Dropsheet Privacy Policy
Draft for counsel review. Effective date: 2026-10-01, or the date of publication if later.
Dropsheet, Inc. ("Dropsheet", "we", "us") provides financial reporting software and services to businesses. This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to dropsheet.ai, the Dropsheet application, and our services (together, the "Service").
Contact for anything in this policy: privacy@dropsheet.ai.
1. Who we are and our role
Dropsheet, Inc. is a Delaware corporation. When you use the Service on behalf of a business customer, that customer decides what data it uploads and why; Dropsheet processes that data on the customer's instructions under our agreement with them (the customer is the controller, Dropsheet is the processor). For information about visitors to our website and the account details of the people who use the Service, Dropsheet decides how the information is used (Dropsheet is the controller).
2. Information we collect
Account information. Name, work email address, job title, and the organization you belong to. Sign-in is handled by our identity provider; we do not store passwords.
Customer data. Files and records that your organization uploads or connects: general ledger extracts, trial balances, budgets, transaction lists, and the reports, narratives, and slides the Service generates from them. This data can include names of employees, vendors, and customers that appear in accounting records.
Usage information. Pages and features used, actions taken, timestamps, browser and device type, IP address, and error reports. We collect this through our own logs and an error-monitoring service configured not to capture personal data by default.
Communications. Messages you send us, including support requests.
We do not collect payment card numbers; invoicing is handled outside the Service.
3. How we use information
- To provide the Service: store your data, run the analyses you request, generate reports, and show results to the people in your organization who are authorized to see them.
- To operate the Service securely: authenticate users, enforce permissions, detect abuse, keep audit logs of data changes, and respond to incidents.
- To improve the Service: understand which features are used and where errors occur.
- To communicate with you about the Service, including security and service notices.
- To comply with law and to establish, exercise, or defend legal claims.
Automated analysis and AI. The Service uses large language models to classify uploaded records, map columns, write narratives, and answer questions about your data. Before any text is sent to a model provider, personal identifiers (names, email addresses, account identifiers) are masked. Model providers process the masked text to return a result and, under our agreements with them, do not use it to train their models. Outputs are shown to you as drafts for review; the Service does not make decisions with legal or similarly significant effects about individuals.
4. Who we share information with
We share information only with service providers that help us run the Service, each bound by contract to protect it and use it only for us:
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Application hosting | All data in transit through the application |
| Cloudflare | Network security, DNS, and file storage | Requests to the Service; uploaded files where object storage is used |
| Crunchy Data (Crunchy Bridge) | Managed database hosting | Account information and customer data at rest, encrypted |
| WorkOS | Sign-in and single sign-on | Name, email address, organization |
| Inngest | Background job orchestration | Job records with account and record identifiers |
| Sentry | Error monitoring | Error reports and request metadata, with personal data collection disabled |
| OpenAI and Anthropic | Language model processing | Masked text as described in section 3 |
We also disclose information when required by law, to protect the rights and safety of Dropsheet, our customers, or others, and in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to your information.
We do not sell personal information and do not share it for cross-context behavioral advertising.
5. International transfers
We are based in the United States and our providers process data in the United States. Where we receive personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on standard contractual clauses or an adequacy decision for the transfer.
6. Retention and deletion
We keep account information for as long as your organization has an account and for up to 90 days afterwards to allow reactivation, then delete it. We keep customer data for as long as your organization instructs us to; on request, or when the account closes, we delete it from our production systems and confirm the deletion. Copies in encrypted backups are retained for the backup retention period and are then overwritten; backups are not selectively edited. Audit logs that record what happened to data are retained for the period set in our Data Management Policy even after the data itself is deleted, because they are the record of the deletion.
7. Security
Data is encrypted in transit and at rest. Access to production systems is limited to named personnel, protected by multi-factor authentication, and reviewed quarterly. Every change to customer data is written to an audit log. We maintain an information security program aligned with SOC 2, an incident response plan, and a disaster recovery plan, and we test them. No method of transmission or storage is perfectly secure; if we learn of a breach affecting your personal information we will notify you and any authority as the law requires.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to how we use it, and to withdraw consent where we rely on it. To exercise these rights, email privacy@dropsheet.ai. If your information was uploaded by a customer organization, we will forward your request to that organization and assist them in responding, because they control it. You may also complain to your local data protection authority.
California residents: we do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information for purposes that would require a right to limit. You have the rights to know, delete, correct, and not be discriminated against for exercising them.
9. Cookies
The Service uses strictly necessary cookies for sign-in sessions and security (for example, the session cookie and a request-forgery token). We do not use advertising cookies. Our website may use a privacy-respecting analytics tool that does not track you across sites; where a consent banner is required, we show one.
10. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.
11. Changes
We will post changes here and update the effective date. If a change materially reduces your rights, we will notify account holders by email before it takes effect.
12. Contact
Dropsheet, Inc. privacy@dropsheet.ai
This policy is governed by the laws of the State of Delaware, without regard to conflict-of-law rules, except where the law of your place of residence gives you rights that cannot be waived.