Privacy policy

Who we are, and who is responsible

Rajesh Kumar (sole proprietor) operates Dripost. Under the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for your account data, which means we decide why and how it is used and we answer for it.

For personal data inside the content you process through Dripost — a customer's name in a caption, a face in a video — you decide why and how, and we process it on your instructions. The data processing terms set that relationship out.

Address: Whitefield, Bengaluru – 560048, Karnataka, India. Email: rajesh@dripost.com.

Who answers your questions about your data

Rajesh Kumar answers every question about how Dripost processes your personal data, and every request to use your rights under the DPDP Act. Write to privacy@dripost.com.

What we collect, why, and who else sees it

Everything in this table comes from you, or from a network you connected, or from the request your browser makes. There is no fourth source: we buy no data and we take none from data brokers.

Every category of personal data Dripost holds today.

What we do not collect

• No advertising trackers. There is no Google Analytics and no advertising pixel. The one third-party script on our pages is Ahrefs Web Analytics, which counts visits (see the table above). We record the visits and steps above in our own database, and PostHog runs only if you switch it on.
• No advertising cookies.
• No sale of your data, and no sharing of it for anybody else's advertising. We do not, and will not.
• No IP address against your consent record. The law lets us keep one; we decided the country is enough.
• The free tools run entirely in your browser. What you type into them is never sent to us.

How the AI features work

When you ask Dripost to write, adapt or enhance a post, we send the text you wrote — and, where the feature works from a video, that video — to a model provider. The request goes through OpenRouter, which routes it to the model we have chosen: today Google's Gemini models, with DeepSeek as a fallback when Google is unavailable. The answer comes back and is shown to you. It is not used to train anything of ours.

We have not been able to secure a contractual opt-out from retention or training with those providers on the plan we are on. So we say it plainly rather than implying otherwise: treat the AI features as you would treat a supplier you have not signed an NDA with, and do not paste anything into them that you would not want a service provider to see.

The free AI tools on our website (hashtags, captions and YouTube titles, no account needed) work the same way: what you type goes to the model provider to write the answer. We don't store it or link it to you. To stop the tools being abused we count requests per visitor for a day, using a one-way hash of the IP address, never the address itself.

Insights labels are off until an owner or admin of your workspace turns them on. When on, Dripost sends your posts' captions and thumbnails to a model provider through OpenRouter to label what each post is (its topic, how it opens, what it asks, its language); the numbers still come only from the networks. We ask OpenRouter to use only providers that say they do not keep or train on these requests. Turning labels off stops it; the labels already made stay until you delete them.

AI output can be wrong, dated, or wrong for your audience. Nothing an AI feature produces is published on its own — you read it, edit it and schedule it. You are the author of what goes out.

Who else handles your data

These are every processor and sub-processor we use today. If we add one that handles personal data, we will update this list before it starts.

• Cloudflare — hosting, the database (D1), file storage (R2), network protection, and Turnstile, the browser check when you create an API key. Data is stored on Cloudflare's network, which spans several countries.
• OpenRouter — routes an AI request to a model provider. Used only when you use an AI feature.
• Google (Gemini, through OpenRouter) — the primary model provider for AI features.
• DeepSeek (through OpenRouter) — the fallback model provider when the primary is unavailable.
• Resend — sends our email: login codes, sign-in alerts, approval requests and account notices.
• Razorpay — takes and manages subscription payments.
• PostHog (EU region) — usage analytics and masked session recordings in the app, only for people who turn on "Help improve Dripost" in Settings › Privacy.
• Ahrefs (Ahrefs Web Analytics) — counts visits to our website's pages; its script is loaded from analytics.ahrefs.com, so your browser contacts Ahrefs when a page opens. We send it no account details.
• Google and YouTube; Meta, for Instagram, Facebook Pages and Threads; X; and LinkedIn — the platforms you choose to connect. Each receives what you publish and holds it under its own terms.
• Apps you connect yourself through the API or as an AI assistant, and addresses you register for webhooks. They are not our processors: you choose them, and they receive what you allowed.
• When you connect an AI assistant such as Claude, ChatGPT or Gemini, what Dripost's tools return to it — your posts' text, file names, schedules and links — goes to that assistant's provider (Anthropic, OpenAI or Google) and is handled under that provider's own terms and privacy policy.

We use no advertising networks and no data brokers. Two analytics vendors: Ahrefs Web Analytics counts visits to our website's pages, and PostHog runs only if you opt in.

