Privacy Policy

Clickdrop is an AI product-photography service operated by an individual creator based in Indonesia. This Privacy Policy explains what information Clickdrop collects when you use our service, how we use that information, who we share it with, and the rights you have over your own data.

For the purpose of this Privacy Policy, “Personal Information” means any information relating to an identified or identifiable individual. We obtain Personal Information about you from your direct interactions with Clickdrop and, in some cases, automatically as you use our service.

Where applicable, we explain why we collect a particular piece of information. If you choose not to provide information we ask for, some features of Clickdrop may not be available to you.

Information you provide to us

When you create a Clickdrop account, we collect your name, email address, and either a password (which we store in encrypted form) or a Google Sign-In identifier if you choose to sign in with Google. You may also upload a profile picture, or one is provided automatically if you sign in with Google.

When you use Clickdrop to generate product photos, we collect the product images you upload, the template or settings you choose, and the prompt sent to our AI model to produce your result. Our system also generates a short AI-written description of your product to help produce better results, and we store this alongside your generation. The generated output image is saved to your Gallery so you can access it later.

When you use tools like Background Remover or White Studio, we collect the images you upload and the results produced by those tools, along with basic usage records.

When you purchase credits, we collect your name and email, the amount you paid, and the number of credits you received. All actual payment processing — including your card details — is handled by Paddle, our payment processor. Your card number is never sent to or stored by Clickdrop.

If you contact us for support or send us feedback, we receive whatever information you choose to include in that communication.

Information collected automatically

When you visit clickdrop.io, some information is collected automatically to make the service work and to help us improve it. Session cookies are used to keep you logged in as you move between pages. Basic technical logs are recorded by our hosting provider (Vercel) and used for debugging and monitoring — these include information like which pages loaded, when errors occurred, and standard web request data.

If you accept our cookie banner, Google Analytics collects anonymized information about your visit, such as which pages you view, roughly where you’re visiting from, what device you use, and how you move through the site. If you reject the cookie banner or close it without choosing, no analytics data is collected and no analytics cookies are set.

We use the information we collect for a limited set of purposes, all related to providing and improving Clickdrop. If we ever want to use your information for a purpose not described here, we’ll ask you first.

Providing the service

Most of the information we collect exists so Clickdrop can do what you signed up for. Your uploaded product photos are sent to our AI provider (Fal.ai) so the AI can generate new images based on them, following the prompt and template you selected. Your generated images are stored so you can view them in your Gallery. Your credit balance and generation history let us track what you’ve used and what you have left. Without this information, Clickdrop cannot function.

Account management and communication

We use your email and password (or Google Sign-In) to authenticate you and let you recover your account. Your name and profile picture appear in the app so you can recognize your own account. We send transactional emails when they’re directly related to your account — account confirmation when you sign up, password reset when you request one, and confirmation when you delete your account or make a purchase. These emails are sent through Resend, our email service provider.

In the future, we may send optional marketing emails about new features, promotions, or Clickdrop updates. Marketing emails will only be sent to users who explicitly opt in, either at signup or from account settings. Every marketing email will include an unsubscribe link, and unsubscribing takes effect immediately.

Payments and refunds

When you purchase credits, we use your payment information to process the transaction through Paddle, verify the payment succeeded, and update your credit balance. We keep records of your purchases so we can honor refund requests, resolve billing disputes, and provide receipts. We do not use your payment history for marketing purposes.

Improving Clickdrop and keeping it safe

If you’ve accepted cookies, we use Google Analytics to understand how people use Clickdrop — which features are used, where users encounter friction, and what devices they visit on. This helps us decide what to build and improve. If you haven’t accepted cookies, none of this happens for your visits.

We use technical logs from Vercel to debug errors, monitor performance, and detect abuse of the service. These logs may contain image URLs, prompts, user IDs, and standard web request data. Logs are used for operational purposes only, not for building user profiles or marketing databases.

