DropRegion (“DropRegion,” “we,” “us,” or “our”) is owned and operated by DVFZ Training Consultancy Services, based in the Philippines. This Privacy Policy explains what information we collect when you use dropregion.com (the “Service”), how we use it, and the choices you have. It is written to comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). By using the Service, you agree to the practices described here. If you don’t agree, please don’t use the Service.
1. Information we collect
Account information
Publishing requires an account. When you sign up, we collect your email address and the handle you choose. Authentication is handled by our infrastructure provider, Supabase — we never see or store your password in plain text.
Content you publish
Any HTML file you drop, along with associated metadata (title, category, visibility setting, and slug), is stored so it can be served at your public link. We also generate a screenshot preview of each published page for use in the gallery and your channel.
Documents, links and transcripts you convert
You can also turn a Word, PDF, Markdown or text file, a Google Doc link, or a YouTube video with a transcript you paste or upload into a page. For that we keep the file, or the copy of the Google Doc we fetch, and the text we read from it, together with the title and channel of a YouTube video and the link you pasted. See “Data retention” below for when the file and text are deleted.
Usage and technical information
We collect information generated by using the Service: likes, follows, bookmarks, site views/bandwidth, the topics you choose as interests, API key usage timestamps, and abuse reports filed against a site. While you're signed in, we use your interests, likes, follows, bookmarks, and the Drops you view to personalize your For You feed. You can change your interests at any time in Settings. We also record which Drops we show you on the homepage and Gallery tabs, and which of them you open, so we can tell whether the For You tab works better than the others. We use Google Analytics to measure how the Service is used (pages visited, traffic sources, approximate location and device type). If you opt in to analytics, it uses cookies to recognize repeat visits. If you don't, it runs in a limited mode (Google Consent Mode) that sets no analytics cookies and sends only basic, anonymous pings, which Google may use to model aggregate usage. We do not run third-party advertising trackers on the Service.
Cookies and local storage
Necessary cookies and storage are always on: a session cookie (set by Supabase Auth) keeps you signed in, a small local-storage value remembers your light/dark theme, another remembers your cookie choices, and another remembers if you dismissed the prompt to pick your interests. None of these is used for advertising or cross-site tracking.
Everything else is off until you opt in. When you first visit, a banner lets you accept all, reject all non-essential cookies, or choose by category: analytics (Google Analytics), marketing, and third-party services. We don't currently run marketing cookies. You can change or withdraw your choice at any time using “Cookie settings” in the footer; withdrawing returns analytics to the limited, cookie-free mode described above and removes its cookies. We ask again after 12 months or if the cookies we use change.
Collaborator invitations
If you invite someone to view a restricted site, we store the email address you provide so we can grant that person access once they sign in with a matching account.
2. How we use information
- To create and maintain your account and published sites
- To serve your published pages and their screenshot previews
- To turn the documents, Google Docs and transcripts you submit into pages, which includes drafting them with the AI providers named below
- To scan submitted content for malware and phishing before it goes live
- To operate gallery ranking, follows, likes, and bookmarks
- To respond to abuse reports and enforce these policies
- To communicate with you about your account, when necessary
- To send our weekly newsletter (the top public Drops, new Drops and the top creator of the week) to people who opted in, and to members who were already signed up when it launched. Each email has an unsubscribe link, and you can turn it off in account settings. We keep a record of when and how you opted in and, if you unsubscribe, when you did. We also count, in aggregate, how many times links in each issue are visited and its share buttons are pressed, so we can see which Drops people like. These counts are not linked to you: we do not record who clicked, and we do not track whether you open the email. If you unsubscribe you can choose to tell us why; that answer is stored without any link to you.
3. How we share information
We do not sell your personal information. We share information only with:
- Service providers— Supabase (database, authentication, and file storage) and Vercel (application hosting) process data on our behalf to operate the Service. Resend sends our newsletter and receives the recipient’s email address for that purpose.
- Content-safety providers — when malware/phishing scanning is enabled, submitted content or the URLs it contains may be checked against Google Safe Browsing.
- AI providers— to draft a page from a document or transcript you convert, we send its text and your answers to the conversion questions to OpenAI or Anthropic, which process it for us through their business services. When we suggest a title, category, description or tags for a page, its text may be sent to the same providers. We do not send your email address or account details. They may process data outside the Philippines (see “Cross-border data transfers”).
