Privacy policy

Last updated 21 October 2026

This policy covers the DropRiff website and waitlist. We collect as little as we can and never sell your data.

Who is responsible

DropRiff, run from the Netherlands, is the controller for the data described here. Contact: hello@dropriff.com.

The waitlist

When you join the waitlist we store:

We use this to email you about the DropRiff launch, and the artist and country information to decide which stores and genres to add first. The legal basis is your consent (Article 6(1)(a) GDPR). We ask you to confirm by email before you’re added, and every email has an unsubscribe link.

Unconfirmed signups are deleted after 30 days. Everything else is deleted when you unsubscribe or when the waitlist ends, whichever comes first.

Before the public launch we invite some people from the waitlist to a private beta. If we invite you, we create an account for your email address that can see the beta, note when we invited you, and email you a sign-in link. You don’t have to use it; you can delete that account like any other (see below).

Your account

You sign in with a link we email you; we never store a password. An account holds your email address, the artists you follow, the products on your wishlist, your shipping country, the categories you chose, whether you want the weekly email (and when you opted in), when you last signed in, and, if you’re a beta tester, when you were invited. Sign-in links are deleted after a day.

We also note on which days you used your account: the date only, not the time, pages or anything you looked at. That tells us whether people come back, one of the few things we measure to decide whether DropRiff works. The legal basis is our legitimate interest in knowing whether the service is useful (Article 6(1)(f) GDPR).

We use this to show you your artists’ merch and, only if you opted in, to send the weekly email. That email lists new merch and tour dates from your artists, and wishlist items that are back in stock or cheaper; we keep a record of when each one was sent and how many items it had, and every email has a one-click unsubscribe link. The legal basis is the contract with you for the account itself (Article 6(1)(b) GDPR) and your consent for the weekly email (Article 6(1)(a)). On your account page you can download all of it as a file or delete your account; deleting is immediate and removes everything listed here, including feedback you sent while signed in.

Services we use

Each processes data only on our behalf, under a data processing agreement. Because they are US companies, data may be transferred to or accessed from the United States. Those transfers are covered by the EU Standard Contractual Clauses in each agreement and, for companies certified under it, the EU–US Data Privacy Framework.

Clicks to stores and ticket sellers

When you click “Go to store”, we count that click: which product and store, the shipping country you selected, the DropRiff page you came from, and the time. A click on a concert’s ticket link is counted the same way: which show, artist and ticket seller, the country you selected, the page and the time. We don’t store your IP address or anything that identifies you, so these counts can’t be linked to a person. We use them to show popular products and to see which stores and ticket sellers people choose. The store or ticket seller you go to has its own privacy policy, and affiliate networks may set their own cookies when you arrive there.

Usage statistics

To see which parts of DropRiff people use, we keep counters per day: how many times each type of page and each product page was viewed (for example “product pages: 120 views on 15 October”), and how often each search was made and whether it found anything. Stores we list get these numbers for their own products in a monthly report, as totals only. Searches are stored as text in lowercase without punctuation; anything that looks like an email address is left out and long numbers are replaced. These counters have no link to a visitor: no cookies, no IP addresses, no visitor ids. Visits that look automated (search engine robots and similar) aren’t counted.

Feedback and problem reports

When you send feedback with the Feedback button, we store your message, the DropRiff page you sent it from and the time. When you report a problem with a listing, we store the product, the store if you pick one, what’s wrong, your note and the time. If you’re signed in, it’s linked to your account so we can reply; if you’re not, we only have an email address if you choose to give one. We use this to fix and improve DropRiff (legitimate interest, Article 6(1)(f) GDPR) and delete it after 12 months, or sooner if you ask. Stores see only how many problems were reported about their items, never who reported them.

Messages from stores, labels and artists

When you use the contact form on our “For stores & artists” page, we store your name, email address, the store, artist or label you write for, its website if you give it, your message and the time. We use this only to reply and to discuss listing your products (steps before a possible agreement, Article 6(1)(b) GDPR) and delete it after 12 months, or sooner if you ask. If we end up working together, the email conversation is kept as the record of your permission.

For stores we list, we keep the email address you give us for the monthly store report, until you ask us to stop sending it or your listing ends. The report contains counts only, never anything about individual fans.

Images

Product photos come from the stores and artist photos from Wikimedia Commons, but your browser loads them from dropriff.com: we fetch and cache them ourselves, so those sites don’t see your visit or your IP address. Images in our emails work the same way.

Cookies

We set at most two cookies, both needed for things you ask for:

Neither is used for tracking. We use no advertising or analytics cookies; visitor statistics are cookie-free and fonts are served from our own domain.

The people who run DropRiff also get dr_admin when they sign in to the site's admin area. It lets them fix listings while browsing the store and lasts up to 30 days. Visitors never get it.

If you don’t pick a country, we estimate it from your network location for that page view only, without storing it.

Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. You can withdraw consent at any time by unsubscribing or emailing us. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

If we change this policy, we’ll update the date above and, for significant changes, tell people on the waitlist.

Feedback