Privacy Policy

Last updated October 9, 2026

This policy explains what personal data Dronrly collects, why, who we share it with, how long we keep it, and the rights you have. It applies to dronrly.com, the Dronrly app and the customer portal (together, the "Service").

"Dronrly", "we" and "us" means [LEGAL ENTITY NAME], a [STATE OF INCORPORATION] company at [REGISTERED ADDRESS]. Questions: [email protected].

1. Who is responsible for your data

Dronrly is used by drone service businesses ("businesses") to run their work with their own clients. Our role depends on whose data it is:

We are the controller for data about business account holders (owners, managers and pilots), visitors to our website, people who use our contact form, and billing for Dronrly subscriptions. This policy fully covers that data.
We are a processor (GDPR) and service provider (CCPA/CPRA) for the data a business stores about its own customers: customer records, job sites, jobs, messages, files, quotes, invoices and payments. The business is the controller and decides how that data is used. We handle it only on the business's instructions, under our Data Processing Addendum.

If you are a customer of a drone business that uses Dronrly, that business's own privacy notice governs your data. Please send privacy requests to the business first. If you contact us, we will pass your request to the business and help it respond.

2. What we collect

Account holders (business staff)

Name, email address, phone number and job title.
Password, stored only as a bcrypt hash. We cannot read it.
Team role (owner, manager or pilot) and sign-in times.
For pilots, if entered: FAA Part 107 certificate number and recurrent-training due date.
Business details: business name, contact details, address, time zone, invoice settings, and insurance carrier and policy expiry date.
Subscription billing: plan, status, and Stripe customer and subscription IDs. Card details are entered on Stripe's pages and never reach us.
Online invoice payments: if the business connects its own Stripe account through Stripe Connect, we store only that account's ID and when it was connected. We do not store Stripe passwords or API keys for connected accounts. Businesses that set up payments before Stripe Connect may still have their own Stripe API keys stored with us, encrypted, until they connect through Stripe Connect, disconnect, or we remove all such keys.

Data businesses store about their customers (processor data)

Customer names, company, email, phone and postal address, and internal notes written by the business.
Job details: title, description, site address, optional GPS coordinates of the site, preferred and scheduled dates, assigned pilot and status history.
Messages between the business and its customer, and internal notes.
Drone photos, video, maps and other files. These can capture people, vehicles, license plates and private property.
Quotes, invoices and payment records (amounts, dates, method, and Stripe session and payment IDs). Card payments are made on Stripe Checkout; card numbers never touch Dronrly.
Payment information read from the business's own Stripe account for its in-app payments dashboard: balance, recent payments (with the payer's name or email as held in Stripe), refunds and payouts. This covers every payment on that Stripe account, including payments not made through Dronrly. It is fetched from Stripe when an owner or manager opens the dashboard and kept in server memory for up to 5 minutes. It is not saved to our database.
For customers with a portal login: name, email, password hash and sign-in times.

Everyone

Security and usage data: IP address and browser user agent for signed-in sessions; IP address in the audit log of significant actions; server request logs.
Contact form: name, email, company and your message.
Bot checks: Cloudflare Turnstile runs on the signup and contact forms and processes device and browser signals to tell people from bots.

We do not ask for, and ask businesses not to upload, sensitive data such as health information, government ID numbers or financial account numbers.

3. How we use it and our legal bases

The GDPR requires a legal basis for each use. For data where we are the controller:

Providing the Service (accounts, sign-in, teams, notifications, support): performance of our contract with you or your business (Art. 6(1)(b)), and our legitimate interest in serving the team members a business invites (Art. 6(1)(f)).
Subscription billing through Stripe: contract (Art. 6(1)(b)) and legal obligations such as tax records (Art. 6(1)(c)).
Transactional email (invitations, password resets, job updates, invoices, receipts, trial and deletion reminders): contract (Art. 6(1)(b)).
Security (sessions, rate limiting, audit log, bot checks, logs): legitimate interest in keeping the Service and your data safe (Art. 6(1)(f)).
Answering contact-form messages: legitimate interest in responding to enquiries (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)).
Legal claims and compliance: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

For processor data, we act on the business's instructions: to store it, show it to the right people, email it where the business asks, and delete it on schedule. The business is responsible for its own legal basis.

We do not sell personal data, "share" it for cross-context behavioral advertising, use it for advertising or profiling, or make automated decisions that have legal or similarly significant effects on you. We do not use customer data to train AI models.

