TwistDrops
Start for free

Privacy policy

Last updated: 27 October 2026

This policy explains what personal data TwistDrops collects, why, who receives it, how long we keep it and what your rights are. It covers our site, twistdrops.com, every maker’s storefront on it and the studio that makers sell from.

“We” and “us” mean VLAH SOFTWARE HOUSE SRL, which runs TwistDrops. A maker is a business or person who sells food or drink through TwistDrops, and a customer is anyone who reserves from a maker.

1. Who we are

TwistDrops is run by:

  • Company: VLAH SOFTWARE HOUSE SRL
  • Registered office: Str. Dinicu Golescu 2, Bl. 1, Sc. B, Ap. 2, 557260 Șelimbăr, Sibiu, Romania
  • Tax ID (CUI): 44445094
  • Trade Register number: J32/1183/2021
  • Email: info@twistdrops.com

We are the controller of the personal data this policy describes, except for the data a maker controls (5.1).

2. What we collect and why

2.1. When you reserve

You don’t need an account. When you reserve on a maker’s storefront, we collect:

  • your name, email address and phone number, which the checkout asks for: the maker needs them to know whose reservation it is and to reach you, and we use your email address to tell you about your reservation;
  • what you reserve: the products and how many, options such as sliced, any special request you add, the drop and its pickup day, and the prices;
  • the language you read the shop in, so that our emails reach you in it;
  • whether you’d like the shop’s news, if you tick the box for promotional emails at checkout or use its storefront’s subscribe form, which asks for your name, email address and phone number. The maker sees your answer in their customer list. We don’t send any such emails today.

We email you when you reserve, when the maker confirms your reservation (with the pickup address and the ways the maker accepts payment) and when its status changes, with any message the maker adds. If the maker has turned on review requests, or asks from their studio, we also email you after pickup to ask for a review, at most three times for one reservation.

To see your reservations with a shop, enter your email address on its storefront, and we email you a link that works for an hour. The link in a review request works for seven days.

2.2. When you write a review

Only a customer who has picked up what they reserved can review it. We collect your rating, your words and up to three photos, and publish them on the maker’s storefront with your first name. When the maker replies, we email you once. If a maker asks us to remove your review, we keep a record of the request and of our decision.

2.3. When you sell on TwistDrops

  • Your account: your name, your email address and your password, which our sign-in provider stores only as a hash. It also records when you sign in, with your IP address and browser, to keep your account secure.
  • The link you claim: if you claim a link on our Home page and then create your account, we keep that link for your account for six hours, so that nobody else can take it. An account can hold one link. If no shop opens with it in those six hours, it’s free again.
  • Your shop: what you tell us about it, such as its name and link, trade, country, time zone and languages, address and pickup points with the ways you accept payment, phone number and whether it’s on WhatsApp, notification email address, logo, photos and texts, social links, products, drops and prices, and your settings.
  • Your customers and their orders, including the notes you keep on them (5.1).
  • Your replies to reviews, and any request you make to remove one.

Your storefront shows your shop’s name, link, texts, photos, products, drops and prices, your social links, your WhatsApp number if you mark your phone as WhatsApp, and your address unless you keep it private. A private address stays off your storefront, but customers get it in the email that confirms their reservation. Every email we send your customers about a reservation or a review also shows your shop’s phone number, and a customer who replies to one of them writes to the email address where you receive your orders.

We email you about your shop, such as each new reservation, and now and then about TwistDrops itself, such as a change to the studio. Every news email has an unsubscribe link, and emails about your orders keep coming after you unsubscribe.

2.4. When you join the waiting list

TwistDrops opens shops in the EU and the UK. If you sell in a country where we haven’t opened yet, you can join our waiting list: on our Home page, on Create an account, or in your studio while you open your shop. We keep:

  • your email address and the country where you sell;
  • the link you wanted for your shop, if you chose one;
  • the language of the page you joined from, and where you joined: Home, Create an account or the studio;
  • your account, if you joined from the studio.

We email you once, the day we open in your country, and use the list for nothing else. Until then, your entry is kept only in our database (5.2). When we open in your country, we pass the email addresses waiting for it to Resend, which sends that one email, and they’re deleted from Resend when we delete the entries (section 6). You can ask us to take you off the list at any time (section 7).

2.5. How makers use the studio

Unless you say no, we record what you do in your studio, to see how it’s used and make it better:

  • when you create your account, confirm your email address and open your shop, and which link brought you to create it (such as a campaign tag in its address);
  • what you do in your studio, such as publishing a drop, saving a product, confirming an order or changing a setting, and when something you tried didn’t save;
  • facts about your shop: its trade, country and languages, how much of its setup is done, how many products, drops, orders, customers and reviews it has, some of its settings, and the type of device, system and browser you use;
  • what happens to your shop, such as a reservation, a review, a new subscriber or the review requests we send for you: when it happened, with counts and the review’s stars, never who it was.

We record these under your account’s ID, with your shop’s name and link. We never record your email address, your name, your phone number, what you type or anything your customers gave you. Our servers send these records to PostHog, in the EU, and nothing is stored on your device for them. What happened before we began recording, on 29 September 2026, we add once from your shop’s own records, in the same way.

