Privacy policy

This policy explains what personal data dropquay collects, why, and what your rights are. It covers sellers who use dropquay and the end customers whose orders pass through it. Last updated 1 November 2026.

Who we are

dropquay is a trading name of Banana Box Group (to be confirmed), registered in England and Wales. For data protection law we are the controller of sellers' account data, and a processor of end-customer data that sellers pass to us to fulfil orders. Contact: privacy@dropquay.com.

Data we hold about sellers

• Account: name, email address, a hashed password (we never see the password itself), plan, and your activity in the dashboard.
• Payments: handled by Stripe. We store a Stripe customer reference and the brand and last four digits of your saved card, never the full card number.
• Sales channels: the access tokens the channel gives us when you connect it, encrypted at rest, so we can manage listings and orders on your behalf.
• Your products and designs: listings you create and any print-on-demand artwork you upload.
• Support: problem reports, photos you attach, and emails you send us.
• Technical: IP address, browser and device details from server logs, kept for security.

End-customer data we process for sellers

When one of your customers places an order, your sales channel sends us the order: the customer's name, delivery address, email, phone number and what they bought. We use it only to deliver that order: we pass the delivery details to the fulfilment partner handling it, add tracking to the order, and keep a record so problems can be resolved. We do not use customer data for marketing or share it with anyone else. We act on your instructions as your processor; you remain responsible for your customers' data under your own privacy policy.

Why we use data and our lawful bases

• To run your account and fulfil orders (performance of our contract with you).
• To take payments and prevent fraud (contract and legitimate interests).
• To send service emails such as order updates, dispatch problems, refunds and billing notices (contract). We only send marketing email if you opt in, and you can unsubscribe at any time.
• To keep the service secure and improve it (legitimate interests).
• To meet legal obligations, for example tax records.

Who we share data with

• Fulfilment partners (manufacturers, warehouses and print partners, in the UK, EU and Asia): the delivery name, address, contact details and items for each order, so it can be shipped. Where a partner is outside the UK, transfers are covered by the partner's contractual safeguards (UK IDTA or addendum) or by the fact that the transfer is necessary to perform the contract you have asked us to fulfil.
• Sales channels you connect (Shopify, eBay, TikTok Shop, Wix, WooCommerce, Square, Squarespace): product listings, stock and tracking information.
• Stripe for payments; Resend for sending email; our hosting provider for running the service.
• Anthropic for writing product listing copy from supplier product data. No seller or customer personal data is sent for this.
• Authorities where the law requires it.

We never sell personal data.

Data from Shopify and other channels

If you connect a sales channel, we only request the permissions needed to list products, read orders and add tracking. If a channel or one of its customers asks us to provide or delete the data we hold about that customer or store, we do so within 30 days, and automatically when a store uninstalls dropquay.

How long we keep data

• Seller account data: while your account is open and for up to 12 months after it closes, then deleted, except records we must keep for tax (6 years).
• Order and end-customer data: 24 months from the order, so problems and refunds can be handled, then anonymised.
• Channel access tokens: deleted immediately when you disconnect the channel or close your account.
• Problem-report photos: 12 months from the report.
• Server logs: 90 days.

Your rights

Under UK GDPR you can ask us to access, correct, delete or restrict the use of your personal data, to object to processing based on legitimate interests, and to receive your data in a portable format. Email privacy@dropquay.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk. End customers should contact the seller they bought from, who can instruct us.

Cookies

We use one strictly necessary cookie to keep you logged in, and short-lived cookies to secure the channel connection process. We do not use advertising or tracking cookies, so no cookie banner is needed. Your browser may also store small preferences, such as which filter you last used.

Security

Data is sent over HTTPS and stored encrypted; channel and supplier credentials are additionally encrypted with a key held only on our servers. Access is limited to staff who need it. If a breach ever affects your data we will tell you and the ICO as the law requires.

Changes

We will email sellers about material changes to this policy before they take effect.