Privacy Policy

Last updated: September 2026

Privacy Policy at a glance

• Website visitors: marketing pages set no cookies, store nothing in the browser and make no requests to third parties. A first-party pageview beacon logs each visit. See Data Collected and Sign-in providers for the distinction between browsing and optional sign-in.
• Business accounts and client portals: account data supports sign-in and billing; client files, comments and checklists are processed for the Business. See Controller and Processor Roles.
• Retention and deletion: active account data, audit logs and disaster-recovery backups have different deletion paths. See Data Retention before deleting an account or exporting records.

Data Controller

The Service is operated by Ubique d.o.o., a company registered in Croatia, European Union.

• Registered seat: Kikićeva 7, 10000 Zagreb, Croatia
• Company VAT ID (OIB): HR 90787328659
• Privacy contact: privacy@droplana.com

In this policy, "droplana", "we", "us", and "our" refer to Ubique d.o.o.

Scope

This Privacy Policy explains how Droplana collects, uses, and stores personal data when you use the Service. It applies to Business accounts, their team members, Customers who access portals created by those Businesses, and visitors to droplana.com.

Controller and Processor Roles

• For Business account data (the account owner's and team members' details, billing identifiers, and our security logs), Ubique d.o.o. is the data controller.
• For the data a Business puts into Droplana about its Customers (client names and email addresses, files, comments, file statuses, checklists and signing records), the Business is the data controller and we act as its processor. Our Data Processing Agreement governs that processing. This is the usual setup for businesses that handle sensitive client documents, such as law firms and accounting practices. Customers who want to exercise their rights over this data should contact the Business that invited them.

Data Collected

We collect:

• Business accounts and team members: email address, business name and slug, session data, and magic link tokens (stored as SHA-256 hashes). If you sign in with Google or Microsoft instead of a magic link, we also store the provider name and the account identifiers that provider returns (for Microsoft: the issuer, account, directory and object identifiers, plus the email address shown on that account), so we can match you to your account on future logins. We never receive or store your Google or Microsoft password.
• Customers (portal users): the name and email addresses the Business enters for them. If a Customer signs in with Google or Microsoft, we store the provider name and account identifiers, as above, and for Microsoft also which of the Customer's email addresses that account was connected to. Portal sessions and remembered devices (90 days) are stored as tokens.
• Files and comments: files uploaded by the Business or the Customer, comments on those files, file statuses (Approved or Rejected), and document checklists.
• Portal activity: when a Customer last opened their portal, and per-file download counts with the first and last download time. Downloads from known bots are not counted; this filter is best-effort.
• Signing records: when someone signs a PDF in Droplana, we record the typed name, the email address they signed in with, the IP address, the time zone, the time, and a SHA-256 hash of the signed file. A public verification page, reachable through the QR code on the signed PDF, shows the signer's typed name, the business name and the signing time. It does not show the document.
• Billing-related identifiers: subscription IDs and invoice IDs received from Creem. We do not store payment card details - those are processed by Creem.
• Website visitors: the marketing pages set no cookies and store nothing in the browser. Each page view is logged with the page path, referrer, user agent, time, and an IP address shortened before it is written. See the Cookie Policy for details and for the necessary cookies the app uses.

How We Use Data

Data is used solely to provide and secure the Service: authenticating users, storing and delivering files, sending portal links, reminders and activity notifications, recording signatures, and showing Businesses when their Customers have engaged with shared content. We do not send marketing emails, and our emails contain no tracking pixels. We do not sell data to third parties and we do not train AI models on your data.

Data Processors

We use the following sub-processors. Each is subject to appropriate data processing agreements or other contractual arrangements required by applicable data protection law.

Service	Provider	Location	Notes
Server hosting	Hetzner Online GmbH	Germany (EU)	DPA available
PostgreSQL database	Hetzner Online GmbH	Germany (EU)	DPA available
S3-compatible object storage	Hetzner Online GmbH	Germany (EU)	DPA available
Transactional email	Brevo (Sendinblue SAS)	France (EU)	No customer file data stored
Payments (Merchant of Record)	Creem.io - Armitage Labs OÜ	Estonia (EU)	Subscription and invoice data only

GitHub, Inc. (US) hosts our source code only and processes no Customer Personal Data, so it is not a sub-processor under GDPR and does not appear in the table above.

