Acceptable Use Policy — Drop Privacy

This Acceptable Use Policy (the “Policy”) applies to all use of the Site and Services of Drop Privacy, LLC (“Drop Privacy”). Capitalized terms not defined here have the meanings in the Master Subscription Agreement. Violation of this Policy may result in suspension or termination of access, without limiting Drop Privacy’s other rights and remedies.

1. Permitted Use

You may use the Services only for lawful internal business purposes consistent with the Master Subscription Agreement, your Order Form, and Applicable Laws — including to operate California Delete Act / DROP workflows, screening, suppression, and related privacy-compliance tooling for which you are authorized.

2. Prohibited Activities

You must not, and must not allow any user or third party to:

Unlawful use. Use the Services for any unlawful purpose, or in a manner that violates Applicable Laws, including privacy, consumer-protection, data-broker, export, sanctions, or intellectual-property laws.
Misrepresent compliance. Use the Services to prepare, submit, or support false, incomplete, or misleading attestations, statuses, exemptions, or filings to DROP, the CPPA, or any regulator or counterparty.
Shift legal duty. Represent that Drop Privacy is your registered data broker, compliance officer, counsel, or that Drop Privacy has assumed your Delete Act / DROP obligations.
Unauthorized access. Probe, scan, penetrate, or attempt to gain unauthorized access to the Services, other tenants’ data, accounts, APIs, agents, or related systems; bypass authentication, rate limits, or security controls; or share credentials insecurely.
Abuse & interference. Interfere with, disrupt, overload, or degrade the Services (including denial-of-service attacks, excessive automated load outside documented limits, or mining/crawling that impairs availability).
Malware & harmful code. Upload, transmit, or introduce viruses, worms, trojans, ransomware, or other malicious or harmful code.
Reverse engineering. Reverse engineer, decompile, disassemble, or otherwise attempt to derive source code, algorithms, or non-public APIs, except to the limited extent such restriction is prohibited by law.
Resale / service bureau. Rent, lease, sell, sublicense, white-label, or provide the Services to third parties on a service-bureau or timeshare basis without Drop Privacy’s prior written consent.
Competitive misuse. Access the Services to build a competing product, benchmark for public disclosure without consent, or systematically scrape documentation or UI content.
PII misuse. Submit personal information you are not authorized to process; use screening or matching features to re-identify consumers contrary to Applicable Laws or Drop Privacy’s documented design; or attempt to defeat hashing, isolation, or audit controls.
Credential & key abuse. Share API keys, agent tokens, or admin credentials beyond authorized personnel; use another customer’s tenant; or rotate/revoke keys in a way intended to evade billing or audit.
Harassment & abusive content. Transmit defamatory, harassing, fraudulent, or otherwise abusive content through Site forms, support channels, or notifications.

3. Customer Responsibilities

You are responsible for: (a) all activity under your accounts and keys; (b) configuring source systems, mappings, exemptions, and deletion confirmations accurately; (c) validating critical outputs before regulatory submission; and (d) ensuring your personnel and subprocessors who access the Services comply with this Policy.

4. Monitoring & Enforcement

Drop Privacy may investigate suspected violations and may suspend, throttle, or terminate access, remove content, or report activity to law enforcement when it reasonably believes this Policy, the Master Subscription Agreement, or Applicable Laws have been violated, or that continued use poses a security, legal, or operational risk. Drop Privacy has no obligation to monitor all use of the Services.

5. Reporting

Report suspected abuse or security issues to security@dropprivacy.com. Policy questions: legal@dropprivacy.com.