Privacy policy
Last updated 16 October 2026
Draft: to be checked before Dropnote takes real payments.
This policy explains what information Dropnote collects, why, and your rights over it. “Dropnote”, “we” and “us” mean the operators of dropnotes.co.uk, who are the data controller for your information.
What we collect
- Account details: your name, email address and password (stored securely hashed by our login provider).
- Your study material: lecture files you upload, the study packs made from them, questions you add, and your exam dates and settings.
- Your activity: answers you give, scores, flashcard progress, short answers you submit for marking and questions you ask about your lectures.
- Payment details: handled by Stripe. We see your subscription status and the last details Stripe shares with us, never your full card number.
- Site usage: anonymous page-view statistics (Vercel Analytics). This doesn't use cookies or identify you personally.
Why we use it
- To provide the service you sign up for: making your study packs, marking your answers and tracking your progress (necessary to perform our contract with you).
- To take payments and manage your subscription (contract).
- To keep the service secure, prevent misuse and enforce fair-use limits (our legitimate interests).
- To understand how the site is used so we can improve it, using anonymous statistics (legitimate interests).
- To send emails about your account, such as sign-up confirmation and password resets.
We do not sell your data, use your uploads to advertise to you, or share your material with other users.
AI processing
Dropnote is AI-powered. When you upload a lecture, ask for an answer to be marked or ask a question about a lecture, the relevant material is sent to our AI provider, Anthropic, to generate the result. Anthropic processes it on our behalf and, under its commercial terms, does not use it to train its models. This processing may take place outside the UK, including in the United States.
Who processes your data for us
- Supabase: database, file storage and login.
- Stripe: payments and subscriptions.
- Vercel: website hosting and anonymous analytics.
- Anthropic: AI processing, as described above.
Some of these providers process data outside the UK. Where they do, they rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK-US data bridge.
How long we keep it
- Uploaded files are deleted as soon as your study pack has been made.
- Your packs, questions and progress stay in your account until you delete them or close your account.
- Payment records are kept for as long as the law requires for tax and accounting.
Your rights
You can ask to see, correct, export or delete your data, and you can object to or ask us to restrict how we use it. Deleting a module or pack in your account removes it straight away. To close your account and delete everything, email us. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Contact
dropbox101@gmail.com