Sign-in providers (Google and Microsoft)

Signing in with a Google or Microsoft account is an optional alternative to the email magic link. When you choose it, you authenticate directly with that provider, which tells us which account signed in (and, for Google, your verified email address) so we can log you in. Google and Microsoft act as independent identity providers under their own privacy policies - not as our sub-processors - and we do not send them your account data, your clients' data, or any files. This optional sign-in is separate from fonts: the marketing pages serve their own fonts, while the sign-in pages and the application still load fonts from Google's font service whether or not you choose Google sign-in. The identity providers do not appear in the sub-processor table above.

International Transfers

Customer files and the application database are hosted exclusively in the EU (Germany) and encrypted at rest. Hosting location does not restrict where authorized users open or download files; users can receive them outside the EU. Technical details are on our Security page. Brevo (email) and Creem (payments) are EU companies that process only the metadata their function needs - email addresses and billing/subscription details, never file contents. Where either uses a subprocessor outside the EU/EEA, GDPR transfer safeguards (Standard Contractual Clauses) apply.

Data Retention

Data is retained for as long as your account is active, subject to these limits:

• On the Free plan, each file is kept for up to 180 days after upload. This file-expiry rule does not close the account or expire clients and their portal access.
• A Business can set an expiry date on any file. Expired files are deleted.
• After a paid subscription is cancelled and its 15-day grace period ends, each file is kept until 90 days after the grace period ends, and never longer than 365 days after upload. An already earlier file expiry still applies. See the Refund Policy for the full cancellation terms.

You can export account data as JSON from Account settings. File downloads and the activity CSV export are separate. Account deletion irreversibly removes active account data, including stored files and signing records; it does not immediately remove audit-log entries or disaster-recovery backups. The audit-log period is described below. Backups are used solely for disaster recovery, are not user-accessible, and expire on the system-defined schedule of our infrastructure provider.

Audit and security logs

To operate the Service securely and meet our legal obligations, we keep logs on our EU infrastructure in three places. Your own activity trail is stored in our database and is described in the last section below. The audit log is a file-based record of security-relevant events. System logs are operational logs of the service. The audit log captures events across the following categories:

• Account: account and client deletion, and changes to account settings.
• Access and sharing: access-token creation and revocation, connected applications, and linked sign-in identities.
• Team: team-member invitations, additions, and removals.
• Billing: subscription and addon lifecycle events (linked, activated, canceled, updated, payment failed).

Each entry records the event type, a timestamp, the relevant account/object identifiers, and the originating IP address and user agent. We do not log file contents, comment text, passwords, magic-link or access tokens (these appear only as redacted placeholders), or payment card data.

The audit log is retained for 24 months and then automatically deleted. System logs record how the service runs and include failed sign-in attempts and rate-limit events, with the originating IP address; a separate error log records application errors. Both are retained for 6 months and then automatically deleted. Email addresses in rate-limit events are stored only as a short one-way hash. Because they exist as a security and legal-compliance record, they sit outside the account hard-delete described above: deleting your account removes your business and client data from our database and object storage immediately, while any log entries already written age out on the schedules above.

Your own exportable activity trail

The logs above are our internal security record and are not something you browse yourself. Separately, as the business owner you can view and export (CSV) your own activity trail - logins, portal visits, uploads, downloads, deletions, comments, approvals and due-date changes across your account - from Account → Activity, at any time. The trail is stored in our database for 24 months.

Your Rights

Under the GDPR you have the right to access, correct, delete, export, restrict, or object to processing of your personal data. Most rights can be exercised directly from your Account page. To make any other request, email privacy@droplana.com. We respond within 30 days.

You also have the right to lodge a complaint with your supervisory authority. For Croatia this is the Croatian Personal Data Protection Agency (AZOP).

Contact

For privacy enquiries or data subject requests, contact us at privacy@droplana.com.