Who is responsible
QuietDrop is run by:
Sina Ramalho Claro
Erik-Nölting-Str. 8, 40227 Düsseldorf, Germany
Email: contact@quietdadclub.com
QuietDrop handles two kinds of data, with different people responsible:
- Creators who use QuietDrop (their Instagram account and login): QuietDrop’s operator above is the controller.
- People who comment on a creator’s posts or write to them (comments, DMs, story replies and story mentions): the creator decides what QuietDrop sends and is the controller. QuietDrop processes this data on the creator’s behalf under a data processing agreement (Art. 28 GDPR). For quietdadclub’s own posts, the operator above is also that creator.
What QuietDrop does
A creator connects their Instagram professional account through Meta’s official Instagram API. When someone comments one of that creator’s keywords, QuietDrop sends them one private reply. If they tap its button or reply, QuietDrop sends the link they asked for. A creator can also have QuietDrop answer a keyword sent by DM or as a reply to their story, thank people who mention them in a story, and send one automatic answer to other DMs. In an email automation, QuietDrop asks for an email address before sending the link. QuietDrop never messages anyone who hasn’t commented or written first.
Data we process
- Creators: Instagram user ID, username, an access token (stored encrypted), when they joined, last signed in and accepted the Terms, and the automations they set up. A session cookie keeps them signed in to the dashboard; it is technically necessary and not used for anything else.
- People who comment or write: the Instagram-scoped ID Meta sends with the comment or message, the username (comments only), the comment or message ID, the time of their last message to the creator, and which messages were sent. The text of comments and messages is checked for the keyword and not stored. Story mentions are noted as such; the story itself isn’t stored.
- Email addresses: only when someone sends their email in reply to an email automation’s question. QuietDrop stores the address, the question they answered (as the record of what they agreed to) and the time, and, if the creator connected their Kit account, passes the address to it.
- Link clicks: the time of the click and which message it came from. No IP address, device data or cookies.
Why, and on what legal basis
- Creators: to provide QuietDrop to them (Art. 6(1)(b) GDPR).
- People who comment or write: to send the messages they asked for by commenting or writing, and to show the creator how many comments, messages and clicks an automation had. The basis is the creator’s legitimate interest in answering their audience (Art. 6(1)(f) GDPR) and steps taken at the person’s request (Art. 6(1)(b) GDPR).
- Email addresses: to add the person to the creator’s email list, which the question asks them to agree to (Art. 6(1)(a) GDPR). They can unsubscribe in any email from the creator or ask the creator to delete it.
- Creators who pay for a plan: to provide the plan (Art. 6(1)(b) GDPR).
How long
Usernames of people who comment are deleted 30 days after their last comment. Message records, email addresses and click counts are kept while the creator uses QuietDrop (the creator can delete single email addresses any time) and deleted when they delete their data or disconnect QuietDrop on Instagram. Technical delivery logs (no message text) are deleted after 7 days.
Who else processes it
- Cloudflare, Inc. hosts QuietDrop (Workers and the D1 database) as a processor. Cloudflare may process data in the USA; transfers rely on the EU-US Data Privacy Framework and the EU standard contractual clauses.
- Meta Platforms delivers comments and messages through the Instagram API. Instagram’s own privacy policy applies to your use of Instagram.
- Kit (ConvertKit LLC), only for creators who connect their own Kit account: email addresses collected for that creator are sent to it on the creator’s instruction. Kit is the creator’s own service; its privacy policy applies.
- Lemon Squeezy sells QuietDrop’s paid plans as merchant of record and handles payment, invoices and VAT as its own controller. QuietDrop only learns the plan, its dates and Lemon Squeezy’s customer number, never card details.
Data isn’t sold or used for advertising.
Your rights
You can ask for access, correction, deletion, restriction or a copy of your data, and object to its processing, by emailing the address above. If you commented on a creator’s post, you can also ask that creator. You can complain to a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.