Privacy Policy

Who we are

Pinnacle Drop (pinnacledrop.com) is a tool for online store owners: it imports products, makes product photos, ads and social posts with AI, pushes products to Shopify and helps fulfill orders. In this policy "we" means Pinnacle Drop and "you" means the store owner using it.

Questions about privacy: support@pinnacledrop.com.

What we collect

Your account: your name, email address, username and password (stored hashed by our login provider, never readable by us).

Your work: the products you import (supplier links, titles, descriptions, prices and photos), the images, ads, captions and posts you make, your brand details, and your store settings.

Billing: your plan, payments and credits, and the card you save for paying your orders. Card details are handled by Stripe; we only see the card brand, the last 4 digits and the expiry date.

Usage: basic logs such as pages visited, errors and how many AI credits each action used, to keep the service running and fix problems.

Shopify

You connect your Shopify store either from Pinnacle Drop or by installing the Pinnacle Drop app in Shopify and linking it to your account. Either way we receive an access key for the store (stored encrypted) and can read and change the products, themes, discounts, inventory and orders the connection allows, only to do what you ask: push products, build store pages, set up bundles and fulfill orders.

Shopify tells us when an order is placed, changed or cancelled in your store, so it can appear in Pinnacle Drop right away. How we handle your customers' details in those orders is explained in the next section.

When you disconnect your store or uninstall the app, we stop accessing it and delete the access key. Shopify's privacy requests (customer data requests, customer deletion and shop deletion) are handled automatically.

Orders and your customers' details

When you use Pinnacle Drop to fulfill orders, we buy each item from the supplier on your behalf and have it shipped straight to your customer. For your customers' personal details, you are in charge of the data and we process it for you, only to fulfill your orders.

What we receive from your store for each order: the customer's name, shipping address, phone number and email where provided, and what they bought.

What we pass on, and to whom: the customer's name, shipping address and phone number go to AliExpress and the supplier selling the item, so they can ship it and the carrier can deliver it. Some countries also require an ID or tax number for customs, such as a CPF in Brazil; we pass that on only when the destination requires it. We never pass on the customer's email.

What we never do: we don't use your customers' details for marketing, advertising, profiling or AI, we don't contact your customers, and we don't sell or share their details with anyone other than for delivering their order.

Where it goes: suppliers and their warehouses are often in China and other countries, so a customer's shipping details may be processed outside the country they live in, as with any international order.

How long we keep it: we keep the customer's name, address, phone and email for 90 days after the order is delivered or cancelled, so you can handle questions, returns and lost parcels. After that we remove them and keep only what we need for your order history and bookkeeping (the items, amounts, dates and tracking number). If Shopify tells us a customer or your store asked for their data to be deleted, we delete it straight away.

Your part: tell your customers that their shipping details are shared with fulfillment and shipping partners to deliver their order. Shopify's standard privacy policy for your store already covers this.

Paying for your orders

To fulfill orders, you save a card with us through Stripe. We charge it for the orders we buy on your behalf (the item cost and shipping we show you in Pinnacle Drop), usually once a day for that day's orders. Each charge is listed with its orders in Pinnacle Drop. If an order can't be bought from the supplier, we refund it to the same card.

Facebook and Instagram

If you choose to connect a Facebook Page or Instagram account, we receive an access key for it (stored encrypted) and your Page and account names and profile pictures. We use it only to publish the posts you create and schedule in Pinnacle Drop to the Page or account you chose. We don't read your messages, friends, followers' data or ads.

You can disconnect at any time in Pinnacle Drop or in your Facebook settings (Settings & privacy, Business integrations). When you disconnect, we delete the access key.

We never sell data received from Meta, never use it for advertising or profiling, and never share it except with the service providers below that we need to run the feature.

AI processing

To make images, titles, descriptions, ads and posts, we send the relevant product details and photos to our AI provider (OpenAI) through their business API. Under their business terms, this data isn't used to train their models.

We never send your customers' personal details to the AI provider.

Who we share data with

Only the service providers we need to run Pinnacle Drop, each under its own privacy and security terms: Supabase (database, login and file storage), OpenAI (AI generation), Stripe (payments), Shopify (your store), AliExpress (buying and shipping your orders, which includes the customer's shipping address), Meta (only if you connect Facebook or Instagram), and our website host.

We don't sell or rent personal data, and we don't share it for advertising.

We may disclose data if the law requires it, or to protect our users and the service from fraud or abuse.

How long we keep it

We keep your account and your work while your account is open. Things you delete (a product, an image, an ad, a post) are removed from our systems, including their files.

Your customers' personal details from orders are kept for 90 days after the order is delivered or cancelled, as explained under Orders and your customers' details.

When you ask us to delete your account, we delete your account and everything in it within 30 days, except records we must keep by law (such as payment records).

Security

Data is sent over HTTPS and stored with access limited to your own account. Store access keys are encrypted. Only the people who run Pinnacle Drop can access the systems, and only to support you or run the service. Your customers' details are only used by the parts of Pinnacle Drop that fulfill orders.

Your choices and rights

You can see and edit your work in the app, delete products, images, ads and posts yourself, disconnect Shopify, Facebook or Instagram, and cancel your plan.

You can ask us for a copy of your data, to correct it, or to delete it, by emailing support@pinnacledrop.com from your account email. We reply within 30 days. Depending on where you live (for example the EU, UK or California) you may have further rights, which we respect.

How to delete your data is explained on our Data deletion page: pinnacledrop.com/data-deletion.

Children

Pinnacle Drop is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect.