This policy explains what personal data DryMarket processes, why, on what legal bases, and how to exercise your rights. It applies to the dry.market website and its localized versions.
Last updated: July 21, 2026
The data controller is TomSaaS Inc., a company incorporated in the State of Delaware (United States).
TomSaaS Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States. EIN: 78-3894605.
For any question about your personal data, write to [email protected].
Although the operator is based in the United States, DryMarket addresses in particular the European Union public and applies the General Data Protection Regulation (GDPR).
Account and authentication: when you create an account, we process your e-mail address, username, display name, country and, where applicable, your profile picture. Authentication and password storage are handled by our processor Supabase; we never have access to your password in clear text.
Google sign-in: if you choose to sign in with Google, we receive the basic information from your Google profile (e-mail address, name, picture) needed to create your account.
Contributions: the reviews (rating, title, text, photos), favorites, lists, edit suggestions and reports you publish are linked to your account.
Claiming a place or a brand: to verify that you represent a business or a brand, we collect your full name, e-mail, phone number, a registration number (for example a SIRET or VAT number) and a supporting document you upload. These documents are stored in a private space and can only be viewed by our administration team.
To understand how the service is used, we keep daily aggregated counters: page views, product views, search terms, scanned barcodes, outbound clicks and visit sources.
These counters are anonymous by design: they record no account identifier, no IP address and no session data that could re-identify you. They serve only global statistics and never influence the DryScore or the ratings.
DryMarket does not use advertising cookies or third-party trackers for tracking purposes. We do not carry out advertising profiling.
The only cookies set are strictly necessary for the site to work: they keep your login session (managed by Supabase Auth) and remember preferences such as language or theme. Being essential, they do not require a consent banner.
Providing the service, your account and your contributions: performance of the terms of use you accept (Article 6.1.b GDPR).
Verifying place and brand claims, ensuring moderation and platform security, preventing abuse: the operator's legitimate interest (Article 6.1.f).
Measuring audience anonymously: legitimate interest; these measurements do not concern personal data.
Sending you service-related messages, for example your e-mail confirmation: performance of the contract.
We do not sell your data. It is accessible to our authorized team and to technical processors acting on our instructions:
As the operator is based in the United States and some processors may host data outside the European Union, your data may be transferred outside the EU. Such transfers are framed by the appropriate safeguards provided for by the GDPR, in particular standard contractual clauses.
Account and contributions: kept as long as your account is active. When you delete your account, your personal data is deleted or anonymized within a reasonable time, unless a legal retention obligation applies.
Claim supporting documents: kept for the time needed to process the request, then for the period necessary to evidence the right granted.
Anonymous audience statistics: as they are not linked to any person, they may be kept without a time limit.
In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability regarding your personal data.
You can edit much of your information directly from your account area and delete your contributions (reviews, favorites, lists). For any other request, or to delete your account, write to [email protected].
You may also lodge a complaint with a supervisory authority, for example the CNIL in France (www.cnil.fr).
Access to data is protected by database-level security rules (Row Level Security), which limit public reading to published content only. Sensitive documents, such as claim supporting documents, are kept in private spaces accessible only to administration through temporary links.
Passwords are encrypted and managed by our authentication provider; they are never shared with us in clear text.
DryMarket is about non-alcoholic drinks and addresses a wide audience. The service is nonetheless not intended for children: creating an account requires having the minimum age required by the law of your country to consent to the processing of your data. If you believe a minor has provided us with data without authorization, contact us so we can delete it.
For any question about this policy or your personal data, write to [email protected]. General support remains reachable at [email protected].
We may update this policy to reflect changes to the service or to regulations. In case of a significant change, we will inform you by an appropriate means. The last-updated date appears at the top of this page.
Related documents
