This Privacy Policy describes how dropwrk ("we", "us", the "Service") collects, uses and protects information when you use the dropwrk application and its website. dropwrk is designed so document files stay in your Google Drive, with no second document store held by us. When selected, the built-in AI agent (BETA) automatically classifies and analyses uploaded documents using Google services. Extracted data and metadata are stored in your Google Sheets. Google does not retain content after analysis. If you choose to connect your own external AI assistant, content is provided to it only following your explicit request and authorization.
1. Controller and contact
The data controller is dropwrk. For any privacy-related questions, contact us at privacy@dropwrk.com.
2. What data we collect
2.1. Identity data
When you sign in with Google Sign-In we receive your name, email address and profile picture via the standard openid, email, profile scopes. This data is used solely to create and manage your user profile.
2.2. Organization data
- Names of organizations, locations and memberships (owner/member/viewer roles);
- Email invitations to team members;
- Usage counters (number of uploaded documents and pages);
- An audit trail of administrative actions (who, what, when).
- Identifiers, processing statuses and temporary AI extraction claims, without a document copy.
2.3. Access tokens
To write files into your Google Drive we store the organization owner's Google refresh token in encrypted form. We also store QR tokens for scanner sessions. Access to this data is restricted via Row Level Security.
3. Documents and AI processing
- We do not store copies of your documents. Image bytes pass transiently through our upload endpoint and are written directly into your Google Drive. dropwrk keeps no copy of any page.
- When selected, the built-in AI agent (BETA) uses Google services for automatic classification and analysis on upload. It extracts specific invoice data and metadata from contracts and other documents;
- Google does not retain content after AI analysis. Results are stored in your Google Sheets and documents in your Google Drive;
- We use no analytics tools, trackers or session replay — especially on the scanner and invoice pages;
- Invoice content never appears in logs, metrics or backups.
4. Use of Google API data
dropwrk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4.1. Scopes
- openid, email, profile — used only for sign-in identification;
- https://www.googleapis.com/auth/drive.file — grants access only to the files and folders the application itself has created (the "Invoice Inbox" folder and the "Invoice Register" spreadsheet). dropwrk has no access to the rest of your Google Drive.
4.2. How we use this access
- Creating a folder structure in your Google Drive for incoming documents;
- Writing scanned JPEG pages into those folders;
- Creating and appending rows in the "Invoice Register" spreadsheet in your Google Sheets.
- For automatic AI analysis (BETA) or following your explicit request through a connected MCP client, reading files created by dropwrk and writing extracted fields and metadata back to the register. For scanned PDFs, Google Drive may temporarily extract text through OCR; the intermediate Google Doc is deleted.
We never use Google API data for advertising, never sell it and never share it with third parties except as necessary to provide the Service, when explicitly requested by you through a connected MCP client, or as required by law.
5. Storage and protection
- Identity and organization data are stored in a secure database (Supabase) with Row Level Security;
- Google refresh tokens are stored encrypted;
- All communication happens over HTTPS with a strict Content Security Policy;
- Scanner sessions are authenticated with a signed cookie valid for 2 hours.
6. Sharing with third parties
We do not sell or rent personal data. We use the following processors solely for the technical operation of the Service: Google Drive, Google Sheets, Sign-In APIs, Google AI analysis services, Supabase (authentication and database) and Vercel (hosting). If you connect your own ChatGPT, Claude or another compatible MCP client, your chosen provider may receive document content when you request it. That provider is selected and managed by you, and its own terms and privacy policy apply.
7. Cookies
We use only strictly necessary cookies: a session cookie for sign-in and a signed scanner cookie valid for 2 hours. We use no advertising or analytics cookies.
8. Retention and deletion
- Profile and organization data are kept while the account is active;
- You can revoke dropwrk's access to your Google account at any time from Google Account → Security → Third-party access. The files in your Google Drive remain yours and untouched;
- Upon an account deletion request to privacy@dropwrk.com we delete the profile, organization data and stored tokens without undue delay.
9. Your rights (GDPR)
If you are located in the EU/EEA, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can exercise these rights via privacy@dropwrk.com, and you may lodge a complaint with your supervisory authority — for Bulgaria this is the Commission for Personal Data Protection (CPDP).
10. Changes to this policy
For material changes we will publish the updated policy on this page and update the "Effective date". Continued use of the Service after a change constitutes acceptance of the updated policy.