BunnyDropBunnyDrop Privacy Policy
Version: 1.0 (draft) · Date: October 22, 2026 · Official URL: https://bunnydrop.io/en/legal/privacy
Draft: pending legal review. A lawyer in Guatemala has not yet reviewed this document, and it may change before launch. It describes how BunnyDrop works today. It is not legal advice for your business. The Spanish version prevails.
Related: Terms of use · Data deletion · Giveaways and contests
1. Who we are and scope
BunnyDrop is a web platform for businesses. A business uses it to create promotions, events, giveaways and messages to its customers, and to moderate the chat of its live streams, by talking to Brío, BunnyDrop's AI assistant.
The controller is BunnyDrop, a brand of Hyper Reality Company, based in Guatemala. This policy covers https://bunnydrop.io, the app, and the public promotion and event pages BunnyDrop publishes for each business.
2. Two different roles
| Person | Who decides about their data | BunnyDrop's role |
|---|---|---|
| Business owners and their team | BunnyDrop | Controller |
| A business's customers (sign-ups, tickets, drops, giveaway entries) | The business | Processor: acts only on the business's instructions |
| People in the live chat of the business's streams | The business | Processor |
If you are a customer of a business that uses BunnyDrop, that business asked for your data and is responsible for it. Contact them first. If they do not answer, contact us and we will forward your request.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Owner and team account | name, email, phone, password (hashed), photo, country, role | the person |
| Third-party sign-in | account id, name, email and photo provided by Google, Facebook or Instagram | Google or Meta, with your permission |
| Business data | brand, logo, branches, hours, campaign texts | the owner |
| Conversations with Brío | what the owner writes and uploads, Brío's answers, notes saved at the owner's request | the owner |
| Customers (on behalf of the business) | name, email, phone, ID number, branch or country only if the business asks for them; entries, redemptions, tickets, prizes, tags and notes | the customer or the business |
| Connected apps | encrypted access tokens, the connected account's name and photo, data that a requested function reads | the app provider, with the owner's permission |
| Live chat | usernames, public chat messages, moderation actions | the streaming platform |
| Payments | plan, subscription status, last card digits, invoices | Stripe (BunnyDrop never stores card numbers) |
| Technical data | IP address, browser, language, access times, error and security logs | automatic |
We do not ask for sensitive data, and businesses must not ask for it in their forms.
4. Why we use it
To run the account and the business space; to let Brío understand requests and build campaigns; to store and show each business's customers, entries and redemptions; to send messages when the business orders it (the business must have the customer's consent); to bill; for security, fraud prevention and support; and to comply with lawful orders. Electronic acceptance is valid in Guatemala under Decree 47-2008 (arts. 5, 6 and 15).
5. What we do not do
- We do not sell, rent or hand over personal data. In Guatemala, selling or distributing personal data without the holder's express written consent is a crime (Decree 57-2008, art. 64).
- No third-party advertising and no audience profiling. Each business space is kept separate.
- We do not use data from Google, Meta or other connected apps to train AI models.
- BunnyDrop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Service providers
Render (hosting, US); a cloud MongoDB database provider (US). OpenAI (Brío's language models, US): by default it does not train on API data and keeps abuse logs for up to 30 days. Google and Meta (sign-in and the apps the owner connects, US). Stripe (billing, US). Cloudinary (files, US). Brevo / SMTP (email). Tavily (Brío's web searches, which receive the query only). Twitch, Kick and other apps the owner connects. Authorities may receive data only under a valid order.
7. Transfers outside Guatemala
Our servers and most providers are outside Guatemala, mainly in the United States. By using BunnyDrop the owner accepts these transfers.
8. Retention
| Data | How long we keep it |
|---|---|
| Owner account | while the account is active; anonymized on deletion |
| A business's customers | as the business decides while it uses BunnyDrop; deleted or handed over when it closes its account |
| Conversations with Brío | while the account is active, or until the owner deletes them |
| Connected-app tokens | until the app is disconnected, the permission is revoked or Meta sends a deletion request |
| Technical and security logs | up to 12 months |
| Billing records | as Guatemalan tax law requires |
| Backups | replaced in the normal maintenance cycle |
9. Your rights
You can ask for access to your data and a copy, correction, deletion, and you can opt out of commercial messages or withdraw a permission you gave. Guatemala has no general data protection law yet. Its Constitution protects privacy, correspondence and documents (arts. 24 and 44). It also gives people the right to know and correct what State records hold about them (art. 31). BunnyDrop applies these rights to everyone.
- Owners: you can see and correct your profile in Settings. For a copy or deletion, email info@bunnydrop.io.
- Customers: contact the business first. If it does not answer, email us with the business's name.
- Facebook or Instagram data: see the instructions and status page.
We answer within 30 days and may ask you to verify your identity first.
10. Security
All traffic uses HTTPS. Passwords are hashed and app tokens are kept in an encrypted store, with internal access limited to service operators. If an incident affects personal data, we will notify the affected people, the business and the platforms that require it without undue delay.
11. Minors
Business accounts are for people over 18. Businesses must not target giveaways at minors, or collect their data, without the consent of a parent or guardian.
12. Cookies
Only technical cookies and browser storage (session, language, theme, security). No advertising cookies.
13. Changes and contact
We will publish changes at this address with a new version number and date. If a change is significant, we will give notice in the app or by email before it applies.
Privacy contact: BunnyDrop · Hyper Reality Company, Guatemala · info@bunnydrop.io · https://bunnydrop.io