Protection Regulation (GDPR) applies to the Service: which data the Owner is responsible for as a controller, which it processes on a User's behalf as a processor, where that data lives, who else touches it, what protects it, and how a person exercises their rights.
It complements the Privacy Policy, which lists every processing activity in detail, and the Terms and Conditions, which govern the contract. Where the documents overlap, the Privacy Policy governs data protection and the Terms govern the contract.
The Service is a Project Workspace: a connected source repository, scoped access for an AI coding agent, and managed hosting for the application. Each of those brings personal data with it, and the Owner is not responsible for all of it in the same way.
Two roles, and which one applies
Under the GDPR a company is a controller when it decides why and how personal data is processed, and a processor when it processes data on somebody else's instructions. The Owner is both, for different data.
| The Owner is a controller for | The Owner is a processor for |
|---|---|
| Account and Team records: email addresses, names where given, sign-in identifiers, roles and invitations | Source code and repository contents the User connects |
| Billing and subscription records, and the notices sent about them | Runtime values the User enters for an application |
| Audit and action logs: who did what, from which address, and when | Data stored in a managed database, cache or queue, and the logs an application writes |
| Website usage and advertising measurement, after consent | Personal data of the User's own end users, received by an application the User deploys |
| Support conversations and abuse reports |
For the right-hand column the User — or the organisation the User's Team belongs to — is the controller. The Owner processes that data only to provide the Service, as the Terms and the User's own configuration instruct, and uses it for no purpose of its own. This page describes the processing. It does not replace any data processing agreement applicable to the relationship between the User and the Owner.
What the Owner processes as a controller
| Activity | Data | Legal basis | Kept for |
|---|---|---|---|
| Providing an account and a Team | Email address, name where given, password hash, sign-in provider identifiers, Team membership and role | Contract — Art. 6(1)(b) | The life of the account; deleted on request |
| Billing | Plan, subscription status, invoices, and the customer identifier held by the payment provider | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) | For the applicable statutory accounting and tax retention periods, calculated according to the type of record and obligation |
| Transactional email | Email address, Team name, the notice sent — an invitation, a billing or hosting notice | Contract — Art. 6(1)(b) | As long as the account exists |
| Security, abuse prevention and audit | IP address, User-Agent, the action taken, timestamps; edge and application logs | Legitimate interest — Art. 6(1)(f): keeping the Service and the other Users safe | Audit and action logs for the life of the Team; server logs rotate at configured size limits, so their lifetime depends on traffic volume |
| Website analytics and advertising measurement | Device information, session statistics, masked session recordings, an advertising click identifier | Consent — Art. 6(1)(a), given in the cookie banner and withdrawable there at any time | Amplitude events and session replay: seven days. Google measurement records follow the applicable Google product retention settings. Withdrawal stops new optional collection; requests to erase existing personal data can be sent to the Owner. |
| Error monitoring | The request that failed, the account it belonged to, stack traces | Legitimate interest — Art. 6(1)(f): keeping the Service working | Seven days |
| Support and abuse reports | What the User or the reporter sends, and the address it came from | Contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) | As long as needed to handle the matter and any follow-up |
What the Owner processes on a User's behalf
Everything a User puts into a Project is processed on the User's instructions, which are the Terms together with what the User configures. In practice the Owner builds a connected repository at the revision the User authorises, and runs the application and the backing services behind it. The Service does not send a User's content to an AI provider. It does not read a User's content for any other reason, and it does not train machine-learning models on it.
- Retention and deletion. Data is held to operate the User's Project until it is removed through the relevant controls or a deletion request. Archiving a Project removes its backing services and their data; archiving an individual Service is not deletion of all Project or repository records. Stopping unpaid hosting or suspending a Team does not itself trigger a fixed 30- or 60-day deletion schedule. The Terms explain these lifecycle events. Contact info@aidrop.it for export or deletion assistance. Records needed to meet a legal obligation or handle a legal claim may be retained for that purpose.
- Daily snapshots. The Owner takes daily snapshots and retains them for seven days. A deleted record may remain in an existing snapshot until it expires. Snapshots do not guarantee restoration of deleted data. Users should export data they need before deletion.
- End users. A User who deploys an application that collects personal data is the controller for the people it collects from. The User is responsible for their privacy notice and their legal basis, and may rely on the Owner only as a processor. The Owner has no relationship of its own with a User's end users and does not use their data.
Where the data lives
The core of the Service — the control plane, the runtime servers on which Users' applications and managed databases run, the build servers, the Git hosting and the container registry — runs on servers in the Netherlands, rented from LeaseWeb and operated by the Owner. Some parts of the Service are provided by other companies, listed below.
