Privacy statement
This statement explains what DropTheHassle collects, why we collect it, how long we keep it, and what you can ask us to do with it. It describes what our software actually does.
Last updated: 30 September 2026.
Who we are
DropTheHassle is run by DBOS B.V., 3e Westewagenhof 50, 3011 AR Rotterdam, the Netherlands, KvK 95650989, VAT number NL867223327B01. We are the controller for the personal data in this statement. For questions or requests, email info@dropthehassle.com. That is the only contact address, including for abuse reports.
Your account
Your email address is your account. We store it with the date you signed up. You sign in with a 6-digit code we email you, which works for 15 minutes, or with a password if you set one. Sign-in codes, passwords, session tokens and API tokens are stored only as hashes, never in readable form.
If you add a backup email address, we store it and also send sign-in codes to it. We use your email address to sign you in, to send receipts, renewal notices and service messages, and to answer you.
If you ask us to email you a link to a name, we use that address only to send that one email. We do not store it; a scrambled form of it is kept in memory for at most a day to stop repeat sends.
Sites you put online
When you upload a site, in the browser, from the command line or through your AI assistant, we store the files and serve them to everyone who visits the site. For each upload we record its size, the number of files, whether it was accepted and how it arrived. If an upload is refused, we keep the reason and the names of the top-level folders and files. We never keep the contents of a refused upload.
You can put a site online without an account. It gets a free address on dropthehassle.app and a claim link. We do not store an IP address or an email address with an anonymous upload. You can claim the site within 7 days by entering your email address. An unclaimed anonymous site can be removed after 7 days. We keep a short record of each anonymous upload (date, size, number of files, how it arrived, and the source note described below), without IP address or email address, to see how the service is used. We delete that record 30 days after the site is removed or claimed.
You can download your site as a zip and delete it from your dashboard. A site with a domain you bought here can be deleted once you have stopped that domain's renewal or moved the domain out.
Domain names
When you buy a domain, we register it in your name with our accredited domain registrar partner. For that we pass your name, email address, postal address, phone number and, if you give one, your company name to the registrar partner. These come from the billing details you enter when you pay. The registrar partner and the registry of the domain ending need them because you are the legal owner (the registrant) of the name. The registry rules require a verified owner email address, so the registrar partner emails you a verification link.
Where the domain ending allows it, we turn on WHOIS privacy, so your details are not shown in the public WHOIS. Some endings do not allow this. For those, the publication rules of that registry apply.
We keep your name, email address and country with the domain in our own database.
Payments
Payments are handled by Stripe, our payment provider. You enter your card or bank details with Stripe, not with us. Stripe gives us the billing details we need for the domain registration and the invoice (name, email address, postal address, phone number) and the result of the payment. When you pay, Stripe's script loads on the page. Stripe processes payment data under its own privacy policy and may set its own cookies to prevent fraud.
For each payment we keep an invoice: your email address, what you bought, the amount, the VAT and the type of payment method. We also add three labels to the payment at Stripe: the maker code, the campaign name and how the site was created. We use them to pay referral rewards (see Where you came from, below).
Email at your domain
If you turn on email for your domain, your mailbox is hosted by our email provider, and the messages you send and receive are stored there. When you open your inbox in the dashboard, our server fetches the messages from the provider to show them to you. We do not keep a copy of your messages on our servers. We store the addresses you create, their settings, and the mailbox password our server uses to connect. That password is never shown.
Where you came from
When you first visit dropthehassle.com, your browser keeps one small note in its own storage (dth_src, not a cookie). It holds the campaign tags from the link you used (utm_source, utm_medium, utm_campaign, utm_content, utm_term), a maker code (ref) if there was one, the name of the site that sent you, the page you landed on, your language and the date. The first visit counts. A new maker code only replaces an older one after 30 days.
When you sign in, put a site online, or connect the command-line tool or your AI assistant, this note is sent to us with that request. We store it with your account or site, together with how you did it (browser, command line, or your AI assistant). We never store your IP address or the full address of the page that sent you.
If you pay, only the maker code, the campaign name and how the site was created go to Stripe with the payment, so we can pay the maker who referred you.
