Drop Room
Privacy
What we collect, why we are allowed to, who else sees it, and how to make us delete it. This describes the version of Drop Room that exists today, not one we intend to build.
1. Who we are
YOUR COMPANY NAME LTD, company no. 00000000, registered at YOUR REGISTERED ADDRESS, is the data controller for everything described here.
Contact us about anything on this page at YOUR@EMAIL.
We run the brands Kovelle and VH Life, and Drop Room is the creator community that supports them.
2. What this covers
Three separate things, and they collect different amounts:
- This website. The page you are reading and the landing page it links from.
- The Drop Room Discord server. Where the community actually is.
- Sending you product and paying you commission.
Discord is not ours. While you are in the server, Discord is processing your data too, under its own privacy policy and as its own controller. Nothing we write here changes what Discord does. If that matters to you, read theirs as well.
3. The website
As it ships, the website collects nothing. There is no account, no form, no analytics, and it sets no cookies and writes nothing to your browser's storage.
Two things still happen that involve someone else:
- Google Fonts. The page loads one typeface from Google. To send you the font file, Google receives your IP address and the fact that a browser asked for it.
- Hosting. The site is served by Cloudflare Pages, which keeps ordinary server logs, including IP address and browser user agent, to serve the page and to defend against attacks.
Advertising measurement
We advertise on Meta. If you accept the cookie notice on the landing page, a Meta pixel loads and tells Meta that a browser reached our page and what it did there, so we can tell which adverts are worth paying for. It sets cookies in your browser.
If you decline, or ignore the notice, the pixel never loads and no cookie is set. Declining changes nothing about the page or about your ability to join. You can change your mind later from the link in the footer.
4. The Discord server
This is where nearly all of it is. We keep our own database, separate from Discord's.
When you join
Your Discord user ID, username, display name and avatar, and the answers you give to the onboarding questions about your platform, niche and audience size.
When you apply to a brand
Your TikTok handle, your Instagram handle, roughly how many followers you have, what you post about, an optional free-text note, and which brands you applied to. Stored against your Discord user ID with the date, and whether we approved or declined it.
When you ask for product
Which brand, which product, and the state of the request. To actually post it to you we need a delivery name, address and a contact number, which you give us at that point and which we pass to whoever ships that brand's orders.
While you are a creator
- Your discount code and tracking link, and whether your account has been verified.
- How many posts you have logged, and the sales recorded against you: an amount, a short note, and which month it fell in.
- Any prize you win and which month you won it.
- Payment details you give us so we can pay you, which is a PayPal address or bank details.
What you post
Messages, images, threads and reactions in the server, visible to whoever has access to that channel. Treat anything you post in a shared channel as seen by everyone in it.
5. Mia and Anthropic
Mia is an assistant that answers questions in the server. When you talk to her in a channel where she is active, your message, your Discord display name, and up to the six messages immediately before yours in that channel are sent to Anthropic to generate the reply. Anthropic processes it to produce the answer and does not use it to train models.
We do not keep a separate copy of Mia conversations beyond the ordinary channel history that every message has. Even so, do not put anything into a conversation with her that you would not want leaving the server.
6. Why we are allowed to
UK GDPR requires a lawful basis for each purpose. Ours:
| What for | Lawful basis |
|---|---|
| Running the community, moderating it, answering questions | Legitimate interests. We cannot run a community without knowing who is in it |
| Deciding on your application | Steps taken at your request before entering a contract |
| Sending you product, and paying you commission | Performance of a contract with you |
| Keeping sales and payment records | Legal obligation under UK tax law |
| Spotting self-buying, fake orders and bought engagement | Legitimate interests, protecting the brands from fraud |
| Advertising measurement via the Meta pixel | Your consent, which you can withdraw at any time |
| Serving the website and keeping it up | Legitimate interests, security and availability |
7. Who else sees it
- Discord, because the community runs on their platform.
- Anthropic, and only the messages described in section 5.
- Railway, which hosts the bot, so our database sits on their infrastructure.
- Cloudflare, which hosts the website.
- Meta, but only if you accepted the cookie notice.
- Shopify, and the fulfilment and payment providers behind Kovelle and VH Life, for getting product to you and money to you.
- Moderators of the server, who can see applications and creator records in order to run the thing.
We do not sell your data, and we do not hand it to anyone else for their own marketing.
Some of those companies are outside the UK, mainly in the United States. Where that happens the transfer relies on UK adequacy regulations, or on the International Data Transfer Addendum to the EU standard contractual clauses.
8. How long we keep it
| What | How long |
|---|---|
| A declined application | 12 months, then deleted |
| An approved application, and your creator record | While you are active, plus 12 months |
| Sales, commission and payment records | 6 years from the end of the tax year they fall in, because HMRC requires it |
| Delivery addresses | Held by the brand's fulfilment provider under its own retention period, not kept in the community database |
| Messages you post in the server | Until you or a moderator deletes them, or the server closes |
| Website server logs | Cloudflare's standard retention |
9. Under 18
Discord's own minimum age is 13, and we do not knowingly hold data for anyone younger. If we find that we do, we delete it.
You are welcome in the community below 18, but you cannot receive product or be paid commission until you are 18, unless a parent or guardian is running the account and dealing with us directly. TikTok Shop applies its own 18+ rule regardless of ours.
10. Your rights
Under UK GDPR you can ask us to give you a copy of what we hold, correct it, delete it, restrict what we do with it, hand it over in a portable format, or stop processing it where we rely on legitimate interests. Where we rely on your consent you can withdraw it at any time, and that does not make anything we did beforehand unlawful.
Email YOUR@EMAIL. It is free, and we will respond within one month.
Leaving the server stops us collecting anything new, but does not delete what we already hold. If you want it gone, email us and say so. We will delete everything except the sales and payment records we are legally required to keep.
If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can fix it.
11. Security
The database sits on the host that runs the bot, and access to it is limited to the owner and the moderators who need it to do their job. Access inside Discord is controlled by role, so most channels and records are not visible to most members. API keys are held as environment variables and are not in the code.
No system is completely secure, and we are not going to pretend otherwise. If we ever have a breach that is likely to be a risk to you, we will tell you and the ICO.
12. Changes
If we change this page, the date below changes with it. If a change is material, we will post it in the server rather than hoping you notice.
Last updated 25 August 2026.