Privacy Policy

What this covers

How Drip handles personal data when you use dripai.studio. Questions or requests go to support@dripai.studio.

What we collect

Only what the product needs:

• Account: your email address, name if you give one, and a password hash — never the password itself. Signing in with Google gives us your Google account id, email and name.
• Workspace content: campaigns, hooks, prompts, brand details, uploaded images and generated posts.
• Connected accounts: TikTok access tokens, stored encrypted, and the profile details TikTok returns.
• Usage: generation and image counts per billing period, activity records showing who did what in a workspace, and post metrics retrieved from TikTok.
• Billing: a Stripe customer id and subscription status. Card details go to Stripe directly and never reach our servers.
• Technical: session records with the browser user agent, and rate-limiting counters keyed to your IP address.

Why we process it

To provide the service you asked for: creating an account, generating content, publishing to TikTok, and billing. To keep the service safe — rate limiting, abuse prevention, and audit records. To meet legal obligations, such as tax records for payments.

We do not sell personal data, and we do not use your workspace content to train our own models.

Who else processes it

Drip runs on a small set of providers, each handling only what its job needs:

• Cloudflare — hosting, database and media storage
• OpenAI — generates slide text and AI images from the prompts and campaign details you provide
• Stripe — payments and subscription management
• Resend — transactional email such as verification and password reset
• TikTok — receives the posts you publish, along with the captions and images in them
• Pexels — supplies stock images when you choose them

How long we keep it

Workspace content stays until you delete it or close your account. Sessions expire after thirty days, and sooner if you sign out. Verification and reset links expire within a day, resets within an hour, and are single-use. Billing records are kept as long as tax law requires. Deleting your workspace removes its content and disconnects its TikTok accounts.

Your choices

You can access and correct your details in the app, export or delete your workspace content, disconnect a TikTok account at any time, and cancel billing from the billing page. Depending on where you live you may also have rights to object to processing, restrict it, or complain to a regulator. Ask us and we will help rather than make you fight for it.

Security

Passwords are hashed with PBKDF2-SHA256 and never stored in the clear. Sessions are server-side and revocable, so signing out or changing a password ends them everywhere. TikTok tokens are encrypted at rest. Workspaces are isolated: every query is scoped to the workspace you are a member of.

No service is perfectly secure. If a breach affects you, we will tell you and the relevant regulator as the law requires.

Children

Drip is not intended for children. Do not use it if you are under the age TikTok requires for an account where you live.

Changes

We will post changes here and update the date above. Material changes get notice before they apply to you. Last updated 16 September 2026.