If you accepted analytics on our site before you created your account (2.7), we link the pages you visited then to your new account, so we can see what brought you.

Only if you say yes, by answering Yes, share when your studio asks on its Home page or by switching on Include the pages I open and what I tap in Settings → Privacy, we also record which studio pages you open, which of its buttons you use, such as Create or Download PDF, and how long a photo takes to upload. Your browser sends these to our servers, which check them and pass them on to PostHog. This part rests on your consent, and you can switch it off and keep the rest.

To stop all of it, answer No thanks when your studio asks, or switch off Share how I use the Studio in Settings → Privacy. From then on, nothing is recorded.

2.6. When you write to us

When you use the contact form, it sends us your name, email address, subject and message by email, so that we can answer you.

2.7. When you visit any page

  • Technical data: when you open a page, our hosting and database providers see your IP address, your browser and the page you asked for, and keep them in their logs for a short time, to keep TwistDrops secure and to fix problems. Our host also reads from your IP address which country you’re in. We use that country only to decide whether to show you the waiting list (2.4), and we don’t store it.
  • Protection against abuse: to stop floods of requests, we count how many come from each IP address, and how many give the same email address in our forms, over a minute or an hour.
  • Error reports: when something breaks, in your browser or on our servers, Sentry receives a report of what went wrong, on which page and in which browser. Before a report leaves, we mask any code from a link we email you, and shorten every email address in the report to the part after the @, such as …@gmail.com. A report never includes your IP address.
  • Page speed: Vercel Speed Insights measures how fast our pages load, with the page’s address, your connection speed and the type of device. It sets no cookie, stores nothing on your device and runs only on our live site.
  • Analytics, only if you accept: if you choose Accept all on the cookie banner, PostHog records how you use the site and the storefronts: the pages you visit, the drops and products you look at, what you add to a reservation and whether it goes through, the reviews you send, the language you choose, the links you follow to a maker’s WhatsApp, Instagram or directions, how fast pages load and how long you stay. It also notes your type of device, your browser and the site that sent you. PostHog may use your IP address to estimate your country and city, and then discards it without storing it. All of this is kept under a random identifier, never with your name, email address or phone number, and never with what you type. If you choose Essential only, or don’t answer, PostHog doesn’t start.

3. Our legal bases

The General Data Protection Regulation (GDPR), and the UK GDPR for people in the UK, let us use personal data on these grounds:

  • To perform a contract (article 6(1)(b)): to take your reservation and pass it to the maker, email you about it and show you your reservations; to run a maker’s account and shop.
  • With your consent (article 6(1)(a)): analytics on the site and the storefronts, once you accept it (2.7); the studio pages you open and what you tap, once you say yes (2.5); publishing your review (2.2); emailing you when we open in your country, once you join the waiting list (2.4). You can withdraw your consent at any time (section 7).
  • For our legitimate interests (article 6(1)(f)): keeping TwistDrops secure and free of abuse, finding and fixing errors, measuring page speed, recording how makers use the studio so that we can improve it (2.5), asking customers for reviews when the maker wants them, and emailing makers about TwistDrops. You can object to any of these (section 7).
  • To meet a legal obligation (article 6(1)(c)): keeping what the law requires us to keep, and answering lawful requests from authorities.

The checkout needs your name, email address and phone number: without them, the maker can’t take your reservation. We don’t make any decision about you by automated means alone.

4. What we store on your device

TwistDrops keeps a few things in your browser: in cookies, and in its local and session storage. Local storage stays until you clear your browser’s data, and session storage until you close the tab.

4.1. Always on

These are needed for what you ask the site to do, so they need no consent:

  • Sign-in cookies, for makers (names starting with sb-): they keep you signed in to your studio until you sign out, for up to 400 days.
  • Your reservation before you send it (cart_…, local storage): the products you add and any special request, until you reserve them or remove them.
  • While and after you reserve (session storage):
    • a code that stops a reservation you retry from being placed twice, with your email address, until the reservation goes through (twistdrops_checkout_…);
    • the summary that the confirmation page shows, with your name (twistdrops_receipt_…);
    • your name, email address and phone number, so that the next reservation in the same tab fills them in (twistdrops_checkout_details_…).
  • Your answer to the cookie banner (twistdrops_posthog_consent, local storage): Accept all or Essential only.
  • Opening a shop, for makers (twistdrops.setup.…, session storage): the setup steps you’ve filled in, until your shop opens.

4.2. Preferences

These remember a choice you made, or a maker’s shop link, so they need no consent:

  • NEXT_LOCALE (cookie): the site language you picked, for a year.
  • language_… (local storage): the language you picked on a maker’s storefront.
  • studio-rail (cookie), for makers: that you folded the studio’s side menu, for a year or until you unfold it.
  • studio-shop (cookie), for makers: your shop’s link (twistdrops.com/your-shop), written whenever you open your studio, so that your own storefront can show you the way back to it. It lasts a year, or until you sign out. For a shop run by one person, the link can identify that person.

