Privacy Policy
Last updated: November 2, 2026
This Privacy Policy explains how [BUSINESS ENTITY] ("ZipDrop", "we", "us") collects, uses and protects information when you use zipdropapp.com and the ZipDrop service. ZipDrop turns new MLS listings into Instagram carousel drafts that real estate agents review and approve.
Information we collect
Waitlist. When you join the waitlist we collect your name, email address, ZIP code, brokerage (optional) and any message you send us.
Agents (subscribers). When you become a ZipDrop customer we collect your name, email address, brokerage, California DRE license number, Instagram handle, the ZIP codes you subscribe to, and your subscription status.
Payments. Payments are processed by Stripe. Stripe collects and stores your card details. ZipDrop never receives or stores your full card number.
Instagram data. If you connect Instagram, we access only:
- your Instagram professional account ID and username (to show which account is connected and post to the right account), and
- permission to publish content to that account (to publish posts you have approved).
We do not read your direct messages, comments, followers, insights or any other Instagram data. Your Instagram access token is encrypted at rest.
Listing data. Listing information (address, price, photos, description, listing agent and office) comes from MLS data feeds under each agent's own MLS authorization.
How we use information
- To provide the service: building listing post drafts, showing them to you for approval and, once you approve, publishing them to your Instagram account.
- For billing through Stripe.
- To provide customer support.
- To send product updates about the service you use.
Listing data is used only to create posts for the agent whose MLS authorization provided it. Instagram data is used only to publish posts that the agent has approved.
Service providers
We share information only with providers that help us run ZipDrop, under contracts that limit their use of it:
- Supabase: database, file storage and admin login.
- Vercel: website hosting.
- Stripe: payments and subscription billing.
- Meta (Instagram): only when publishing a post you approved.
Post drafts are written on our own server by a locally hosted language model. Your data is not sent to third-party AI services.
We do not sell your personal information
We do not sell or share personal information for cross-context behavioral advertising.
Retention
- Waitlist information is kept until you ask us to remove it.
- Agent information is kept for the life of your subscription plus 12 months, then deleted, unless the law requires us to keep it longer (for example, billing records).
- Listing data is deleted when the agent cancels or when the MLS revokes access.
- Instagram tokens are deleted when you disconnect Instagram, remove ZipDrop from your Instagram settings, or ask us to delete your data.
Your California privacy rights
California residents have the right to:
- know and access the personal information we hold about them,
- request deletion of their personal information,
- correct inaccurate personal information, and
- not be discriminated against for exercising these rights.
To make a request, email [CONTACT EMAIL]. We will verify your identity before acting on it and respond within 45 days.
Deleting your data and disconnecting Instagram
See our Data Deletion page for step-by-step instructions. You can also email [CONTACT EMAIL].
Security
We encrypt data in transit (HTTPS) and encrypt Instagram tokens at rest. Database access is limited by row-level security, and only authorized administrators can sign in to the admin console. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.
Children
ZipDrop is a business service for licensed real estate professionals. It is not directed to anyone under 18.
Changes
If we change this policy, we will update the "Last updated" date and, for material changes, notify subscribers by email.
Contact
[BUSINESS ENTITY] Email: [CONTACT EMAIL]