Privacy Policy

Last updated: May 2026

1. Who we are

Drop The Fit is operated by Drop The Fit Ltd, a company registered in England and Wales, with a registered office at Wyke House, Mill Road, Bergh Apton, Norfolk, NR15 1BQ.

For the purposes of data protection law, we are the data controller. This means we decide how and why your personal data is processed.

If you have any questions about this policy or how we handle your data, contact us at [email protected].

2. What this policy covers

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have. It applies to our website at dropthefit.app, our mobile application, and any related services.

3. What personal data we collect

Data you give us directly

When you create an account, book a session, or use our services, we may collect:

• Name and email address
• Instagram and TikTok handles
• Profile photos you upload
• Body measurements and style preferences (if you choose to provide them as a client)
• Payment information (processed by Stripe -we do not store your card details)
• Messages, images, and voice notes sent during styling sessions
• LookBook content created by influencers
• Reviews and ratings
• Any information you include in the contact form on our website

Data we collect automatically

When you use our website or app, we may collect:

• Device information (device type, operating system, browser type)
• IP address
• Usage data (pages visited, features used, session duration)
• Crash reports and performance data
• Cookies and similar technologies (see section 9)

Data from third parties

• If you sign in via Google or Apple, we receive your name and email address from those services
• Affiliate purchase data from our affiliate network partners (Awin and others), including order amounts and commission earned, linked to your account
• If you connect an Instagram professional account to use our auto-reply feature, we receive your Instagram account ID, username, and an access token from Meta

Data from connected Instagram accounts (auto-reply feature)

If you are a creator and choose to connect your Instagram professional account, we use the Instagram API with Instagram Login (provided by Meta) to operate an optional keyword auto-reply feature. With your permission, we receive and process:

• Your Instagram account ID, username, and a long-lived access token
• The content of comments and direct messages sent to your account, solely to check them against the keyword rules you configure
• The Instagram-scoped ID of the person who comments or messages, used only to send them your automated reply

We do not store the content of comments or messages beyond what is needed to evaluate your keyword rules in real time, and we do not message anyone unless they first comment on or message your account with a keyword you have set up. You can disconnect your Instagram account at any time from your dashboard, or by removing our app from your Instagram settings, which deletes the stored connection and access token. Our use and transfer of information received from the Instagram API adheres to the Meta Platform Terms, including the limited use requirements.

4. Why we collect your data and our legal basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Performance of a contract -Processing necessary to provide our services to you, including creating your account, facilitating bookings between influencers and clients, processing payments, delivering LookBooks, and enabling chat and video sessions.

Legitimate interests -Processing necessary for our legitimate business interests, where those interests are not overridden by your rights. This includes improving our services, preventing fraud, ensuring platform security, and analysing usage patterns to develop new features.

Consent -Where you have given us specific consent to process your data for a particular purpose, such as sending you marketing emails or using optional analytics cookies. You can withdraw consent at any time.

Legal obligation -Processing necessary to comply with our legal obligations, such as tax and financial reporting requirements.

5. Body measurements and sensitive style data

If you are a client, you may choose to provide body measurements and personal style preferences to help influencers give better advice. This data is optional. You are never required to provide it. It is stored securely and only shared with influencers you book sessions with. You can delete this data at any time from your account settings.

6. Who we share your data with

We share your personal data only where necessary to provide our services or where we have a legal obligation. We never sell your data.

Influencers you book with -When you book a session as a client, the influencer you book receives your name, any intake form responses, style preferences, and body measurements you have provided. They need this to deliver the styling service.

Clients who book you -When you receive a booking as an influencer, you receive the client's name and intake form responses.

Payment processors -Stripe processes all payments and payouts. Stripe acts as an independent data controller for payment data. See Stripe's privacy policy at stripe.com/privacy.

Affiliate network partners -When a client clicks an affiliate link in a LookBook, the affiliate network (such as Awin) receives click and purchase data to track commissions. This data is linked to the influencer's affiliate account, not the client's personal identity.

Video call provider -Daily.co provides our video call infrastructure. Session video data passes through their servers. See Daily.co's privacy policy at daily.co/privacy.

Email provider -We use Resend or a similar service to send transactional and marketing emails.

Hosting and infrastructure -Our services are hosted on Netlify (website), Render (application backend), Cloudflare (content delivery, DNS, and file storage), and MongoDB Atlas (database). Data is stored in data centres located in the United Kingdom and European Economic Area.

Analytics -We may use privacy-respecting analytics tools to understand how our website and app are used. We do not use analytics that track individual users across other websites.

Law enforcement -We may disclose data if required to do so by law or in response to a valid legal request from a law enforcement authority.

7. International transfers

We aim to keep your data within the United Kingdom and European Economic Area. Where data is transferred outside these regions (for example, if a service provider processes data in the United States), we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office.

8. How long we keep your data

We retain your data only for as long as necessary for the purposes described in this policy.

• Account data -Kept for the lifetime of your account, plus 12 months after account deletion to handle any outstanding disputes or financial obligations.
• Session content (messages, LookBooks, recordings) -Kept for the lifetime of your account. Session recordings are deleted 90 days after creation.
• Payment records -Kept for 7 years to comply with UK tax and accounting requirements.
• Contact form submissions -Kept for 12 months, then deleted.
• Analytics data -Aggregated and anonymised within 26 months.

When data is no longer needed, it is securely deleted or anonymised.

9. Cookies

Our website uses cookies. Cookies are small text files stored on your device.

Strictly necessary cookies -Required for the website to function. These do not require consent. They include session cookies and security cookies.

Analytics cookies -Used to understand how visitors use our website. These are only placed with your consent. You can accept or reject analytics cookies when you first visit the site, and change your preference at any time.

We do not use advertising or tracking cookies. We do not allow third parties to place cookies on our website for advertising purposes.

10. Your rights

Under UK GDPR, you have the following rights:

Right of access -You can request a copy of the personal data we hold about you.

Right to rectification -You can ask us to correct inaccurate data or complete incomplete data.

Right to erasure -You can ask us to delete your data. We will do so unless we have a legal obligation to keep it (such as financial records).

Right to restrict processing -You can ask us to temporarily stop processing your data in certain circumstances.

Right to data portability -You can request your data in a structured, commonly used, machine-readable format so you can transfer it to another service.

Right to object -You can object to processing based on legitimate interests. We will stop unless we have compelling grounds to continue.

Right to withdraw consent -Where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

Rights related to automated decision-making -We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

To exercise any of these rights, email us at [email protected]. We will respond within one month. If your request is complex, we may extend this by a further two months and will let you know.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (HTTPS/TLS), encryption of data at rest, access controls limiting who can view your data, regular security reviews, and secure deletion of data when no longer needed.

No system is completely secure. If we become aware of a data breach that poses a high risk to your rights, we will notify you and the Information Commissioner's Office as required by law.

12. Children

Drop The Fit is not intended for anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through a notice on our website or app. The “last updated” date at the top of this page indicates when this policy was most recently revised.

14. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address your concern before you contact the ICO. Please reach out to us first at [email protected].

15. Contact

For any questions about this privacy policy or your personal data:

• Email: [email protected]
• Postal address: Drop The Fit Ltd, Wyke House, Mill Road, Bergh Apton, Norfolk, NR15 1BQ