Service providers and recipients
| Provider | What it does | What reaches it | Location |
|---|---|---|---|
| Supabase, Inc. | Managed PostgreSQL and authentication behind the control plane | Account and Team records, connector tokens | European Union (Frankfurt, Germany); company in the United States |
| Cloudflare, Inc. | Proxy and edge in front of app.aidrop.it, api.aidrop.it and docs.aidrop.it. The public site at aidrop.it is served directly from the Owner's servers. | Every request to those hostnames, including IP addresses | Global network; company in the United States |
| Paddle.com Market Ltd | Merchant of Record: checkout, invoicing, taxes and payment processing | Billing name, email address, plan; payment details, which the Owner never holds | United Kingdom, with processing in the United States |
| Functional Software, Inc. (Sentry) | Error monitoring | Failed requests, the account they belonged to, stack traces | United States |
| Amplitude, Inc. | Product analytics and session replay, after consent | Device information, usage events, masked session recordings | European Union, under EU data residency |
| Google Ireland Limited | Google Analytics 4 and Google Ads conversion measurement, and Google sign-in where chosen | After the corresponding consent: analytics events, or advertising click identifiers and conversion events (including email matching at signup). No Google measurement tag loads before an optional purpose is accepted. Google sign-in processes identity when chosen separately. | Ireland, on Google's global infrastructure |
| GitHub, Inc. | Repository access through the aidrop GitHub App, and GitHub sign-in where chosen | The repositories the User authorises; sign-in identity | United States |
| Zoho Corporation | Transactional email: invitations, billing and hosting notices | Email address, Team name and the notice | European Union data centre |
| Crisp IM SARL | Support chat inside the dashboard | What the User writes in the chat, with their email address and name | France |
An AI tool the User connects to a Project — Claude, ChatGPT, Codex, Cursor, or any other client speaking the Model Context Protocol — is not a sub-processor of the Owner. The User chooses it, the content it reads is sent at the User's request, and the tool's provider processes it under its own terms.
Providers have different roles. Some process data on the Owner’s behalf; others, including a Merchant of Record and chosen sign-in providers, may also act as independent controllers for their own purposes. Their applicable terms determine those roles. The list is reviewed when the Service changes.
Transfers outside the European Economic Area
Where a provider listed above processes data outside the European Economic Area, the transfer rests on the European Commission's Standard Contractual Clauses contained in that provider's data processing terms, or on the EU-US Data Privacy Framework where the provider is certified under it. Users may ask the Owner which safeguard applies to a given provider.
Security measures
The Service uses access controls, encrypted connections and isolated application runtimes. Users remain responsible for their application code, permissions and the personal data they collect.
- Every connection to the Service is encrypted in transit. Certificates are issued and renewed automatically, and a name serves nothing until it is proved.
- Runtime values a User enters for an application are encrypted at rest under a key held only by the control plane. They are never returned to anyone — not to the dashboard that set them, not to an agent — and are decrypted only for a deploy.
- Every record carries the Team it belongs to, and every read and write is checked against it, so one Team cannot reach another's data. An agent's grant resolves exactly one Team — the Projects in it, and nothing wider — and what it may do there is the role of the person who approved it.
- Each Project's application runs in a private network of its own, on a read-only root filesystem. The step that builds a User's code holds no credential of the Owner's, and a runtime server stores no platform credential at all.
- A deployed application answers at a public address from its first deployment, reachable by anyone who has the address.
- Every action taken through the dashboard or by a connected agent is written to an audit log the Team can read.
- Payment card details never reach the Owner; the payment provider holds them.
Daily snapshots are retained for seven days. They support recovery operations but do not provide a guaranteed undo for deletion. Users can also export their databases.
If something goes wrong
For data processed as a controller, the Owner notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach, unless it is unlikely to result in a risk to people’s rights and freedoms. Where notification is delayed, the reasons accompany it. Affected people are informed without undue delay where the breach is likely to create a high risk, subject to the exceptions in Article 34. For data processed on a User’s behalf, the Owner notifies that User without undue delay after becoming aware of a personal data breach, so the User can meet their controller obligations.
Your rights, and how to use them
Any person whose personal data the Owner holds as a controller may:
- access it, and learn how it is processed and with whom it is shared;
- rectify it — account details can also be changed in the dashboard;
- erase it, subject to what the Owner must keep by law, such as billing records;
- restrict its processing while a dispute about it is settled;
- object to processing based on legitimate interest, and to direct marketing at any time;
- receive it in a structured, machine-readable form, and have it transmitted to another controller where technically feasible;
- withdraw consent at any time, for the processing that rests on it — analytics and advertising measurement, through Cookie preferences in the public-site footer or the button in the application;
- complain to a supervisory authority.
Write to info@aidrop.it with the right you are exercising in the subject line; the links under Your data at the bottom of this page open a prepared message. Requests are normally free and are answered without undue delay, within one month. Where the complexity or number of requests requires it, the period may be extended by up to two further months; the Owner informs the requester of the extension and reasons within the first month. Manifestly unfounded or excessive requests are handled as permitted by Article 12(5). The Owner may ask for enough information to be sure the request comes from the person it concerns.
For data the Owner processes on a User's behalf — a repository, or the records of an application a User deployed — the request belongs to that User, who is the controller; the Owner will assist them in answering it.
The supervisory authority for the Owner is the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl. A person may also complain to the authority of the member state where they live or work.
Automated decisions
The Service makes no automated decision about a natural person in the sense of Article 22. A build either succeeds or reports why it failed, which is a statement about code, not about a person, and a person can always be reached about it. Advertising personalization is disabled in the website’s Google consent settings. Optional measurement is described in the Cookie Policy.
Age
The Service is for adults: Users must be eighteen or older, as the Terms say. The Owner does not knowingly offer accounts to children. Personal data within a User’s application is processed on that User’s instructions; the User is responsible for any rules concerning children’s data in that application.
Contact
The Owner has not appointed a Data Protection Officer. Questions about this page, or a request under it, go to info@aidrop.it with "GDPR" in the subject. The postal address is at the top of the page.
Changes to this page
The Owner updates this page when a sub-processor, a location or a practice changes. The date of the latest update is shown at the top. A change that affects processing based on consent is put to Users for new consent where the law requires it.