What we don’t do with your data

We do not sell your personal information to anyone. We do not share your data with advertisers. We do not use your uploaded product photos to train AI models, and both our AI providers (Fal.ai and Anthropic) have contractually committed not to train their models on customer inputs. We do not use your product photos or generated images in Clickdrop’s marketing or website without your explicit permission.

Running an AI product-photography service requires several specialized providers. We call these providers “processors” — companies that process data on our behalf under contract. We remain responsible for your data even when a processor handles it, and we choose our processors carefully.

Data infrastructure

Supabase handles Clickdrop’s database and authentication. Your account details, credit balance, generation history, and app data are stored in Supabase’s infrastructure, which runs on AWS servers in Sydney, Australia (AWS ap-southeast-2 region). When you delete your account, Supabase deletes all associated records immediately.

Cloudinary stores the images you upload — product photos, tool inputs, and profile pictures. Cloudinary is GDPR-compliant, and does not use uploaded content for any purpose other than storage and delivery to Clickdrop. Because of how our image processing pipeline works, uploaded images are stored at public Cloudinary URLs; these URLs are not indexed by search engines and are not shared outside our system. When you delete your account, we call Cloudinary’s delete API to remove every image you uploaded.

Vercel hosts Clickdrop’s website and application. Every page load and API request passes through Vercel’s infrastructure, and their systems record technical logs used for debugging. These logs may include image URLs, prompts, user IDs, and standard request data. Vercel retains logs according to their standard policy.

AI providers

Fal.ai runs the AI models that generate your product photos. When you click Generate, we send your product photo URL, the template reference, and a prompt to Fal.ai’s infrastructure, which returns the generated image. Generated images are hosted on Fal.ai’s CDN. Fal.ai’s Terms of Service state that customer inputs are not used to train AI models. When you delete your account, we use Fal.ai’s Platform API to delete the generated image files.

Anthropic provides the Claude AI model, which Clickdrop uses to analyze uploaded product photos and generate short descriptions that help our system produce better results, to check the quality of generated images, to detect product orientation in some tools, and to power the in-app support chat if you use it. Anthropic’s Commercial Terms of Service state that Anthropic does not train models on customer content sent through the commercial API. Anthropic’s default policy is to automatically delete API inputs and outputs within 30 days.

Payments

Paddle processes all payments for Clickdrop. Paddle acts as our Merchant of Record, which means Paddle handles your card details, sales tax, fraud prevention, and payment compliance directly. When you buy credits, Paddle collects your name, email, billing information, and payment method; Clickdrop only receives confirmation that a payment succeeded and the amount. Payment records may be retained by Paddle even after you delete your Clickdrop account, as required by tax and financial regulations.

Communication and analytics

Resend sends the emails Clickdrop dispatches to your inbox, including account confirmations, password resets, receipts, and (if you opt in) marketing emails. Resend receives your email address and the content of each message.

Google Analytics collects anonymized analytics data about your visits to clickdrop.io, but only if you accept our cookie banner. Google Analytics receives standard analytics data such as page views, session duration, device type, and approximate geographic region based on IP address. It does not receive your Clickdrop account details, uploaded images, or generation history.

If you choose to sign in with Google Sign-In, Google verifies your identity and provides Clickdrop with your email, name, and profile picture URL. Google’s use of this information is governed by their own privacy policy.

International data transfers

Most of our processors are US-based (Cloudinary, Fal.ai, Anthropic, Vercel, Google, Resend), while Paddle operates from the UK and US, and Supabase hosts our project in Sydney, Australia. If you’re located in the European Union or another region with cross-border data transfer requirements, your data may be transferred outside your region as part of using Clickdrop. Our processors that handle EU user data use Standard Contractual Clauses (SCCs) or equivalent legal mechanisms for cross-border transfers where required.

If we add a new processor that receives your personal data or replace an existing one, we will update this policy and notify users of significant changes.

You have significant control over the personal information Clickdrop holds about you. Most of these rights come from data protection laws such as the EU’s General Data Protection Regulation (GDPR), Indonesia’s Personal Data Protection Law (UU PDP), and California’s Consumer Privacy Act (CCPA). We honor these rights for all Clickdrop users regardless of where you’re located.

You have the right to access the personal information we hold about you, and the right to receive a copy of that information in a portable format. You have the right to correct inaccurate data — most account information can be updated directly in your settings, and for anything else, you can email us. You have the right to delete your account and associated data, which you can do at any time from your account settings, and the right to restrict or object to specific uses of your data.

You also have the right to complain to a data protection authority if you’re not satisfied with how we handle your data — in the European Union, that’s your national DPA; in Indonesia, the Kementerian Komunikasi dan Digital (Komdigi); in California, the California Privacy Protection Agency. We’d prefer you raise concerns with us directly first so we can try to fix them, but you’re always free to go to a regulator.

To exercise any of these rights, email us at clickdropcorp@gmail.com from the address associated with your Clickdrop account. We respond within 30 days at the outside, though most requests are handled within a few business days. Exercising your rights is free, and we may ask you to verify your identity for sensitive requests like data deletion or export.

When you delete your Clickdrop account — either through your account settings or by emailing us — we delete your database records, your uploaded images from Cloudinary, your generated images from Fal.ai’s infrastructure, and your authentication record from Supabase. This happens automatically and immediately, not as a delayed background job.

A small amount of information survives account deletion, and we want to be transparent about what and why. Your email address is retained on our signup-credit deduplication list, which prevents abuse of promotional credits — this list holds only your email, not other data. If you’d like your email removed from this list too, email us. Payment records held by Paddle may be retained as required by tax and financial regulations, governed by Paddle’s own policy rather than ours. Anonymized analytics data (if you had accepted cookies) remains at Google Analytics but cannot be traced back to your identity. Technical logs at Vercel are cleared according to their standard log rotation. If we’re required by law to retain specific data, we retain only what’s specifically required and for only as long as required.

Clickdrop uses two categories of cookies. Essential cookies keep you logged in and are required for the service to function — these are always set when you use Clickdrop. Analytics cookies are set by Google Analytics only if you click Accept on our cookie banner on your first visit. If you reject the banner or close it without choosing, no analytics cookies are set and no analytics data is collected.

You can change your cookie consent at any time by clearing cookies for clickdrop.io in your browser settings. The banner will reappear on your next visit, and you can make a different choice.

We take reasonable measures to protect your data through our choice of processors, secure authentication, and standard security practices. However, no online service can guarantee absolute security. If Clickdrop experiences a data breach that affects your personal data, we will notify you by email within 72 hours of discovering the breach, tell you what data was involved and what steps we’re taking, and notify relevant data protection authorities as required by law.

Clickdrop is operated by an individual creator based in Indonesia. You can reach us at clickdropcorp@gmail.com for any questions about this policy or your data. Clickdrop is the data controller responsible for your personal data under this policy.

This Privacy Policy is governed by the laws of the Republic of Indonesia. If your local consumer protection laws give you the right to bring claims in your own jurisdiction, we respect that right. We honor privacy rights under applicable data protection laws including GDPR (EU), UU PDP (Indonesia), and CCPA/CPRA (California), regardless of where you’re located.

You must be at least 13 years old to use Clickdrop, and at least 18 (or the age of legal majority in your jurisdiction) to make a purchase. We don’t knowingly collect data from children under 13. If you believe a child under 13 has created a Clickdrop account, please email us and we’ll delete the account promptly.

We may update this Privacy Policy from time to time as Clickdrop grows and changes. For minor updates such as clarifications, typo fixes, or the addition of new processors, we’ll update the “Last updated” date at the top of this policy. For significant updates that change how your data is used or shared, we’ll notify you by email at least 14 days before the changes take effect and post a notice in the app. For updates that require new consent, we’ll ask you specifically before the change applies to your account. We won’t make retroactive changes to how we handle data you’ve already provided without giving you a chance to review the new policy first.