Local files stay local.

Scope

This notice covers the DROP Matched website and product workspace. DROP Matched is a software tool offered by Seaside Crypto LLC. It does not govern the CPPA DROP portal, your customer systems, or other services you choose to use.

Files processed in your browser

The following content is designed to be read and processed by JavaScript in your browser session:

• the customer CSV you select;
• the complete DROP ZIP you select and the Id,Hash files extracted from it in memory;
• mapped customer fields, standardized identifiers, and local hashes;
• matched record details and operator status decisions; and
• worklists, Id,Status responses, and receipts generated for download.

In the production workflow, DROP work-item IDs, their hashes, list type, source filename, processing status, and dated inactive removal tombstones are retained in this browser profile’s IndexedDB. Immediately before aggregate completion, the browser also journals the pending local status mutation so it can finish safely after a crash or reload. The ledger is scoped to an immutable random account identifier issued by DROP Matched plus the four-digit broker ID, supports later screening and amendments, and is not encrypted or synchronized by DROP Matched. The identifier stays with the account if its work email changes. Clearing site data or losing the browser profile can remove the local ledger.

DROP Matched does not request your CPPA username, password, API secret, or portal session. You obtain DROP files through your own authorized account.

Information used to operate an account

If you create an account, the service may process your work email, a password verifier, session records, account state, one verified four-digit DROP broker ID, a non-secret verification case reference, and support communications. If paid billing is activated, it may also store payment-processor customer/subscription identifiers and subscription state, but not full card data. The service may store cycle metadata you submit from the workspace, including access, response, and amendment dates; completion timestamps; aggregate status and file counts; action and acceptance attestations; a technical-specification version; and report or batch fingerprints. For the founding Success Gate, an authorized provider operator records that the environment was production, a non-row-level evidence reference, the batch-acceptance artifact’s SHA-256, and the verification time; the artifact itself remains in the approved external evidence system. Sandbox acceptance never opens billing.

That metadata records when an operator reported a workflow event and whether its totals are internally consistent; it is not independent proof that the underlying work was correct. It is not intended to contain consumer names, emails, phone numbers, device identifiers, VINs, dates of birth, ZIP codes, or DROP hashes.

How information is used

Operational information may be used to authenticate users, maintain cycle history, deliver configured reminders, diagnose errors, protect the service, answer support requests, and improve the deterministic workflow. DROP Matched does not use customer-file contents to train models because those contents are not sent through the product’s matching path.

Service providers and disclosure

Limited account and operational information may be handled by infrastructure providers needed to host, secure, or communicate about the service. DROP Matched does not sell the customer-file contents described above, and the local matching architecture is specifically intended to keep those contents out of that provider path.

Information may also be disclosed when required by law, to protect the service or its users, or as part of a business reorganization, subject to applicable obligations. Under the published founding offer, payment is handled by the disclosed payment processor after the provider-verified Success Gate; DROP Matched stores processor customer/subscription state but not full payment-card data.

Retention and protection

Limited hosted account and aggregate cycle metadata is retained while an account is active. After an authenticated deletion request or termination, DROP Matched’s production policy is to delete that metadata from active systems as soon as reasonably practicable and no later than 30 days, except where documented legal, billing, security, or dispute obligations require limited retention. Residual copies in encrypted, access-restricted backups expire through ordinary rotation within 90 days after active-system deletion and are not used for normal operations.

If a backup is restored, the deletion journal must be applied before service resumes. A minimal hashed deletion record may be retained solely to prevent a deleted account from being restored. Production access remains gated until every provider-controlled backup tier and the restore-and-deletion-replay procedure conform to this policy.

The local suppression ledger remains on the device until the browser’s site data is cleared as part of an authorized offboarding or recovery procedure. A later DROP removal marks an item inactive but deliberately retains its ID and hash as a dated tombstone so replaying an older batch cannot revive it. Include the authorized browser profile and encrypted DROP Matched backup in your organization’s protected device-continuity and records plan.

No browser-only architecture can protect files from a compromised device, malicious browser extension, unsafe download location, or someone with access to your unlocked session. Use a managed, current browser on a trusted device.

Your choices

You can choose not to create an account, not to select a local file, or not to submit cycle metadata. Those choices may prevent the corresponding features from working. For account-data questions or requests, email privacy@dropmatched.com. Do not attach customer files, DROP files, credentials, or secrets.

Changes to this notice

This notice may change as production onboarding, service providers, or product behavior are finalized. Material changes should be reflected by a new reviewed date on this page. Verify the current notice before relying on the service for production work.