Privacy Policy
Under the General Data Protection Regulation (GDPR)
1. Controller
The controller within the meaning of the GDPR is:
Larysa Danyuk (sole proprietorship, NIP 5214137319, REGON 543026074)
ul. Jana III Sobieskiego 1/49, 02-957 Warszawa, Poland
E-mail: info@dripscanner.com · Phone: +48 662 642 216
2. What data we collect
At registration: e-mail address, password (stored encrypted), company name
In the producer profile: company name, address, contact details, product information, photos, company documents you upload for verification
Automatically: IP address, browser type, access times (server logs)
When you accept the Terms of Service: the accepted version, the time and the IP address of acceptance — as evidence that the contract was concluded (Art. 6(1)(b) and (f) GDPR); visible in your account settings
Cookies: session cookies for authentication (strictly necessary) and — only with your consent given in the cookie banner — Google marketing cookies (see section 8)
3. Purposes of processing
- Providing the platform and its functions
- Authentication and account management
- Displaying public producer profiles and product listings to buyers
- Communication between buyers and producers (requests for quotation, chat, sample requests)
- Verifying that an account represents a registered business
- Technical security and abuse prevention
4. Legal bases (Art. 6 GDPR)
Art. 6(1)(b) GDPR — performance of a contract: data required to use the platform
Art. 6(1)(f) GDPR — legitimate interests: server logs for security, prevention of fraud and abuse
Art. 6(1)(a) GDPR — consent: the public presentation of your profile, and marketing cookies / conversion measurement (Art. 5(3) ePrivacy Directive as implemented in Polish law); consent can be withdrawn at any time
5. Third-party processors
Supabase (USA) — database and authentication. Data is stored on EU servers (Frankfurt). Privacy policy: supabase.com/privacy
Hostinger (Lithuania) — hosting of the web application (VPS in the EU) and the e-mail mailbox. Privacy policy: hostinger.com/legal/privacy-policy
Stripe Payments Europe Ltd. (Ireland) — card payments. Card details are entered on Stripe's hosted payment page and never reach our servers; we receive the payment status and a payment reference. Privacy policy: stripe.com/privacy
Google Ads / Google tag (Google Ireland Ltd.) — conversion measurement for our advertisements. Loaded only after your consent in the cookie banner (Google Consent Mode v2; without consent all Google signals stay "denied"). Privacy policy: policies.google.com/privacy
Google Ads API (Google Ireland Ltd.) — advertising campaigns that producers order through the platform run in our Google Ads account; Google receives the ad texts, keywords and the landing-page addresses of the advertised listings, never buyer data.
Google Gemini (AI) — automated analysis of product listings (keywords, ad texts, consistency checks) and of company documents uploaded for verification. Only business data provided by the companies themselves is processed; prices and payment data are not transmitted.
Maps — location maps on producer profiles are rendered from OpenStreetMap data (map tiles by the OpenStreetMap Foundation, geocoding via Nominatim). Your IP address is transmitted to load the tiles.
6. Your rights (Art. 15–22 GDPR)
- Access — you may request information about the data we hold about you at any time
- Rectification — inaccurate data can be corrected in your dashboard
- Erasure — close your account (producers: Dashboard → Profile → "Delete Supplier Account"; buyers: Dashboard → Settings)
- Restriction — you may ask us to restrict processing
- Data portability — your data as an export on request
- Objection — by e-mail to info@dripscanner.com
7. Retention
Data is kept for as long as the account is active. After the account is closed, personal data is deleted within 30 days unless statutory retention duties apply (e.g. invoicing and accounting records under the tax and accounting law applicable to us; as a precaution we keep those for 10 years from the end of the calendar year).
8. Cookies
Strictly necessary cookies: session cookies for authentication. They are required to operate the platform and need no separate consent.
Marketing cookies (only with consent): on your first visit a cookie banner asks for your consent. Only if you choose "Accept" does the Google tag set cookies for conversion measurement of our Google Ads campaigns (Google Consent Mode v2). If you decline, all advertising and statistics signals stay off — the platform works without restriction.
Your choice is stored locally in your browser. You can change or withdraw it here at any time:
9. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for the controller is the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland: uodo.gov.pl. You may also contact the supervisory authority of your place of residence.
10. Contact
Questions about data protection: info@dripscanner.com
Last updated: September 2026