4.3. Analytics

  • PostHog (local storage, keys starting with ph_), only after you choose Accept all: a random identifier and PostHog’s own settings. PostHog sets no cookie. If you later choose Essential only under Cookie settings, at the bottom of every page of the site and of every storefront, PostHog stops and its keys are deleted.
  • twistdrops_internal_device (local storage), only after you choose Accept all: the value 1, written in a browser that opens the studio, our admin pages or the page shown when a sign-in link fails. It serves analytics only: that browser’s visits to storefronts are marked as a maker’s own, so that they don’t count as a customer’s. If you later choose Essential only, it’s deleted with PostHog’s keys.

4.4. Links to other sites

A maker’s storefront can link to their WhatsApp, Instagram, Facebook and other pages, and to directions on Google Maps. We share nothing with those sites unless you follow a link, and their own privacy policies then apply.

5. Who receives your data

We never sell your data.

5.1. The maker you reserve from

The maker receives your name, email address, phone number and reservation, with any special request, your language and your answer about their news, so that they can make what you reserved and hand it over. They see these in their studio and in the email we send them about your reservation. They can call or email you about it, keep private notes on it, add customers and orders themselves (an order taken by phone, for instance) and download their customer list.

Each maker is a controller of this data in their own right: they decide how they use it and answer for it under the law. Our terms let them use it only to handle your reservations and contact you about them, and for their news only if you agreed. For anything a maker does with your data, you can also contact the maker directly.

5.2. Our service providers

These providers process data for us, only on our instructions:

  • Supabase: our database, file storage and sign-in, including the emails that confirm a maker’s account, sign them in or reset their password. Its servers are in Stockholm, Sweden.
  • Vercel: hosting and security, including processing IP addresses to protect the site from attacks, and Speed Insights (2.7). Our server functions run in Stockholm, and pages are served from Vercel’s network, usually from the location nearest to you.
  • Resend: sends our emails, such as reservation updates, links to your reservations, review requests and news for makers.
  • PostHog: analytics (2.5 and 2.7), on its EU cloud in Frankfurt, Germany.
  • Sentry: error reports (2.7), in its EU region in Germany.

5.3. Authorities

We share data with an authority only when the law requires us to.

5.4. Outside the European Economic Area

Our database and our server functions are in Sweden, and PostHog and Sentry keep what they receive in Germany. Vercel and Resend are based in the United States, and our other providers may have staff outside the European Economic Area, so data can reach them there. When it does, it’s protected by the safeguards the GDPR requires, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

6. How long we keep it

  • Reservations and customers’ details: as long as the maker’s shop keeps them for its orders and records, which is while the maker’s account is open, unless you ask us to delete yours sooner (section 7).
  • Reviews: while the maker’s shop is on TwistDrops, unless you ask us to take yours down. A review we remove comes off the storefront, and its photos are deleted.
  • Makers’ accounts and shops: while the account is open. We delete an account and its shop’s data when the maker asks, unless the law requires us to keep some of it.
  • Links: a link to your reservations stops working after an hour, and a review link after seven days. Both are deleted within two days after that.
  • Held links: deleted a day after their six hours end.
  • The waiting list: an entry is deleted 30 days after we email you that we’ve opened in your country, or 24 months after you joined if we never open there.
  • The counts we keep against abuse: deleted within two days.
  • Analytics (PostHog), from the site, the storefronts and the studio: one year.
  • Logs: a short time, to keep TwistDrops secure and to fix problems.
  • Error reports: for as long as we need them to find and fix the error.
  • Messages you send us: for as long as we need them to answer you and follow up.
  • What’s stored on your device: as section 4 says.

7. Your rights

Under the GDPR, and the UK GDPR in the UK, you can ask us to:

  • give you access to the personal data we hold about you, with a copy of it;
  • correct it if it’s wrong or incomplete;
  • erase it (the “right to be forgotten”), unless the law requires us to keep it;
  • restrict how we use it, for instance while we check that it’s correct;
  • send you the data you gave us, or send it to someone else, in a common, machine-readable format (the right to data portability).

You can also:

  • object to our use of your data for our legitimate interests (section 3), and at any time to its use for marketing. Makers can stop the studio’s usage record themselves, in Settings → Privacy (2.5);
  • withdraw your consent at any time, without affecting what we did with it before: for analytics under Cookie settings, at the bottom of every page of the site and of every storefront, and for the studio pages and taps in Settings → Privacy.

To use any of these rights, email us at info@twistdrops.com. We may ask you to confirm who you are, and we’ll answer within one month. For data a maker controls (5.1), you can also ask the maker, and we’ll help them answer.

You can also complain to a data protection authority: in Romania, where we’re based, the ANSPDCP; or the authority where you live or work, such as the AEPD in Spain or the ICO in the UK.

8. How we protect it

  • Every connection to TwistDrops is encrypted (HTTPS).
  • Our database lets each maker reach only their own shop’s customers and orders.
  • Passwords are stored only as hashes, never as they were typed.

9. Changes to this policy

We’ll tell you about any major change by email or with a notice on the site. The date at the top shows when this policy last changed.

Questions about this policy or your data? Write to us at info@twistdrops.com