DropMerch provides online shops, memberships and digital sales for independent creators. This policy explains what personal data we handle when you use dropmerch.store, a shop hosted on it (a *.dropmerch.store address or a creator's own domain), or our emails. We process personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).
Creators decide how they run their shops. For data a creator collects through their shop (for example their own mailing list), the creator is responsible for how they use it, and their shop's privacy policy also applies.
1. What we collect
- Account details: your name, email address and password (stored only as a hash). If you choose "Continue with Google" or "Continue with Apple", we receive your name, email address, whether the email is verified and your profile picture from that provider. We do not receive your Google or Apple password, contacts, files or any other account data.
- Shop details: the shop name, social links, products, designs and settings a creator enters.
- Orders and memberships: buyer name, email, shipping address, phone (optional), items bought, membership tier and messages or comments you post.
- Payments: card, FPX and GrabPay payments are processed by Stripe. We receive the payment status and the last four card digits, never the full card number.
- Technical data: IP address, browser type and session cookies needed to keep you signed in and to protect accounts from abuse.
2. How we use it
- To create and secure your account, and to sign you in (including with Google or Apple when you choose that).
- To run shops: take orders, print and ship products, deliver downloads and give members access to their perks.
- To process payments, refunds and creator payouts.
- To send service emails such as order confirmations, password resets and membership receipts.
- To prevent fraud and abuse, and to meet legal and tax obligations.
3. Google user data
When you sign in with Google we request only the basic profile scopes (openid, email and profile). We use that data solely to create your DropMerch account, sign you in and show your name and picture inside DropMerch. We do not use Google user data for advertising, we do not sell it, and we do not share it with third parties except the service providers listed below that host our application.
DropMerch's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. How long we keep it
We keep account data while your account is open. Order and payment records are kept for seven years to meet Malaysian tax and accounting rules. Other data is deleted or anonymised within 90 days of account deletion.
6. Your choices and rights
You can view and update your account details in your account settings, unsubscribe from marketing emails with the link in each email, and ask us to access, correct or delete your personal data by emailing hello@dropmerch.store. You can also remove DropMerch's access to your Google account at any time from your Google Account's security settings.
7. Security
Data is encrypted in transit (HTTPS) and at rest with our providers. Passwords are hashed, payment card details never reach our servers, and staff access to personal data is limited to what is needed to provide support.
8. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.
Questions about this policy? Email hello@dropmerch.store.