Privacy Policy

DRIP (trading name — company registration pending) is the data controller for personal data processed through this website. Registered address: Italy — full registered address to be published at incorporation. VAT number to be published at incorporation.

Privacy contact: privacy@dripcream.co. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

• Waitlist data: email address, language, timestamp.
• Order data: name, email, shipping and billing address, phone (if provided), order contents, order value, delivery country.
• Payment data: processed exclusively by our payment providers. We never see or store your full card number.
• Support data: anything you write to us by email.
• Technical and usage data: IP address, device and browser type, pages viewed, referrer. Analytics data is only collected if you accept analytics cookies.

• Processing your preorder and refunds — performance of a contract (Art. 6(1)(b) GDPR).
• Waitlist signup and launch emails — your consent (Art. 6(1)(a) GDPR), withdrawable at any time.
• Analytics and product improvement — your consent through the cookie banner (Art. 6(1)(a) GDPR).
• Fraud prevention and site security — our legitimate interest (Art. 6(1)(f) GDPR).
• Accounting, tax and consumer-law obligations — legal obligation (Art. 6(1)(c) GDPR).

We do not sell your data. We share it only with providers that help us run the shop:

• Shopify — e-commerce, checkout, order and customer management.
• Payment providers (Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay) — payment processing and fraud checks. They act as independent controllers for their own compliance duties.
• Supabase — database hosting for waitlist signups (EU region).
• PostHog — privacy-focused product analytics (EU region), only with your consent.
• Hosting and CDN providers — serving this website.
• Shipping carriers — delivering your order.

Each processor is bound by a data processing agreement under Art. 28 GDPR. We may also disclose data where required by law.

We prefer EU-hosted services. Where a provider processes data outside the European Economic Area (for example in the United States), the transfer is covered by the European Commission's Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework, together with appropriate supplementary measures.

• Waitlist email: until you unsubscribe, or 24 months after the last interaction.
• Order and invoicing data: 10 years, as required by Italian tax law.
• Support emails: 24 months.
• Analytics data: 14 months maximum.
• Cookie consent record: 12 months.

Under Articles 15–22 GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing, including direct marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting past processing;
• lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

To exercise any right, email privacy@dripcream.co. We respond within one month.

We do not carry out automated decision-making or profiling that produces legal effects concerning you. Payment providers may run automated fraud checks on transactions.

The site is served over HTTPS, access to personal data is restricted to the people who need it, and data at rest is encrypted by our providers. No system is perfect: if a breach affects your rights, we notify the supervisory authority within 72 hours and you without undue delay.

This site is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

We may update this policy. Material changes will be announced on this page and, where required, by email. The date at the top always reflects the current version.