What we keep, and why.

Who we are

CampaignFly (campaignfly.app) is operated by DropFly, a Delaware corporation. For anything on this page, write to rio@dropfly.io.

Whose data this covers

• Client users — the people at a business who sign in to review and approve campaigns.
• A client's subscribers — the people on that business's email list. The business is the controller of that list; we process it on their instructions.
• A client's advertising accounts — when a business connects a Meta, TikTok or Google advertising account so we can build and manage campaigns for them.

What we collect

From client users: name, work email address, and a record of what you approved, declined or scheduled, and when. Signing in uses a link or code sent to your email; we do not store a password. We record whether the review emails we send you were opened and which links in them were clicked, so we know a request reached you.

From a client's email platform: with the client's own API key, we read list and campaign performance (sends, opens, clicks, unsubscribes) and create and schedule campaigns. That key is stored encrypted and is used only for that client's account.

From a client's advertising accounts: with the client's permission, granted through Meta, TikTok or Google, we read campaign performance and spend, and create, pause and update advertising campaigns in the client's own account. We never hold the client's payment method. Nothing is launched without the client's written approval, and spend is capped at the amount the client approved.

Files a client uploads: brand documents and photography, kept in private storage and used only for that client's campaigns.

How we use it

• To produce, review, approve and send the client's campaigns.
• To report performance back to the client.
• To keep the service secure and to tell the client when something needs their decision.

We do not sell personal data. We do not use one client's data for another client. We do not use subscriber data for advertising of our own.

Who else handles it

The service runs on Vercel (hosting) and Supabase (database and file storage). Review emails to client users go through Resend. Campaigns go out through the client's own email platform, currently Klaviyo. Advertising runs in the client's own Meta, TikTok and Google accounts. Each of these processes data under its own terms; none of them receives more than the task needs.

How long we keep it

Campaign records and approvals are kept for as long as the client's account is open, so the client has an audit trail of what went out. A file a client deletes is recoverable for thirty days and then removed for good. Sign-in links and codes expire within minutes. When a client account is closed, its data is deleted within thirty days, except where we must keep a record of a send to comply with law.

Deleting your data

To have your data deleted, email rio@dropfly.io with the subject line Delete my data from the address you use with us. We will confirm within seven days and complete the deletion within thirty. If you connected a Meta, TikTok or Google account, removing CampaignFly's access from inside that account also revokes our permission immediately, and we delete the data we obtained through it on the same schedule.

If you are a subscriber on a client's list, the fastest route is the unsubscribe link in any email you received; the business that emailed you is the controller of that list, and you may also write to them directly.

Security

Sign-ins are by emailed link or code, with a second-step code for operators. Sessions are signed cookies. Client API keys are stored encrypted. Uploaded files sit in private storage and are never public. Every send is either approved by the client or blocked.

Changes

If this page changes in a way that matters, we will tell client users by email before it takes effect. The date below is the date of the current version.