Privacy Policy

SC Studios LLC d/b/a Dropedia · Martinsburg, West Virginia 1. WHO WE ARE AND WHAT THIS COVERS SC Studios LLC, a West Virginia limited liability company, doing business as Dropedia (“Dropedia,” “we,” “us,” “our”) provides a business platform where marketing agencies collect photos, videos, and files from their clients through private branded portals (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to the Service and our websites. It does not cover the practices of the agencies who use Dropedia. Each agency is responsible for its own relationship with its clients and for its own privacy obligations. 2. INFORMATION WE COLLECT • Account information — name, email address, business name, role, and any profile details you provide. • Client contact information — when an agency adds a client, it provides that client’s business name and contact email so we can send the portal invitation. • Uploaded content and its details — the files users upload, plus the organizational details attached to them: folder, tags, priority, notes, subject, shoot date, and who submitted them. • Information embedded in your files — photos and videos often carry metadata created by the camera or phone, which can include the date, device model, and in some cases the GPS coordinates where the file was captured. This metadata travels with the file. We do not use it, index it, or display it, but it may remain in the file as you uploaded it. If that matters for your content, remove it before uploading. • Agreement records — when you accept our Terms of Service or other policies, we record which version you accepted, when, your IP address, and your browser information. This is how we prove agreement. • Sign-in records — when you sign in, we record the time, IP address, and browser information for security and audit purposes. • Billing information — handled by our payment processor. We store references to your customer and subscription records; we never store full payment card numbers. • Support communications — messages you send us through in-app support or email. • Usage and device data — basic technical data generated by using a web application: pages loaded, approximate location derived from IP address, and browser type. 3. HOW WE USE INFORMATION • To provide the Service — storing, organizing, and displaying content to the people your account’s roles and permissions authorize. • To operate accounts — invitations, authentication, notifications, and support. • To bill — subscription management, storage measurement, and overage calculation. • To secure the Service — sign-in auditing, abuse and fraud prevention, and enforcing our Terms and Acceptable Use Policy. • To comply with law — responding to lawful requests and meeting record-keeping obligations. We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use your content or your personal information to train artificial intelligence models, and we do not provide your content to third parties for their own purposes. 4. HOW INFORMATION IS SHARED Within your workspace: content and its details are visible to the people your account structure authorizes. An agency’s team sees its clients’ uploads; a client’s team sees its own portal. Uploads display the name of the person who submitted them, so anyone with access to that portal can see who uploaded what. With service providers: we use a small set of infrastructure providers who process data only to provide their service to us, under contracts that restrict their use of it. ----------------------- ----------------------------------------- --------------------------------------------------------------- Provider What they do for us Data involved Supabase Database, file storage, authentication Account data, uploaded content, login records Vercel Application hosting Usage data processed in serving the app Stripe Payment processing Billing name, email, payment card (held by Stripe, not by us) Resend Transactional email Email addresses, notification content Cloudflare DNS, network security, content delivery IP addresses, network request data ----------------------- ----------------------------------------- --------------------------------------------------------------- Other disclosures: we may disclose information if required by law or legal process; to protect the rights, safety, or property of Dropedia or others, including reporting child sexual abuse material to the National Center for Missing & Exploited Children as required by law; or in connection with a merger, acquisition, or sale of assets, in which case this Policy continues to apply to previously collected information until it is updated and you are notified. 5. OUR ROLE AND YOUR AGENCY’S ROLE For content uploaded into an agency’s portals, the agency and its clients decide what is uploaded and who may access it. Dropedia processes that content on their behalf in order to provide the Service. Agencies are responsible for having the right to give us their clients’ contact information and for meeting their own legal obligations to their clients. 6. SECURITY Security is built into the platform rather than layered on top of it. Every database table enforces row-level security, so each business can reach only its own records. File storage paths are scoped to each agency and client. File download links are time-limited and expire automatically. Data is encrypted in transit and at rest by our infrastructure providers. Sign-ins and sensitive administrative actions are logged. No system is perfectly secure and we cannot guarantee absolute security. Use a strong, unique password, and tell us at support@dropedia.app immediately if you believe your account has been accessed without your permission. 7. RETENTION AND DELETION We keep your information while your account is active. When content is deleted through the Service, files are removed from active storage and a deletion record — what was deleted, by whom, and when — is retained for audit purposes. When an account closes, we make export available for the period described in the Terms of Service, then delete content from active systems. Residual copies may persist in encrypted backups for a limited period before those backups are purged on their normal cycle. We retain agreement records, billing records, and audit logs for as long as needed to meet legal, tax, and security obligations. 8. YOUR RIGHTS AND CHOICES We extend the following rights to every user, regardless of where you live: to access the personal information we hold about you, to correct it, to obtain a copy of it, to delete it, and to not be treated differently for exercising any of these rights. Some states give residents these rights by law; we apply them to everyone rather than sorting users by geography. To exercise a right, email support@dropedia.app. We will verify your identity and respond within the time required by law, and in any event within 45 days. If you are a client of an agency, note that your agency controls much of the data in your portal — we may direct your request to them or work with them to fulfil it. You can delete your account yourself from within the Service under Settings. Transactional emails — invitations, security notices, and billing — are part of the Service and cannot be turned off while your account is open. Other notification preferences can be adjusted in your account settings. 9. NO PROTECTED HEALTH INFORMATION Dropedia is not a HIPAA business associate, and the Service must not be used to store protected health information. If you believe PHI has been uploaded to the Service, contact us at support@dropedia.app and notify the responsible agency immediately so it can be removed. 10. CHILDREN The Service is for business users aged 18 and over. We do not knowingly collect personal information directly from children, and children cannot create accounts. Photographs or video showing a minor may be uploaded only with verifiable parental or guardian consent, as required by our Terms of Service. If you believe a child’s image or information has been uploaded without that consent, contact us at support@dropedia.app and we will act promptly. 11. WHERE DATA IS PROCESSED We are a United States company and process data in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. 12. CHANGES TO THIS POLICY We version this Policy. If we make material changes we will post the updated version with a new effective date and, where appropriate, ask you to acknowledge it the next time you sign in. Continued use of the Service after the effective date constitutes acceptance. 13. CONTACT US SC Studios LLC d/b/a Dropedia · 149 Lynnhaven Drive, martinsburg WV 25404 · support@dropedia.app · dropedia.app