We use this to understand which channels bring people who actually put a site online, and to pay referral rewards. We do not use it for advertising, we do not share it with ad networks, and we do not build profiles across other websites. We keep it as long as your account or site exists.
Visitor statistics
We count visits to dropthehassle.com, and to the sites we host, with our own counter. It does not use cookies. For each page view, our server combines the IP address and the browser type with a secret that changes every day, turns that into a code, and stores only the code. The IP address and the browser string are not stored. Next to the code we store the page path (without anything after a question mark), the name of the site that linked to the page, whether the device is a phone or a computer, and the country. We look up the country from the IP address in a table on our own server.
Because the secret changes every day, this data cannot be used to follow a visitor from one day to the next. We keep the individual rows for about 13 months. After that they are folded into daily totals and deleted.
On a site we host, the site owner sees these statistics for their own site. A site owner can also turn on enhanced statistics. Visitors of that site then see a notice and can accept or decline one counting cookie. That site also records where visitors tap and how far they scroll, as loose points that are not linked to any visitor. For those statistics, the site owner decides and we process the data on their behalf.
Server logs and security
Our web server keeps an access log for dropthehassle.com. It records the IP address, the time, the page requested (including any tags in the address), the browser type and the referring page. We use it to keep the service secure, to fix problems and to measure visits.
Our application also writes technical logs, for example the names searched in the domain search, clicks on a search result (the action and the domain name on the card), and errors. We use them to run and improve the service. We keep server logs, application logs and database backups for 30 days.
To stop abuse, our server briefly uses your IP address in memory to limit how many requests one address can make. If you report a site, we store your report together with your IP address, so we can recognise repeated reports and count reports from different networks. We keep an abuse report, including the reporter's IP address, for 12 months. Reports go to info@dropthehassle.com.
Stored in your browser
dropthehassle.com does not set cookies of its own. It uses your browser's local storage for the source note described above, for your sign-in session and account email once you sign in, and for an unfinished checkout or site so you can pick up where you left off. You can clear this in your browser settings. Clearing it signs you out. Stripe's script loads only when you pay.
Who else receives data
- Stripe, for payments.
- Our accredited domain registrar partner, and through it the registry of your domain ending, for domain registration.
- Our hosting provider, whose servers run the service and store the sites and our database.
- Our email provider, for the emails we send you (sign-in codes, receipts, notices), and for email at your domain if you turn it on.
We do not sell personal data. We do not use advertising networks or third-party trackers.
How long we keep it
| What | How long |
|---|---|
| Account (email address, backup email address, sign-up source) | As long as your account exists. |
| Email me this link: the address is not stored. | A scrambled form stays in memory for at most a day, then it is gone. |
| Sites and their files | Until you delete the site. An unclaimed anonymous site can be removed after 7 days. |
| Record of anonymous uploads (no IP address, no email address) | 30 days after the site is removed or claimed. |
| Registrant details of a domain | As long as the domain is with us. The registrar partner and the registry keep them under their own rules. |
| Invoices | 7 years (Dutch tax law). |
| Visitor statistics | Individual rows about 13 months, then daily totals. |
| Server logs, application logs and database backups | 30 days. |
| Abuse reports, including the reporter's IP address | 12 months. |
| Account deletion | On request by email to info@dropthehassle.com. |
Why we are allowed to use it
- Account, sites, domains, payments and email: to provide the service you asked for (GDPR article 6(1)(b)).
- Invoices: because Dutch tax law requires us to keep them (article 6(1)(c)).
- Visitor statistics, sign-up source, logs, request limits and abuse reports: our legitimate interest in running a secure service, knowing which channels work and paying referral rewards, with as little data as we can (article 6(1)(f)).
Your rights
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to object to how we use it, and to receive it in a portable format. Email info@dropthehassle.com from the address on your account. We answer within one month, as the GDPR requires.
We delete an account on request by email to info@dropthehassle.com. Some data we must keep after that, such as invoices, and the registrant details of a domain that is still registered in your name.
Much of this you can do yourself in the dashboard: download your site, delete a site, change your email address, remove a backup email address, stop a domain renewal, and request the transfer code for your domain.
If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
When we change this statement, we update the date at the top. If a change affects how we use your data, we tell account holders by email before it takes effect.