- Google, when you paste a Google Doc link — our server asks Google for that document, which must be shared as “Anyone with the link”. Google sees the document’s address and our server’s network address, not your Google account, and we never receive your Google password. We keep a copy of the document only to make your page and delete it when you publish or discard the page (see “Data retention”).
- YouTube, when you paste a YouTube link — our server asks YouTube’s public oEmbed service for the video’s title, channel and thumbnail address. YouTube sees the video address and our server’s network address, not your account. While you set up the conversion, your browser also loads the thumbnail picture from YouTube’s image servers, which can see your browser’s address; the thumbnail is not part of your published page. The transcript is whatever you paste or upload, and we keep it only to make your page and delete it when you publish or discard the page (see “Data retention”).
- Other users — content you publish as Public or Unlisted, your handle, and your channel page are visible to anyone with the link, by design.
- Legal reasons — if required to comply with law, enforce our Terms of Use, or protect the rights, property, or safety of DropRegion, our users, or the public.
4. Content moderation and scanning
Every file you publish is automatically scanned before it goes live. Sites that fail this check, or that are later found to violate our Terms of Use, are blocked or removed. Reports filed against a site are reviewed by us and retained to maintain a record of moderation decisions.
5. Data retention
We keep your account and published content for as long as your account is active. When you move a site to trash, it is permanently deleted 30 days later unless you restore it first. You can delete your account at any time from account settings; this removes your published sites and personal information from active systems, subject to any copies we’re required to retain for legal or security purposes.
Documents, links and transcripts. The file you upload (or the copy of a Google Doc we fetch), the transcript you provide and the text we read from them are deleted when you publish the page, or when you discard it at the preview step. A page you leave unpublished, whether it is waiting at the preview step or was held or failed after a problem, keeps them until you publish or discard it. The published page, its title and the link or video details shown on it stay until you delete the page. Copies made before October 22, 2026 are deleted if you ask us to (see the contact details below).
6. Legal basis for processing
We process your personal information on these legal bases, as required by the Data Privacy Act: your consent (given when you create an account and agree to this Policy); the necessity of processing to fulfill our contract with you (operating the account and sites you publish); and our legitimate interests in securing the Service, preventing abuse, and enforcing our Terms of Use. The weekly newsletter is sent on the basis of your separate, optional consent at signup or in account settings; for members who were already signed up when it launched, it is sent on our legitimate interest in keeping members informed about the Service, and you can object at any time with the unsubscribe link.
7. Your rights under the Data Privacy Act
As a data subject, you have the right to:
- Be informed that your personal information will be, is being, or was processed, including the extent and purpose of that processing.
- Access your personal information that we hold.
- Object to processing of your personal information, including processing for direct marketing, automated processing, or profiling.
- Correct any inaccurate or outdated personal information we hold about you.
- Erase or block your personal information from our systems, including by deleting your account.
- Data portability — request a copy of your personal information in an electronic format, where technically feasible.
- Damages for any harm sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.
- Lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights under the Data Privacy Act have been violated.
To exercise any of these rights, set a site’s visibility to Public, Unlisted, or Restricted at any time, revoke an API key from account settings whenever you like, or contact us using the details below — we will respond within a reasonable time and, in any case, within the period required by the Data Privacy Act and NPC rules.
8. Security measures
We apply reasonable organizational, physical, and technical security measures to protect your personal information, including relying on our infrastructure provider’s encryption in transit and at rest, access controls, and hashed (not plaintext) storage of API keys and passwords. No system is perfectly secure, and we cannot guarantee absolute security.
9. Data breach notification
If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected users without unnecessary delay, consistent with the timelines and procedures set by the Data Privacy Act and NPC circulars.
10. Children’s privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
11. Cross-border data transfers
DropRegion is operated from the Philippines by DVFZ Training Consultancy Services. Our infrastructure providers — Supabase, Vercel, Resend (email), our AI providers (OpenAI and Anthropic) and, where scanning is enabled, Google — may process and store data outside the Philippines. Where this occurs, we require that these providers maintain a comparable level of protection for your personal information as required under the Data Privacy Act. By using the Service, you consent to this transfer and processing.
12. Changes to this policy
We may update this Privacy Policy from time to time. We’ll update the “last updated” date above when we do, and material changes will be reflected prominently on this page.
13. Contact us / Data Protection Officer
Questions about this Privacy Policy, requests to exercise your rights, or privacy concerns can be directed to our Data Protection Officer at contact@digitalventuresfz.com.