Privacy policy

Account data: email address, name, a hashed password, and your country and currency preferences.

Searches: the images, video frames, links or words you submit, the text of the store pages you give us (read to tell what is sold), the product analysis, the results and any price you enter. Videos never leave your device: only a few still frames are sent.

Usage data: number of searches, clicks on results, and a hashed IP address used to prevent abuse. The hash is salted and changes every day, so it can't be traced back over time.

Sign-in sessions, including a guest's: for each browser you use Undrop in, a salted hash of its network's IP address (never the address itself) and the browser and device type it reports, to keep your account secure.

An email key: a salted hash of your email address in its simplest form (lower case, without the dots of a Gmail address or a “+” tag), with this month's advanced searches and any suspension. It lets us keep one account per person: refuse a second account for the same address, count advanced searches per person and keep a suspension in place. Your address can't be read back from it.

API keys: for each key you create, its name, its first characters and a hash of it (never the key itself), when it was created and last used, and the searches made with it, which are processed and kept like your other searches.

If you buy on AliExpress or Alibaba through our link: our affiliate network, Admitad, reports the order (number, product or store, amount, commission and status) with the code of your click, never your identity. That code ties the order to your click, and through it to your search and, if you were signed in, to your account: it serves to measure what searches bring in.

The Undrop extension for Chrome reads the page you are on, inside your browser, to tell whether it sells a product you can add to a cart. That reading stays in your browser: the extension sends nothing about the pages you visit and keeps no history of them.

When you click its button, or the search button in its window, it opens Undrop in a new tab with the address of that product page, and the search runs like any link you give us (see “What we collect”). On a large marketplace such as AliExpress or Temu, it sends the address of the product's photo, with the address of the page and the price the page states, so the comparison starts from that price (never Amazon's price). Its settings, whether the button shows and the sites where you hid it, are kept by Chrome in your browser, and synced with your other computers if you use Chrome sync.

To run your searches and show your history (performance of our contract with you), to enforce limits, keep one account per person and keep the service secure (legitimate interest), to measure clicks, and the orders they lead to, for affiliate reporting and to know what searches bring in (legitimate interest).

Uploaded originals are deleted as soon as the search ends. We keep a reduced copy of the analysed image, the product crop, the words you typed and the results in your history until you delete them or your account.

Guest searches are deleted after 30 days, cached results after 24 hours, and click logs after 13 months. A sign-in session, with its hashed address and browser type, is deleted when you sign out of that browser, or once it expires, 30 days after it was last used.

When you delete your account, its email key is kept for three years, so that the same address can't get around a suspension; it is then erased. Its count of this month's advanced searches is kept until the end of the following month. Affiliate orders are kept for our accounts and detached from your account when you delete it.

When we withdraw a feature, the data it collected is kept for the periods stated in this policy, then erased.

Vercel (hosting and file storage), Neon (database), OpenRouter (image analysis, passed on to the AI model provider selected, currently Google), Upstash (product isolation: the queue that passes the product crop to our own computer, which cuts the product out), SerpApi (visual search through Google Lens, Google Shopping for the words you type, and Google web search for a replacement part), AliExpress (product search: only the product crop and search keywords are sent) and Resend (emails).

Some of these companies are outside the European Union, and outside Quebec and Canada. Transfers from the European Union rely on the European Commission's standard contractual clauses or an adequacy decision; before personal information leaves Quebec, we assess that it will be adequately protected there, as Quebec law requires.

You can access, export and correct your data, and delete your account at any time from your account page. You can also withdraw a consent you gave, object to processing based on legitimate interest, and complain to a data protection authority: in Quebec, the Commission d'accès à l'information du Québec; in France, the CNIL; elsewhere in the European Union, the authority of your country.

For any request: fcarreau@gmail.com.

Francois Carreau, dir. information, is in charge of the protection of personal information at Undrop. Write to fcarreau@gmail.com for any question, request or complaint about your personal information: we answer within 30 days.