Privacy Policy

Last updated: August 27, 2026

This page explains what data is processed when you use DropPanel ("we", "us"), where it is stored, who it is shared with, and your rights over it. DropPanel is an operations panel for Amazon sellers — shipment tracking, accounting and returns management — served at app.droppanel.net. For any question, write to support@droppanel.net.

1. Two kinds of data, two different roles

• Your account data (your email address, account settings, support conversations): for this data, we act as the data controller.
• The business data you enter into the panel (orders, tracking numbers, sales and expense records, return records, customer messages): this data belongs to you. It may contain personal data of your customers (for example, a customer name on a return record). For that data you are the controller and we act only as a processor on your instructions. Informing your customers is your responsibility.

2. What data we process

When you create an account

• Email address and password (your password is stored only as a cryptographic hash; it is never stored or visible in plain text).
• A name and company name, if you choose to add them.

When you use the panel

• Order and shipment records: order number, product code (ASIN), tracking numbers, carrier, shipment events and locations, delivery dates.
• Accounting records: sale amounts, costs, expenses, exchange-rate information.
• Return records: reason, amounts, and — if you enter them — the customer name and return label files.
• Customer service records: customer messages you paste into the panel and your replies.
• Reminders, notes, settings and store definitions.
• Support records: your Contact Us conversations, and your phone number if you request a callback.
• Notification subscription: if you enable phone notifications, the push endpoint of your device and its timezone offset (so quiet hours are applied at the right local time).

On the marketing site (droppanel.net)

• We use no cookies. Visit measurement is done without storing IP addresses; only aggregate figures such as page views, country-level location and scroll depth are kept, and they are never linked to your identity.

3. What we use the data for

• Providing the service: tracking your shipments, computing your accounting, managing your returns, sending notifications.
• Answering your support requests.
• Keeping the service secure and reliable (error logs, abuse detection).

What we do not do: we do not sell or rent your data, do not profile you for advertising, and do not share your data with third parties for marketing. We do not use the business data you enter for our own commercial purposes.

4. AI features

The AI features in the panel (event translation, status reports, reply drafts and similar) run on a language-model provider: Anthropic (USA). We follow these principles:

• Only the data a given job needs is sent. In most features the order number, the customer's name and the amounts are never sent; in the data-fix feature only the shape of a tracking number is sent, not the number itself.
• When you use message translation or reply drafting, the content of the message you pasted is transmitted to the provider for processing.
• Under the provider's service terms, this content is not used to train its models; the provider may retain it only for a limited period for abuse monitoring.
• You are never required to use AI features; each one runs only when you press its button.

5. Amazon account connection

This section applies if you connect your Amazon Seller account to DropPanel (if the feature is not offered to you, no Amazon data is processed for you):

• The connection is established through Amazon's official Selling Partner API with your explicit authorization, which you can revoke from your Amazon account at any time.
• We access only order and financial data (order number, product, amounts, dates, marketplace, Amazon fee lines). We do not request access to buyer personal data such as buyer names or addresses. If that scope ever changes, this policy will be updated first, and Amazon's data protection requirements — including encryption in transit and at rest and strict retention limits — will apply in full.
• We use Amazon data solely to provide the panel's features to you; never for advertising, marketing or any other purpose, and we never share or sell it.
• Authorization credentials are stored server-side only; they are never sent to your browser or to any other user.
• When you disconnect or delete your account, data obtained from Amazon is deleted within a reasonable period.

6. Where your data is stored

• Server: your live data and backups are hosted in a database in the European Union (Frankfurt, Germany). Each account can access only its own data; this separation is enforced at the database layer, row by row.
• Your device: the panel keeps a copy of your data in your own browser's storage for speed and for protection against data loss. That copy never leaves your device.
• Your own disk (optional): if you pick a folder in Settings, automatic backup copies are written there, entirely under your control.
• All connections are encrypted in transit (HTTPS/TLS); the database is encrypted at rest.

7. Who we share data with

We use a small number of service providers (subprocessors) to run the service. Each receives only what its job requires:

These providers may process the data only to provide their service to us. Beyond them, we disclose data only when legally required (court order, competent authority request) and only to the extent of that requirement.

Because some providers are located abroad, your data may be transferred internationally. Transfers are limited to the table above.

8. How long we keep it

• Your account and panel data are kept for as long as your account is open.
• Backups are versioned and automatically thinned over time; their sole purpose is protection against data loss.
• When you ask us to delete your account, after verifying your identity we delete your live data and the server-side backup copies within 30 days. Records we are legally required to keep (for example billing records) are excluded and kept only for the legally required period.
• Copies on your own device and your own disk are under your control; deleting them is up to you.

9. Your rights

Depending on the law that applies to you (including the Turkish Data Protection Law no. 6698 and, where applicable, the GDPR), you have the right to:

• learn whether your data is processed and request information about it,
• request correction of incomplete or incorrect data,
• request deletion of your data,
• learn the third parties your data is transferred to,
• object to processing and request remedy for damages.

To exercise any of these rights, write to support@droppanel.net. We respond within 30 days at the latest. You can also export all of your panel data yourself, at any time, from Settings.

10. Cookies

Neither the panel nor the marketing site uses cookies. In the panel, your session is kept only in your own browser's storage and only because the panel cannot work without it. No third-party advertising or tracking scripts are loaded anywhere.

11. Children's privacy

DropPanel is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

12. Security

We protect your data with encryption in transit and at rest, per-account access separation, access logging and multi-layer backups. If we determine that a security incident has affected your data, we will inform you — and, where required, the relevant authorities — in line with applicable law. No system can guarantee absolute security; if you notice anything suspicious, please tell us.

13. Changes to this policy

When we update this policy, we publish it on this page and change the date above. Significant changes are additionally announced inside the panel. Questions: support@droppanel.net