Where your data goes, outside India

Our hosting is Cloudflare's global network, so your data may be stored or processed outside India. AI requests go to model providers who operate outside India. Our email and payment providers may process outside India as well.

The DPDP Act permits transfers outside India except to a country the Central Government restricts; if such a restriction is notified and it affects a provider we use, we will change the provider or stop the transfer.

Cookies and what we keep in your browser

• A sign-in cookie, so you stay logged in. Without it you would log in again on every page.
• A short-lived cookie during a two-step sign-in, so the second step knows the first one succeeded. It is signed, cannot be read by any script, and dies in five minutes.
• A short-lived cookie recording that you ticked the agreement boxes, so the account we then create can be created with your consent on record. Thirty minutes, signed, and deleted once the account exists.
• A short-lived cookie while you connect a social account, which protects that connection from forgery.
• A cookie naming the workspace you are currently working in.
• A visitor cookie: a random id for your browser, kept for a year, so the pages you open before signing up can be joined to your account. It contains no personal details.
• A first-visit cookie (90 days) and a last-visit cookie (30 days): the campaign link or website that first, and most recently, brought you to Dripost. No personal details.
• A team cookie (a year), set only in the browser of a Dripost team member's own account when they log in, so our own visits are left out of our visitor numbers. You will never receive it.
• In your browser's own storage, not ours: whether you chose light or dark, and whether you left the menu open or closed. If you choose an appearance in Settings, it is also saved on your account, so it follows you to other devices.
• If you turn on "Help improve Dripost", PostHog keeps nothing in your browser either: it holds its state in the open tab's memory, gone when you close it.

That is the whole list. All of these are our own cookies: only Dripost reads them, and none is shared. There are no advertising or cross-site tracking cookies.

How long we keep things

We keep your account and its content while your account is open, because that is the service.

• Delete your account and we delete it then and there: your posts, your uploaded files, your connected-account tokens, your settings. It is not a queue and not a 30-day grace period.
• Website visits and the steps above are deleted after 400 days. If you never made an account, write to us at privacy@dripost.com with your visitor id (the value of the dp_vid cookie, which your browser's developer tools show) and we delete every row recorded under it. An account's deletion also removes every row of the browsers joined to it.
• Emailed login codes die 10 minutes after they are issued, and are deleted the moment they are used.
• Links that let somebody review a post without an account expire after 7 days, and you can revoke one sooner.
• Links to your video and image files are signed and expire after 15 minutes. The file stays private; the link is what expires.
• Rate-limit counters last minutes, not longer.
• A session you sign out of, or that expires, is kept for 30 days so a signed-out device stays signed out, then deleted. All of them go with your account.
• A reviewer's name, decision and note stay with the post they reviewed, until the post or your account is deleted.
• A WhatsApp number you saved stays until you remove it, or until the workspace or your account is deleted.
• The record of each API or connected-app call is kept for 400 days and then deleted, so that a misuse found months later can still be traced. If you delete your account, those records lose their link to you and are deleted at the same 400 days.
• The IP address of a failed API sign-in is kept for 2 days at most; a block it causes lasts 10 minutes. The list of countries a key was used from drops a country a day after it was last seen. Hourly and daily call counts are deleted after 32 days.
• API keys, connected apps, webhook addresses and their delivery log, links you imported media from, and the call counts of your keys and apps are deleted with your account. Revoking a key or disconnecting an app stops it at once; its row stays, marked revoked, so you can still see who had access and when it ended.
• Payment and tax records are kept for as long as Indian tax and company law requires, which is longer than your account. They are financial records, not content.
• Your agreement to these policies is kept for as long as your account exists and for a reasonable period after, because it is the proof that consent was given.

Backups: Cloudflare's database keeps a short rolling history that lets us restore after a mistake or an incident. A deleted row can therefore survive in that history for a brief period before it ages out. We do not read backups except to recover the service.

Your rights, and how to use them

Under the DPDP Act you have the right to know what we hold about you and who we have shared it with, to have it corrected or completed, to have it erased, to nominate somebody to exercise your rights if you cannot, and to have a grievance answered.

