NabDrop – Privacy Policy
Last updated: 5 November 2026 · Version 1.0
1. Who is responsible for your data
The controller for NabDrop (nabdrop.com) is NabDrop ("we"). Contact for privacy: contact@nabdrop.com.
We apply the same privacy standards to every user, wherever they live, based on the UK and EU GDPR. The law where you live may give you extra rights, and nothing here removes them.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | name (optional), email, password hash, country | you |
| Preferences | alert settings, keywords, TLD filters, watchlists, saved searches | you |
| Payment | none: paid plans aren't available during the beta | n/a |
| Email events | delivery, bounce, open/click (if tracking is on) | Resend |
| Usage and logs | IP address, device/browser, pages used, timestamps, error logs (standard Cloudflare and Supabase platform logs). To enforce daily limits for visitors we store a one-way hash of the IP address, not the address itself | automatically |
| Trademark-warning settings | whether and when you turn "Hide brand look-alikes" on or off (logged per account per day) | you / automatically |
| Name checks | names you look up or generate in Ideas, and the result | you / automatically |
| Support | messages you send us | you |
| Cookies | see section 9 | automatically |
We do not want and do not ask for special-category data.
3. Why we use it and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR Art 6) |
|---|---|
| Create and run your account; provide lists, feeds and alerts | Contract |
| Service emails (alerts, security, legal notices, changes) | Contract |
| Security, fraud and abuse prevention, enforcing our Terms | Legitimate interests (keeping the Service safe) |
| Improving the Service with aggregate usage stats from our own platform logs (we use no analytics tools) | Legitimate interests |
| Marketing emails (news, offers) | Consent, or for existing customers the "soft opt-in" (see section 10) |
| Responding to legal claims and requests | Legitimate interests; legal obligation |
| Keeping a record of trademark-warning settings, to show warnings were offered and to enforce our Terms | Legitimate interests (handling complaints and legal claims) |
4. Who we share it with
We use these service providers (processors), under contract:
- Resend (Plus Five Five, Inc., trading as Resend, USA) – sends our alert, digest and account emails. It receives your email address and the content of each email (for example, the names in an alert). Our account is set to send from Resend's EU region (Ireland) where possible.
- Cloudflare, Inc. (USA) – hosts and serves the Service from its global network, provides DNS, and forwards emails sent to contact@nabdrop.com.
- Supabase, Inc. (USA) – runs our database and logins. Your data is stored in its EU region (Paris, France).
- Google (Gmail) – emails to contact@nabdrop.com are forwarded to, and answered from, a Gmail inbox.
- Registrars we link to through affiliate links (Porkbun and Namecheap). We don't send them your name, email or account details. When you click a "Register" affiliate link, you leave our site and the registrar records the click on its own site (usually with its own cookies), so it can credit us if you buy. That data is handled under the registrar's privacy policy, not ours. The registrar may tell us that a referral led to a sale and the commission due, usually without identifying you.
Name lookups. When you check a name's availability, our server asks the relevant domain registry (via its public RDAP service) about that name. The registry sees the name and our server, not your identity or account. Your watchlist is checked on our own servers against public drop data. We don't send your watched names to registries or registrars.
We may also disclose data to professional advisers, to authorities where the law requires, or to a buyer of the business. We do not sell your personal data.
5. International transfers
We are based in Morocco, outside the UK and EU. Your data is therefore transferred to Morocco and to our providers' countries:
- Morocco: has no UK or EU adequacy decision. We protect data in line with this policy and the UK/EU GDPR, which apply to us directly.
- USA (Resend): emails are sent from Resend's EU region (Ireland) where possible, but Resend is a US company and your data may be accessed from or stored in the USA. Resend's Data Processing Addendum includes the EU Standard Contractual Clauses and UK Addendum, and Resend is certified under the EU-U.S. Data Privacy Framework and its UK Extension.
- Supabase: our database is stored in the EU (Paris). Supabase is a US company, and any access from outside the EU is covered by its Data Processing Agreement, including the EU Standard Contractual Clauses.
- Cloudflare (global network) and Google (USA): covered by their data processing terms, including the EU Standard Contractual Clauses and UK Addendum, and the EU-U.S. Data Privacy Framework where they are certified.
You can ask for a copy of the safeguards at contact@nabdrop.com.
6. How long we keep it
| Data | Retention |
|---|---|
| Account, preferences, watchlists | while your account is active; deleted within 30 days of account closure |
| Inactive free accounts | deleted after 24 months of inactivity, after a warning email |
| Email event logs | 90 days |
| Server/security logs | 90 days (longer if needed for an investigation) |
| Support messages | 2 years after the issue closes |
| Trademark-warning setting logs | while your account is active + 2 years |
| Name check logs | 90 days |
| Marketing consent records | while you're subscribed + 2 years |
| Backups | overwritten within 35 days |
7. Your rights
Under UK and EU GDPR you can: access your data; correct it; delete it; restrict or object to processing (including an absolute right to object to direct marketing); data portability; withdraw consent at any time; and not be subject to solely automated decisions with legal effects (we make none).
Email contact@nabdrop.com. We reply within one month (extendable by two months for complex requests). We may need to verify your identity. It's free unless a request is clearly unfounded or excessive.
8. Complaints
Please contact us first. You may also complain to:
- UK: Information Commissioner's Office – ico.org.uk/make-a-complaint, 0303 123 1113.
- EU: the data protection authority in your country of residence or work (list: edpb.europa.eu/about-edpb/about-edpb/members_en).
- Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) – www.cndp.ma.
9. Cookies
We use only strictly necessary cookies: the login-session cookies set by Supabase (named sb-…) when you sign in. They don't need consent. We use no analytics, tracking or advertising cookies, and no affiliate pixels or scripts. If that ever changes, we'll ask for your consent first. A registrar may set its own cookies after you click through to its site, under its own cookie policy.
10. Service emails vs marketing emails
- Service emails (alerts you set up, security and legal notices) are part of the Service. You control alerts in your settings; you can't opt out of essential account notices while you have an account.
- Marketing emails are sent only if you opt in, or – if you're a customer – about our similar products where you were given a chance to opt out at sign-up and in every message (the "soft opt-in" under UK PECR reg 22 and the EU ePrivacy rules as implemented in your country). Every marketing email has an unsubscribe link. We don't send marketing emails during the beta, and marketing emails will have no open or click tracking unless you consent.
11. Security
We use encryption in transit (TLS), hashed passwords, access controls and least-privilege access. No system is perfectly secure; we will notify you and regulators of serious breaches as the law requires.
12. Children
NabDrop is not for children under 13, and we don't knowingly collect their personal data. If you think a child under 13 has given us personal data, contact us at contact@nabdrop.com and we'll delete it.
13. Changes
We'll post updates here and email you about significant changes before they apply.
14. Contact
NabDrop · contact@nabdrop.com