Account details (name, email) when you register, and the profile you choose to publish.
What you post: product submissions (name, URLs, descriptions), votes, reviews, comments, and
the makers, categories, and products you follow.
Data needed to run and protect the service: sign-in sessions and security logs, which include
your IP address and browser.
When you use FastDrop through an AI client (Claude, ChatGPT, Cursor, and others) over MCP: the
tool called, whether it worked, how long it took, the AI client's name, and the IP address the
request came from. We do not log the arguments you send or the results we return.
Listing analytics: page views, outbound clicks, and AI agent lookups per product. These are
counted per product and per AI client, not per person. To count how many different accounts
and AI sessions look a product up, and how many come back, a lookup also stores a keyed code
for the signed-in account or the anonymous MCP session behind it. The code is different for
every product and is erased after 35 days; the raw account or session id is never stored.
Website visits: we count page visits with Rybbit, a cookieless analytics tool that runs on our
own server. It records the page, referrer, browser, device type, and approximate country,
never sells or shares it, and does not follow you across other sites.
Newsletter: your email address, the one answer you gave when you signed up (I build products,
or I invest in or acquire products) and where you signed up (the site form or the submit
form). This lives in Listmonk, the self-hosted newsletter tool that sends FastDrop Weekly.
"Open to": if you mark a product you own as open to acquisition, investment, or partnership,
we store the options you ticked, your optional note, the revenue band, funding stage and team
size you choose to state (each optional), and when you set and changed them.
Following someone is private: makers are never told who follows them, and nobody can see a list
of followers. Visitors see a follower count only once it reaches 10.
How we use data, and why we may
To provide FastDrop (your account, listings, votes, reviews, follows, notifications,
and AI client access) - because you asked us to (contract).
To keep it secure and free of abuse (security logs, rate limits, spam and fraud
checks) - our legitimate interest in a safe service.
To understand and improve the site (cookieless visit counts on our own server)
- our legitimate interest.
To show makers how their listing is found (aggregate analytics with no personal
data) - our legitimate interest.
To send the newsletter - your consent, which you can withdraw any time. FastDrop
Weekly is double opt-in: Listmonk emails you a confirmation link, and nothing is sent until you
click it.
To introduce makers to investors and partners - your consent, given by setting
"Open to" on a product. We show the product, your public maker profile, the options you ticked,
your note, and any revenue band, funding stage or team size you stated (labelled as stated by you,
not checked by us) to the FastDrop team and to subscribers of the paid investor edition of FastDrop
Weekly. It is never shown on your listing, to other makers, or to AI agents, and it never affects
rank. Clear it any time and it is no longer shared from then on. Opt-ins saved before October 22,
2026 were made when only the FastDrop team saw them: we will not show those to investors unless
you confirm.
Apart from the "Open to" details you choose to share with investor-edition subscribers, we do
not sell or share personal data, and we do not use it for advertising or to train AI models.
How long we keep it
Old data is erased automatically every day. When a period below ends, the data is deleted, not
archived.
Your account and profile
Until you delete your account.
Products, votes, reviews, comments, follows
Until you delete them or your account. A review or comment you delete is hidden right away and erased for good after 30 days.
Sign-in sessions (with IP address and browser)
Until you sign out, or after 365 days without use; erased 7 days after they expire.
Email verification and password-reset links
Erased 7 days after they expire.
AI client connections (OAuth tokens)
Connection and usage timestamps are removed when you disconnect the app, delete your account, or the inactive client is cleaned up. Access tokens are erased 7 days after they expire; refresh tokens 30 days after they expire or are revoked.
MCP request logs (tool name, result, timing, AI client name, IP address)
30 days. After that only daily totals per tool remain, with nothing that identifies you.
Security logs (sign-ins, failed attempts, blocked requests, with IP address)
90 days.
Listing analytics (page views, clicks, AI agent lookups)
90 days. These record which product was viewed and by which AI client, never who you are.
Which account or session looked up a product through MCP
35 days, as a keyed code that is different for every product, so it cannot show what one person looked at across FastDrop. After that only daily counts of unique accounts and sessions per product remain.
Notifications
Read notifications are erased after 90 days; unread ones stay until you read them.
API keys
Until you revoke them; revoked keys are erased after 90 days.
Webhook delivery logs
30 days.
Edit history, ownership claims, and abuse reports
180 days after they are decided.
Newsletter subscription (FastDrop Weekly)
Until you unsubscribe. Your email, your one answer (builder or investor), where you signed up and, if you joined the investor waitlist, the price you picked and what you do are held in Listmonk, our self-hosted newsletter tool, on one of two lists (builders or investors), which sends the confirmation email and every issue. We then keep your email only on a do-not-send list, so we never email you again.
Newsletter link clicks (Listmonk)
Listmonk records which links each subscriber clicked so we can tell what was worth reading, and deletes those per-subscriber click records after 90 days. What FastDrop keeps is a total per product and issue - never who clicked.
Newsletter signups waiting to reach Listmonk
30 days. If Listmonk is unreachable when you sign up we queue the address and retry; the queued row is deleted as soon as it syncs, and erased 30 days after a failed sync.
Records of moderation and administrative actions
Up to 1 year. A record that an account was deleted is kept as long as needed to show the request was honoured.
Your controls
You can do all of this yourself, any time, without asking us:
Delete your account in Account settings - we email you a confirmation link (valid
24 hours). Deleting it erases your profile, products, votes, reviews, comments, follows, notifications,
API keys, webhooks, sessions, and AI client access. Only the records listed above as kept for legal
reasons remain.
Delete a product, review, or comment from the product's page or its edit page.
Unfollow anything from its page or from your dashboard.
Stop sharing "Open to" by clearing it on the product's edit page, or with the set_open_to tool from your AI client.
Disconnect an AI client in Account settings under Connected AI apps. Its access ends
immediately and its tokens are deleted.
Unsubscribe from the newsletter with the link at the bottom of every email - it
goes to Listmonk and takes effect immediately, including the manage-preferences page for changing
your email or wiping your subscriber data.
Your rights
Under the GDPR you can ask us for a copy of your data, to correct it, to erase it, to restrict
or object to how we use it, or to receive it in a portable format. Email from your account's address; we reply within one month. You can also complain to
the Italian data protection authority, the Garante per la protezione dei dati personali.
Who else handles data
Our hosting and email delivery providers store and send data on our behalf, under contract and
only for that purpose. If you sign in with Google, Google confirms your identity.
Investor-edition subscribers see the "Open to" details described above. We share nothing else
unless the law requires it.
Cookies and browser storage
We use only essential cookies, to keep you signed in and to complete sign-in with Google or an
AI client. Your browser also stores your light/dark theme and any unfinished submission draft
locally. Our visit counting (Rybbit) sets no cookies. No advertising or third-party tracking
cookies.