4. Who can see it

Within a business: owners and managers can see customer records, invoices, quotes and exports. Pilots can see the jobs assigned to them and open jobs that nobody has taken yet (including the customer name, phone number and site address on them), and all of the business's quotes and invoices, including the customer names, emails, billing addresses and amounts on them; they can also export invoices. Pilots cannot see the customer list or customer records, or export or erase customer data. Customers see only their own jobs, messages, files and invoices in the portal.
Our access to a connected Stripe account: when a business connects its Stripe account, Stripe grants Dronrly "read_write" access to it. That technically lets us read most of the data in the account, including its customers, payments and payouts, and make changes to it on the business's behalf. Stripe never gives us full card numbers. We use the access only to create and close Checkout pages for the business's invoices, confirm payments, and show the payments dashboard described above. The business can remove our access in Dronrly under Settings → Payments while its workspace is active, or at any time in its Stripe Dashboard.
Dronrly staff: a small number of platform administrators, only as needed to run the Service, provide support, keep it secure, or meet legal obligations.
Subprocessors: the service providers listed on our subprocessor page: Stripe (billing and payments), Mailgun (email) and Cloudflare (network, security and bot checks), plus our dedicated hosting in [HOSTING LOCATION]. Each is bound by a contract limiting use of the data to providing its service to us.
Legal reasons: when required by law or valid legal process, to protect rights, safety or property, or as part of a merger or sale of the business (with notice to you).

5. Cookies

We use only strictly necessary cookies. There is no analytics, advertising or third-party tracking, and email open and click tracking is turned off.

dr_session: keeps you signed in. Lasts 14 days from your last activity, and never more than 30 days in total.
dr_csrf: protects signed-out forms (like sign-in and signup) against forgery. Lasts 24 hours.
dr_flash: shows a one-time message after an action. Lasts 60 seconds.

Cloudflare Turnstile, which runs on the signup and contact forms, may use browser storage and signals for its bot check. Because these are strictly necessary, we do not ask for cookie consent.

6. How long we keep it

Delivered files: downloadable for the period the business chooses (7 to 365 days after delivery; 30 by default), then deleted. Files on canceled jobs are deleted 30 days after cancellation.
Canceled accounts and ended trials: all business data (customers, jobs, files, invoices and users) is permanently deleted 90 days after cancellation or trial end. The owner is emailed 30 days and 7 days before. We can delete a business immediately on request.
Invoices and payments: kept while the business account exists, because businesses must keep their own tax records.
Stripe connection: the connected account ID is kept until the business disconnects, removes our access in Stripe, or the workspace is deleted. Any Stripe API keys a business saved before Stripe Connect are deleted as soon as it connects or disconnects, and otherwise when we remove all such keys. Like other deleted data, they leave our encrypted backups within 30 days.
Pay and quote links: stop working 30 days after the invoice is paid or voided, or after the quote expires.
Sessions: end after 14 days idle or 30 days in total. Password-reset links last 1 hour and invitations 7 days; both are purged 7 days after they expire.
Audit log: 12 months. Contact-form messages: 24 months. Notifications: read ones 90 days, all 12 months.
Server logs: rotated with a size cap; tokens in URLs are redacted.
Backups: encrypted and kept for 30 days on a rolling basis, so deleted data leaves our backups within 30 days.

7. Security

HTTPS everywhere with HSTS, and a strict Content Security Policy.
Passwords hashed with bcrypt. Session and password-reset tokens stored only as SHA-256 hashes. Connected Stripe accounts are reached with our own platform key, so we hold no keys for them. Stripe API keys that businesses saved before Stripe Connect are encrypted with AES-GCM until they are deleted.
Role-based access, separation of every business's data on every database query, rate limiting, and an audit log of significant actions.
Card payments handled entirely by Stripe, which is certified PCI DSS Level 1. Card data never touches Dronrly.

Multi-factor authentication is not currently available, so please use a strong, unique password. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to:

know what personal data we hold and get a copy of it (access and portability);
correct inaccurate data;
delete your data;
restrict or object to our use of it, including use based on legitimate interests;
withdraw consent where we rely on it;
not be discriminated against for using these rights;
complain to a data protection authority (in the EU/UK, where you live or work).

We do not sell or share personal data, so there is nothing to opt out of. We do not use sensitive personal information for purposes that would require a "limit the use" option under California law.

How to use them

Account holders: update your profile in the app at any time. For a copy of your data or to delete your account, email [email protected].
Customers of a business: contact the business. Its owners and managers can export, correct or erase your record in Dronrly, and revoke your portal access. If you write to us, we will forward your request to the business.
Everyone else: email [email protected].

We will verify your identity, usually by confirming control of the email address we hold, before acting. You may use an authorized agent; we may ask for proof of their authority. We respond within one month (GDPR) or 45 days (US state laws), and will tell you if we need an extension allowed by law. If we refuse a request, we'll explain why and how to appeal: reply to our decision with "Appeal" in the subject line, and we will answer within 45 days (60 in some states).

When a customer is erased, some invoice amounts may be kept under an anonymized name, because the business must keep tax records.

9. International transfers

Dronrly is a US business and the Service is hosted in [HOSTING LOCATION]. Our subprocessors operate in the United States and, for Cloudflare, on a global network. If you are in the EU, UK or Switzerland, your data is transferred to the US. Where required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where a recipient participates, the EU-US Data Privacy Framework and its UK and Swiss extensions.

EU representative: [EU REPRESENTATIVE, IF APPOINTED]. UK representative: [UK REPRESENTATIVE, IF APPOINTED].

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We will post changes here and update the date above. For significant changes we will email account owners before they take effect.

12. Contact

Privacy: [email protected]. Support: [email protected]. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].