• To see and download everything: Settings has an export. It hands you a JSON file with your profile, posts, versions, library, posting times and activity. Password data and connection tokens are deliberately left out of it.
• To correct something: change it in Settings, or write to us for anything you cannot reach.
• To erase everything: Settings, Delete account. It removes your posts and files and revokes every network connection at once. It refuses in two cases we cannot resolve for you — while other people are in your workspace, and while you have an active paid plan — and it tells you which. Or write to rajesh@dripost.com and we will do it.
• To disconnect one network without deleting anything else: Channels, Disconnect. We delete our copy of the token, and you can also remove Dripost's access at the network's own settings.
• To nominate somebody, or to ask anything the product cannot do: email privacy@dripost.com from the address on your account.

We act on a verified request without undue delay, and in any case within 30 days. We may need to check that the request is really from you; we will not use that check to delay you.

Consent, and changing your mind

We ask for your agreement to this policy and to the Terms when you create an account, in two separate unticked boxes, and we record what you agreed to and when. Marketing email is a third, optional box, unticked, and we record your answer either way — including when it is no.

You can withdraw consent at any time. Withdrawing consent for the processing that runs the service means closing your account, because there is no version of Dripost that publishes your posts without processing them; Settings does that in one step. Withdrawing consent to marketing email is separate and costs you nothing — write to us and we will record it.

Withdrawing consent does not undo what was lawfully done before you withdrew it.

We send no marketing email today. The record exists so that if we ever do, it has a truthful answer to work from.

Children

Dripost is for people aged 18 and over. We ask you to confirm it when you create an account, and we do not knowingly collect data from anyone younger.

If you believe a child has an account here, write to rajesh@dripost.com and we will delete it.

How we protect your data

This is what is actually in place, not a wish list:

• Connected-account tokens are encrypted with AES-256-GCM before they are stored, and are never sent to your browser. There is an automated test whose whole job is to fail if one ever leaks into a response.
• Passwords, where set, are stored only as bcrypt hashes.
• Your uploaded files are private. They are reached only through signed links that expire in 15 minutes.
• Every request is checked against the account and workspace that owns the data, and there is a test that fails the build if a new route forgets.
• Optional two-factor authentication and passkeys are available on every account.
• We email you when your account is signed into from a country or a browser we have not seen before.
• Sign-in, code and password routes are rate limited, and login codes expire in 10 minutes with 5 attempts.
• An append-only activity log records what happened on your account.

No system is perfectly secure, and we will not pretend otherwise. What we commit to is the list above, and telling you quickly when something goes wrong.

If something goes wrong

We have a written breach plan and we follow it. If personal data we hold is exposed, lost or accessed without authorisation:

• We contain it first, which may mean rotating secrets, revoking network tokens so you have to reconnect, or taking a route offline.
• We tell the Data Protection Board of India, and every person affected, with what happened, what data, what we have done and what you should do. Under the DPDP framework this is without delay and within 72 hours of becoming aware, and we will not wait to be sure it was serious before telling you.
• Where the incident is also a reportable cyber incident, we report it to CERT-In within the 6 hours their directions require.
• We tell the networks and our payment provider if their tokens, app secrets or payment identifiers were involved.
• Afterwards we write up the cause and the fix, and add a test that would have caught it.

We will not minimise, and we will not make you find out from somebody else.

The networks you connect

Connecting a network is you giving us permission, at that network, to act for you in specific ways. What we get and what we may do with it is set by the network, not by us. Disconnecting a network (from Channels, in the product) deletes our copy of its token and your account details for that connection immediately, and revokes our access at the network itself wherever the network's own API supports that — YouTube and X both do; where a network has no such call (Instagram, LinkedIn), the token is deleted here and you remove Dripost's access from that network's own settings, linked below.

• Google and YouTube: see the dedicated "YouTube API Services" section below.
• Meta, for Instagram: remove Dripost's access at Instagram's own access-management page.
• X: you can remove Dripost's access in your X settings, under connected apps.
• LinkedIn: you can remove Dripost's access under LinkedIn Settings & Privacy, in the "Permitted services" section.
• Meta, for Facebook Pages and Threads: remove Dripost in Facebook's settings under Business integrations, or in Threads' settings under Website permissions.

When you remove Dripost from Instagram, Facebook or Threads, Meta tells us, and we delete what we hold from that account; you get a confirmation code and a page to check it. The data deletion page explains every way to delete your data.

What we receive from Meta (Instagram, Facebook Pages, Threads)

Each item below is a permission you grant on Meta's own screen when you connect. We use it only for the purpose written next to it, only for the accounts you connect, and never to sell, advertise, or build profiles.

