EZDrop is a product built and operated by Extensions Market (extensionsmarket.com). This Privacy Policy explains what data EZDrop collects, how it is used, and your rights regarding that data.
By installing EZDrop or using any EZDrop-powered waitlist page, you agree to this policy.
1. Who We Are
Extensions Market operates EZDrop alongside other products including EZStock, EZBundle, PopBoost, Sleepmaxing, HomePilot, AirPrice, STRInvest, JobPilot, and CarWise.
Shopify shop domain and store metadata provided during OAuth installation
OAuth access tokens required to operate the app within Shopify admin
App settings you configure: sender name, custom from-email, badge preferences
From shoppers (store customers):
Email address and optional first name when joining a product waitlist
Email address submitted via the "Notify me when this drops" form
Referral data — which referral code, if any, was used when signing up
Queue position and score (calculated from signup time + referral activity)
From website visitors (ezdrop.app):
Analytics data via Google Analytics (see Section 7) — only collected with your consent
3. How We Use Data
To operate the waitlist, referral queue, and position scoring for each drop
To send transactional emails: waitlist confirmation, "drop is live" announcements, and launch notifications to top-ranked entries
To display live signup counts and countdown timers on merchant product pages via the storefront badge
To authenticate merchants through Shopify's OAuth system
To understand how visitors use ezdrop.app so we can improve the product (analytics, consent-gated)
We do not sell personal data to third parties. We do not use shopper data for advertising, profiling, or any purpose beyond operating the EZDrop service.
4. Data Retention
Shopper waitlist entries and interest records are retained while the merchant's EZDrop subscription is active
All shop data — drops, entries, settings, sessions — is permanently deleted when a merchant uninstalls EZDrop
Individual shopper data is deleted upon a valid GDPR or CCPA deletion request
5. Third-Party Services
Shopify — app platform, OAuth, and storefront infrastructure. Shopify's privacy policy applies to data processed through their platform.
Resend (resend.com) — transactional email delivery. Shopper email addresses are passed to Resend solely to deliver the emails described in Section 3.
Railway (railway.app) — cloud hosting for the EZDrop application server and PostgreSQL database. Data is stored in Railway's infrastructure.
Google Analytics (google.com/analytics) — website analytics for ezdrop.app. Only loaded after you give explicit cookie consent. Google's privacy policy governs data collected through their analytics platform. You can opt out at any time via the cookie banner or by declining on first visit.
6. GDPR & Your Rights (EEA / UK)
If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under GDPR:
Access — request a copy of personal data we hold about you
Rectification — request correction of inaccurate data
Erasure — request deletion of your personal data
Restriction — request that we limit processing of your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — withdraw cookie consent at any time by clearing your browser's localStorage for ezdrop.app
EZDrop processes GDPR compliance webhooks forwarded by Shopify automatically. To exercise any of the above rights directly, email [email protected]. We will respond within 30 days.
Our lawful basis for processing shopper waitlist data is legitimate interest (operating the service the shopper signed up for) and, where applicable, consent (analytics cookies).
7. Cookies & Local Storage
Storefront widget: The EZDrop storefront widget uses localStorage to remember whether a shopper has already subscribed to drop alerts, avoiding repeat prompts. This is functional, not tracking.
Cookie consent preference: We store your cookie consent choice (ez_cc) in localStorage so we don't ask again on repeat visits.
Google Analytics cookies: If you accept cookies, Google Analytics sets the following cookies on ezdrop.app:
_ga — distinguishes users. Expires after 2 years.
_ga_* — maintains session state. Expires after 2 years.
These cookies are only set after you click "Accept" on the cookie banner. If you click "Decline" or close the banner without responding, no analytics cookies are set. You can change your preference at any time by clearing your browser's localStorage for ezdrop.app.
8. CCPA — California Consumer Privacy Act
If you are a California resident, you have the following rights under the CCPA / CPRA:
Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you
Right to Delete — request deletion of personal information we have collected from you, subject to certain exceptions
Right to Correct — request correction of inaccurate personal information
Right to Opt-Out of Sale or Sharing — we do not sell or share personal information with third parties for cross-context behavioral advertising
Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights
To exercise your California privacy rights, email [email protected] with the subject line "CCPA Request." We will respond within 45 days. We do not respond to opt-out preference signals (Global Privacy Control) at this time but will not sell your data regardless.
Categories of personal information collected: Identifiers (email address, first name), internet or network activity (analytics, consent-gated), and inferences drawn from that information (queue score). We do not collect sensitive personal information as defined by the CPRA.
9. Data Processing — Merchants as Controllers
Under GDPR and equivalent privacy laws, the relationship between EZDrop and merchants is:
Merchant — data controller. The merchant determines the purpose of each product drop waitlist and is responsible for their shoppers' data under their own privacy policy.
EZDrop / Extensions Market — data processor. We process shopper data solely on behalf of and under the instruction of the merchant, for the purpose of operating the waitlist they have configured.
Merchants who use EZDrop to collect data from EU/UK individuals are responsible for ensuring they have an appropriate lawful basis for that collection and for providing their shoppers with adequate privacy notice. EZDrop provides the technical infrastructure; merchants control the drops.
For merchants who require a formal Data Processing Agreement (DPA) under GDPR Article 28, please email [email protected] and we will provide one.
10. Children's Privacy
EZDrop is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data through an EZDrop-powered page, contact us and we will delete it promptly.
11. Changes to This Policy
We may update this policy as the product evolves. We will update the "Last updated" date above. Continued use of EZDrop after changes constitutes acceptance of the updated policy.