• instagram_business_basic: your Instagram professional account's ID, username, name and profile picture, to show which account is connected and to send your posts to it.
• instagram_business_content_publish: to publish the photos, videos, carousels and Reels you write or schedule in Dripost to your own Instagram account.
• instagram_business_manage_comments: to post the "first comment" you write in Dripost under your own post. We do not read or reply to other people's comments.
• instagram_business_manage_insights: the reach, views, saves and shares of posts Dripost published for you, shown in Insights and in reports you create.
• pages_show_list and business_management: the list of Facebook Pages you manage (including Pages owned by your business portfolio), so you can choose which Page to connect. Nothing is chosen for you.
• pages_manage_posts: to publish the posts you write or schedule in Dripost to the Page you connected.
• pages_read_engagement: the connected Page's name and picture, and the likes, comments and shares on posts Dripost published, shown in Insights and reports.
• threads_basic: your Threads profile's ID, username and picture, to show which profile is connected.
• threads_content_publish: to publish the text, image and video posts you write or schedule in Dripost to your Threads profile.
• public_profile: your Facebook name and ID when you sign in to connect a Page.

How long we keep it: access tokens are stored encrypted until you disconnect, remove Dripost at Meta, or delete your account, then deleted at once. Post numbers are stored with the post they belong to and deleted with that post or your account. We never ask Meta for data about anyone other than the accounts you connect.

YouTube API Services

Dripost uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's own handling of your data is described in the Google Privacy Policy.

What we access: your channel's basic profile (its id, name and thumbnail, to show which channel is connected) and its subscriber count (for your reports), and, only for videos you upload through Dripost, the video file itself, its title, description, privacy setting and thumbnail, its processing status (to confirm it went live) and its view, like and comment counts (for Insights and reports).

What we store: the OAuth token that lets us act on your channel, your channel id, name and thumbnail, the title, description, privacy setting and YouTube video id of what you have published through Dripost, and the view, like, comment and subscriber counts read for Insights and reports — never the video file itself once it has finished uploading to YouTube.

Why: solely to let you upload and manage videos on your own channel from inside Dripost, and to show you their status and numbers. We do not use this data to build advertising profiles, and we do not sell it.

Retention: we keep the OAuth token for as long as the connection stays active. Everything else we read from YouTube is refreshed or deleted within 30 days of reading it: view, like, comment and subscriber counts older than 30 days are deleted, and the channel's name and thumbnail are read again from YouTube once they are 30 days old. We delete the token and channel details the moment you disconnect the channel or delete your account. The title, description and video id of something you already published stay in your post history, the same as they would for any other network, until you delete your account (a draft that was never published can be deleted on its own, from Posts).

How to revoke: disconnect the channel from Dripost's Channels page, which deletes our copy immediately, or revoke Dripost's access directly at your Google security settings page, which also signs Dripost out of your channel.

How to request deletion: write to us (see "How to reach us" below) and we will delete any YouTube-derived data we hold about you, beyond what you can already remove yourself by disconnecting.

Dripost's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to anyone else, sell it, or use it for advertising, and no human at Dripost reads it except with your explicit permission for support, to comply with the law, or where it is aggregated and anonymised for a security or operations reason.

If you are outside India

Dripost is built and operated from India, and Indian law governs it. We apply the protections in this policy to everyone, wherever you are.

If you are in the UK or the European Economic Area: we process your data to perform our contract with you; on your consent where this policy says consent; and in our legitimate interest in keeping the service and your account secure, for the security records described above (sign-in alerts, sessions, the record of API and app calls, and rate limits). You have the rights you would expect — access, correction, erasure, portability, objection, restriction — and the way to use them is the same as above. Tell us first and we will answer properly; you can also complain to the data protection authority where you live or work.

We make no decision about you by automated means alone that has a legal or similarly significant effect on you. Automated security checks can slow down or pause an API key or a connected app; write to us and a person will look at it.

If you are in a US state with its own privacy law: we do not sell personal information or share it for cross-context behavioural advertising, and you may ask us to access or delete your data by writing to us.

Complaints

If anything here worries you, tell us first — most things are a misunderstanding we can fix the same day.

Changes to this policy

If we change this policy in a way that matters, we will tell you inside the product before it takes effect, and we will ask you to agree again. Each version carries its date, and the record of what you agreed to names the version, so it is always possible to say which text you accepted.

This version is dated 2026-09-25.

How to reach us

For anything about this policy, or about data we hold, write to privacy@dripost.com. For everything else: