Lead Generation
Dropcontact
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Dropcontact · www.dropcontact.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Dropcontact at a glance
- Vendor
- Dropcontact
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates Dropcontact 2/5, the mean of 6 judges. Dropcontact is a French B2B contact tool that finds, enriches and cleans contacts the buyer supplies from minimal input — first name, last name, company — rather than a searchable prospect database. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Dropcontact is a French B2B contact tool that finds, enriches and cleans contacts the buyer supplies from minimal input — first name, last name, company — rather than a searchable prospect database. Data provenance is strongest, at 6-8: the captured pages state no stored contact database, no purchased datasets, no scraped directories and no user-contributed reuse, results are generated in real time, and an on-site CNIL audit in 2019 closed in 2020 with no fine or formal notice. Visitor identification is weakest, scores sitting at 0. Data coverage scored 2-4 — validity rates of 99% nominative and 97% catch-all are published, but no per-country figures, and company fields (SIREN, NAF code, VAT number) come from French registers. CRM sync and export scored 5-6, with native Pipedrive and HubSpot cleaning, duplicate merging and company-change detection, Salesforce and Zoho planned. Judges split on sovereignty, 4-7: compliance pages state processing exclusively on European servers with no transfer outside the EU, while the privacy charter cites standard contractual clauses for subcontractor transfers, and we found no public information naming subprocessors or hosting infrastructure.
Speaks for it
- Emails are generated in real time from minimal input with no stored contact database, no purchased datasets, no scraped directories and no user-contributed reuse
- An on-site CNIL audit in 2019 covering servers, stored data and source code closed in November 2020 with no fine and no formal notice
- Published validity rates of 99% for nominative and 97% for catch-all emails, with verification on the vendor's own European servers
- Native Pipedrive and HubSpot integrations clean and enrich existing CRM records, merge duplicates even without common fields and detect contacts who changed company
- A public data processing agreement grants audit rights and 72-hour breach notification by email, with a request route for contacts to stop enrichment of their data
Held against it
- We found no public information on website visitor identification or intent signals — the pages describe enrichment of contacts the buyer already supplies
- We found no public information on per-country coverage, and the published company fields — SIREN, NAF code, VAT number — are French register data
- The captured pages give different positions on transfers outside the EU, and we found no public information naming the subprocessors or hosting infrastructure
- Salesforce and Zoho are named as planned, and we found no public information on API rate limits, per-call credit costs or export retention after cancellation
- The only price on the captured pages is 50 emails for free, with no public information on tier prices, seat costs or credit expiry
Best for
- You need to find, verify and enrich emails for contacts you already hold, with real-time generation instead of a stored database
- Your team runs Pipedrive or HubSpot and wants automated cleaning, duplicate merging and company-change detection on existing records
- Your compliance review weights European processing — the pages state processing exclusively on European servers, backed by a closed CNIL audit and a public data processing agreement
- You run GDPR-based email outreach and want vendor guidance that legitimate interest covers B2B prospecting with a mandatory easy unsubscribe in every email
Avoid if
- You need to know which companies are visiting your website — visitor identification scored 0, and the product described enriches contacts you already supply
- Your CRM is Salesforce or Zoho — both are named as planned integrations, with Pipedrive and HubSpot the available native ones
- Your pipeline depends on German, Austrian or Swiss register data — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Coverage, accuracy & freshness | 1.5 of 5 |
| Data sources & lawful basis | 3.5 of 5 |
| Visitor identification & intent signals | 0 of 5 |
| Prospecting workflow & outreach rules | 2 of 5 |
| CRM sync, enrichment & export | 2.5 of 5 |
| European sovereignty | 3.5 of 5 |
Coverage, accuracy & freshness
Show reasoningHide reasoning
How this is scored
How much of the target market the database actually covers — judged on DACH and EU coverage as much as North American — and what the vendor documents about verification and refresh, because accuracy claims cannot be checked from outside.
0 — No stated coverage, no refresh cadence, no verification method; accuracy asserted as a percentage with nothing behind it.
3 — Headline record counts for the whole database, thin or unstated European coverage, and no description of how often records are re-verified.
5 — Coverage stated per country or region including DACH, email verification described, a stated refresh cadence, and firmographics beyond name and domain.
8 — Coverage broken down by country, industry and data type (email, direct dial, mobile), verification method and refresh cadence documented, company data drawn from official registers where available, and a bounce or credit-back guarantee with stated terms.
10 — The vendor is accountable for its data: per-country coverage and accuracy methodology published, every field carrying a last-verified date visible to the user, register-sourced company data, and credit-back terms that make inaccuracy the vendor's cost rather than the buyer's.
The SDR Team Lead
The numbers my reps would lean on are validity rates — 99% for nominative emails and 97% for catch-all — plus firmographics like SIREN and NAF codes drawn from the French register, but I found no public information on coverage by country or industry, and nothing on DACH records specifically. Verification is described as real-time algorithmic validation on the vendor's own European servers, which is more than a bare percentage claim, but I found no public information on credit-back or guarantee terms when an email bounces. 1 5
The RevOps Manager
Verification is genuinely described — real-time algorithmic generation with email verification on the vendor's own European servers — and enrichment goes past name and domain into SIREN number, NAF code and salary range. But I found no public information on coverage per country or region including DACH, no re-verification cadence, and no bounce or credit-back guarantee, so accuracy rests on the published percentages (99% nominative, 97% catch-all) that I cannot check from outside. 1 5
The Data Protection Officer
The pages state validity rates of 99% for nominative emails and 97% for catch-all emails, describe email verification running on the vendor's own European servers, and enrich firmographics including industry, company size, NAF code and SIREN number drawn from the French register. I found no public information on coverage broken down per country or region including DACH, no per-country or per-data-type figures, and no bounce or credit-back guarantee for inaccurate results. 1 5
The ABM Marketer
Verification is genuinely described — results generated in real time and checked on the vendor's own European servers, with validity rates of 99 percent for nominative and 97 percent for catch-all emails — and firmographics go well beyond name and domain (SIREN, NAF code, VAT number, salary range). But the pages say nothing about coverage of Germany, Austria, Switzerland or any other country, there are no headline counts of any kind, and I found no bounce guarantee or credit-back terms. 1 5
The DACH Sales Director
Validity rates of 99% for nominative and 97% for catch-all emails are stated, with verification described as real-time algorithms on the vendor's own European servers — but the pages state no coverage figures per country, and I found no public information on Germany, Austria or Switzerland coverage. The register enrichment I can see is French (SIREN, NAF code, intra-community VAT), which tells me nothing about Handelsregister or Swiss UID data for my deals. 1 5
The Skeptic
Accuracy is asserted as percentages — 99% for nominative emails, 97% for catch-all — with verification described as real-time generation on the vendor's own European servers rather than a stored database. We found no public information on hit rates, per-country coverage for DACH or any other market, a refresh cadence, or a bounce and credit-back guarantee; the company fields on offer (SIREN, NAF, VAT number) point at French registers and nothing documents coverage beyond France. 1 5
Data sources & lawful basis
Show reasoningHide reasoning
How this is scored
Where the personal data in the database comes from and on what legal basis it is processed — as evidenced on the vendor's own pages. Covers Art. 6(1)(f) legitimate interest, the Art. 14 notice to the people in the database, and whether they can find, object to and remove their record.
0 — No statement of where contact data comes from or on what legal basis; "GDPR-compliant" asserted without explanation, and no way for a listed person to object.
3 — Sources described in general terms ("public sources", "partners"), legitimate interest named without any balancing, and an opt-out request form as the only route for data subjects.
5 — Source categories named (registers, company websites, contributory networks, licensed partners), legitimate interest stated as the basis for EU records, a dedicated privacy notice for the people in the database, and a self-service opt-out or removal process.
8 — The above plus an Art. 14 notification practice described (people informed when added), contributory or browser-extension collection disclosed as such, a legitimate-interest assessment summarised publicly, and EU records handled differently from US records where the law differs.
10 — Provenance is traceable per record: the source and collection date available for each contact, Art. 14 notices sent and documented, the balancing test published, objections honoured across the whole dataset and suppressed permanently, and no data sourced by scraping behind logins or from contributors' address books without their contacts' knowledge.
The SDR Team Lead
The source story is unusually clean: they state no purchased datasets, no scraped directories and no reuse of contributor data, with results generated in real time from the name and company you supply and nothing retained after processing. A full on-site CNIL audit closed in November 2020 with no fine and no formal notice — that is regulator-grade evidence, not a marketing badge. It falls short of the top because I found no public information on a published balancing test or an Article 14 notification practice, and the stated position is that the legal-basis question is not applicable because no personal data is stored. 1 4 5 6
The RevOps Manager
The provenance story is unusually strong for this category: no purchased datasets, no scraped directories, no reuse of user-contributed data, real-time generation from minimal input, and a mechanism for a contact to stop being enriched. A full on-site CNIL audit closed in 2020 with no fine is the closest thing to independent validation I have seen on a vendor's own pages. I found no public information on per-record source traceability or a published balancing test, and the stated legal basis being "not applicable" because nothing is stored is the vendor's position rather than something I can verify. 1 4 5 6
The Data Protection Officer
This is the strongest evidence I have seen in the category: the vendor states no contact database is stored or resold, no purchased datasets, no scraped directories and no user-contributed data are used, results are generated in real time from minimal input, and an on-site CNIL audit covering servers, stored data and source code was closed with no fine and no formal notice. A dedicated request route lets a contact stop enrichment of their data, requests are relayed to the customer as controller, and a data processing agreement commits the vendor as processor with a written processing register and destruction within one month of services ending. I found no public information on an Art. 14 notification practice towards enriched individuals or a published legitimate-interest assessment, which keeps this short of the top band. 1 2 3 5 6
The ABM Marketer
The provenance model is stated on the vendor's own pages: no purchased datasets, no scraped directories, no user-contributed data reuse, nothing stored or resold, everything generated in real time from first name, last name and company — and it survived a full on-site CNIL audit closed in 2020 with no fine and no formal notice. What keeps this below the top: sources are only described negatively rather than as named categories, there is no published balancing test (the vendor says the legal basis is not applicable because nothing is stored), and the objection route is a request mechanism to stop enriching a given contact rather than a self-service removal from a database. 1 5 6
The DACH Sales Director
The provenance model is unusually well disclosed: no stored contact database, real-time generation from the input I supply, and explicit refusals of purchased datasets, scraped directories and user-contributed reuse — claims the CNIL audited on-site in 2019 and closed in 2020 without fine or formal notice. Contacts have a route to stop Dropcontact enriching their data, requests are relayed to the customer as controller, and a privacy charter and DPA are public. I found no public information on an Art. 14 notification practice or a published balancing test. 1 2 5 6
The Skeptic
The pages describe an unusual provenance model — real-time generation from first name, last name and company, with stated no purchased datasets, no scraped directories, no user-contributed data reuse and no stored people database — backed by a 2019 CNIL on-site audit of servers, stored data and source code, closed with no fine and no formal notice. A contact GDPR request route exists to stop enrichment of a person's data, and the vendor's own processing is stated as having no applicable legal basis because nothing is stored. What the pages do not do is name the sources the algorithms actually query, and we found no public information on an Article 14 notification practice for the people whose emails are generated or a published balancing test. 1 5 6
Visitor identification & intent signals
Show reasoningHide reasoning
How this is scored
Identifying companies behind website visits and surfacing buying intent — scored on what is identified (company or person), how the tracking works, and whether the vendor states that its script needs consent under §25 TDDDG and how it behaves without it.
0 — No visitor identification or intent data, or person-level identification of EU visitors with no statement of legal basis.
3 — Reverse-IP company identification with a cookie-setting script, no statement about consent, and match rates claimed without method.
5 — Company-level identification with filters, visit history per company, a stated position that the script requires consent where it sets cookies, and a consent-mode or cookieless option.
8 — Company-level only for EU traffic by design, cookieless operation documented, integration with common consent management platforms, intent topics or page-level signals with the source of third-party intent data named, and alerts routed to owners.
10 — Identification that survives a DPO review: no personal data of visitors stored, the TDDDG and GDPR position published and specific, third-party intent data sourced from a named co-op or panel with its consent basis stated, and scoring on intent that the user can trace back to the underlying visits.
The SDR Team Lead
Everything captured describes email finding, enrichment, cleaning and deduplication of contacts the buyer supplies; I found no public information on identifying companies behind website visits, on intent topics, or on any tracking script and its consent handling. 1 5
The RevOps Manager
We found no public information on website visitor identification, reverse-IP matching or intent signals — the captured pages describe enrichment of contacts the customer supplies. The only cookie statement is the thirteen-month retention for cookies on the vendor's own site, which is not a product capability. 1 2
The Data Protection Officer
We found no public information on website visitor identification, reverse-IP company matching, buying intent data or any tracking script; the captured product pages describe enrichment of contacts the customer already supplies from a first name, last name and company. 1 5
The ABM Marketer
I found no public information on identifying companies behind website visits, intent topics, a named third-party intent source, consent-mode behaviour, or alerts routed to account owners. The product described is enrichment of contacts I already hold — from a first name, last name and website, or a file or CRM — which does nothing to tell me which of my target accounts are actually in market. 1
The DACH Sales Director
I found no public information on visitor identification or intent signals — the pages describe email finding, enrichment and CRM cleaning only. The one cookie statement I can see concerns retention on the vendor's own site, not a tracking product for buyers. 1 2
The Skeptic
The captured pages describe enrichment of contacts and companies the buyer already holds; we found no public information on website visitor identification, intent signals, a tracking script, or any statement of its consent behaviour. Judged by the published descriptions of absence, this scores at the bottom. 1 5
Prospecting workflow & outreach rules
Show reasoningHide reasoning
How this is scored
Search, list building and outreach — and whether the product helps the buyer stay within UWG §7 and the GDPR once the list exists, rather than leaving the legal risk entirely with the customer.
0 — A search box and an export button; nothing on the pages about what the buyer may lawfully do with the contacts.
3 — Filters on firmographics and job title, saved lists, and a terms clause making the customer solely responsible for compliance.
5 — Advanced filters including technographics and triggers, company-level lists and alerts, a global suppression or do-not-contact list, and guidance on cold outreach rules in the main EU markets.
8 — The above plus country-aware handling (for example flagging German contacts where cold calls and emails require consent), phone numbers checked against national do-not-call registers where they exist, and opt-outs from outreach synced back to the database.
10 — Compliance is part of the workflow: outreach channels restricted or flagged per country and contact type by default, suppression shared across the whole account and every export, the Art. 14 notice supported at first contact, and a documented record of how each contact entered the buyer's pipeline.
The SDR Team Lead
The GDPR and cold-emailing guide gives my SDRs usable rules — legitimate interest as the basis for B2B prospecting, no prior consent needed to contact professionals, and a mandatory easy opt-out in every email — but it stays at GDPR level, and I found no public information on market-specific rules such as Germany's on cold calls and emails. There is no prospect search or filtering to judge, since the product runs on contacts you upload, and the closest thing to a trigger is job-change detection on existing contacts. I found no public information on a do-not-contact suppression list or checks against do-not-call registers. 1 3 4
The RevOps Manager
The GDPR and cold-emailing guidance goes beyond a liability dump: legitimate interest as the basis, professionals contactable without prior consent, and a mandate that every email carries a simple unsubscribe. What I don't see is workflow enforcement — I found no public information on search filters or trigger-based lists, a global suppression or do-not-contact list, country-aware flagging, or checks against national do-not-call registers. 1 4
The Data Protection Officer
The vendor publishes substantive guidance that B2B prospecting emails rest on legitimate interest, that professionals may be contacted without prior consent, and that every email must carry a simple opt-out, while duplicate detection, merging and company-change detection keep lists clean. I found no public information on country-aware flagging such as German consent rules for calls and emails, a global suppression or do-not-contact list carried across exports, checks against national do-not-call registers, or support for the Art. 14 notice at first contact. 1 4
The ABM Marketer
There is real outreach guidance on the vendor's pages — legitimate interest as the basis for B2B prospecting, no prior consent needed to contact professionals, and a simple unsubscribe required in every email — which is more than a liability clause pushed onto the customer. But the guidance is GDPR-generic rather than country-aware, with nothing flagging where the stricter national rules bite, and I found no global suppression or do-not-contact list in the workflow. 4 6
The DACH Sales Director
A dedicated guide states that B2B prospecting emails rest on legitimate interest without prior consent and that every email must carry a simple unsubscribe — genuinely useful, but it speaks only to email under GDPR generally. I found no public information on cold-call rules per market such as UWG §7 in Germany, on a suppression or do-not-contact list, or on checks against do-not-call registers, and the customer is placed in the controller role for outreach. 2 4
The Skeptic
The help pages give the buyer real guidance — legitimate interest as the basis for B2B prospecting, professionals contactable without prior consent, and an unsubscribe requirement on every email — and the DPA fixes the customer as controller with the vendor assisting data-subject requests. We found no public information on a suppression or do-not-contact list, country-aware flagging for markets such as Germany, or do-not-call register checks, and there is no search or list-building workflow on these pages to govern in the first place. 1 3 4
CRM sync, enrichment & export
Show reasoningHide reasoning
How this is scored
Getting the data into the systems where sales works — CRM sync, enrichment of existing records, API — and what happens to exported data, and to the buyer's access to it, when the subscription ends.
0 — Manual CSV export only; no CRM integration and no API.
3 — A one-way push to one CRM, CSV export, and no statement on whether exported data may be kept after cancellation.
5 — Native sync with the major CRMs including field mapping and deduplication, enrichment of existing CRM records, and a documented API with stated limits.
8 — Bidirectional sync with scheduled re-enrichment, update and deletion propagated when a record changes or a person objects, webhook or API access with credit costs per call published, and data retention rights after cancellation stated plainly.
10 — The vendor treats the buyer's CRM as the system of record: objections and corrections propagated into synced records automatically, full change history per field, a versioned API with a deprecation policy, and exit terms that say exactly which data the customer may keep and for how long.
The SDR Team Lead
Native Pipedrive and HubSpot integration with plug-and-play setup under five minutes, cleaning and enrichment of existing CRM records, duplicate merging even without common fields, plus a documented API with an MCP server and Zapier, Make and n8n — that is how my team actually works. Salesforce and Zoho are only 'soon', and I found no public information on field mapping, API rate limits or credit costs per call, or on which exported data the buyer may keep after cancelling; the only end-of-service term captured is that the vendor destroys its own copy within a month. 1 3 6 7
The RevOps Manager
This is the part I care about most and the basics score well: native HubSpot and Pipedrive, duplicate detection and merging even when records share no fields, and detection of contacts who changed company with fresh enrichment rather than a new duplicate. The captured pages give different signals on Salesforce (native integration "soon" on the homepage, listed in the help center), and I found no public information on field mapping, bidirectional sync, API rate limits or credit costs per call. Nothing states what we may keep in exports after cancellation; the only exit statement is the vendor destroying our data within a month of the services ending. 1 3 6 7
The Data Protection Officer
Native integrations with Pipedrive and HubSpot cover cleaning, enrichment and duplicate merging even where records share no fields, Salesforce and Zoho are named as planned, and an API with key, an MCP server, a Google Sheets add-on, Zapier, Make, n8n and processing of Excel, CSV and.txt files are documented in the help center. The data processing agreement commits the vendor to destroy all personal data no later than one month after the services end, though that governs the vendor's own copy; I found no public information on stated API limits or per-call costs, field mapping, propagation of objections or corrections into synced records, or what the customer may keep after cancellation. 1 3 6 7
The ABM Marketer
Native Pipedrive and HubSpot integrations clean and enrich existing CRM records, merge duplicates even when they share no fields, and detect when a contact changes company and refreshes their data — with an API, an MCP server, CSV handling and 1,200 connectable tools around it. Salesforce and Zoho are only planned, though, the captured pages state no API limits or per-call credit costs, and I found no statement on whether enriched records may be kept after the subscription ends. 1 3 6 7
The DACH Sales Director
Native integrations with Pipedrive and HubSpot (Salesforce and Zoho announced as coming soon), duplicate detection and merging even without common fields, cleaning and enrichment of existing CRM records, company-change detection, plus an API, MCP server, Zapier/Make/n8n and a Google Sheets add-on. I found no public information on API rate limits or credit costs per call, on how objections propagate into synced records, or on what exported data the customer may keep after cancellation — the one-month destruction commitment covers the vendor's own copy only. 1 3 6 7
The Skeptic
Native HubSpot and Pipedrive integrations clean and enrich CRM records, detect and merge duplicates even when contacts share no fields, and flag contacts who changed company; an API with an MCP server, a Google Sheets add-on and Zapier, Make and n8n cover the other routes in. Salesforce and Zoho appear as planned, and we found no public information on stated API limits, per-call credit costs, or the buyer's retention rights over exported data after cancellation — the only retention term captured is the vendor destroying its own copies within one month of service end. 1 3 6 7
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Where a database of EU residents' personal data is held, who the contracting entity and controller are, and which subprocessors see it. Independently sourced by the sovereignty pipeline; weighted heavily here, because the product itself is personal data about people who never chose the vendor.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and EU residents' contact data processed outside the EU with no stated transfer basis.
3 — Non-EU contracting entity with an EU representative under Art. 27, or EU hosting offered while enrichment, support or AI processing stay non-EU.
5 — EU contracting entity and EU hosting as standard, but parts of the chain — data partners, enrichment sources, tracking infrastructure — are non-EU without an explained safeguard.
8 — EU contracting entity and controller, EU hosting on named infrastructure, subprocessor and data-partner list published, and any non-EU transfer named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, controller, hosting, data partners and every subprocessor European, certification published, and a DPA covering both the customer's data and the database records the customer exports.
The SDR Team Lead
The vendor's own pages give a French contracting entity registered in Bobigny and processing exclusively on European servers, backed by a CNIL audit that examined servers, stored data and source code. The captured pages give different positions on transfers — one states no personal data is transferred outside the EU, while the data protection terms cite standard contractual clauses governing transfers outside the European Union. I found no public information naming subprocessors, data partners or hosting infrastructure, and the independent sovereignty check left jurisdiction, residency and subprocessor exposure unconfirmed, so I hold this score down. 2 3 5
The RevOps Manager
The captured pages put the contracting entity in France with an RCS Bobigny registration, all processing on European servers with no personal data transferred outside the EU, and a passed CNIL audit behind them. What holds it back: I found no published list of named subprocessors or data partners and no named hosting infrastructure, and the privacy charter refers to standard contractual clauses for transfers to subcontractors outside the EU while the compliance pages state no transfer happens — the captured pages give different figures on that point. 2 3 5
The Data Protection Officer
The captured legal pages state a French contracting entity registered at an address in Aulnay-Sous-Bois, hosting on servers of companies located in the European Union, and no personal data transferred outside the EU, while the privacy charter separately references standard contractual clauses for subcontractor transfers abroad, so the captured pages give different positions on outside-EU transfer. The on-site CNIL audit of servers, stored data and source code, closed without fine, evidences the EU-processing posture more strongly than a self-declaration. I found no public information naming the hosting infrastructure or the individual subprocessors, including the payment service provider. 2 3 5
The ABM Marketer
The contracting entity is French (registered at RCS Bobigny), EU hosting is stated, processing is claimed to occur exclusively on European servers, and a published DPA grants audit rights, 72-hour breach notification by email, and destruction of data within a month of the service ending. Two gaps hold it back: no named hosting infrastructure and no published subprocessor list, and the captured pages give different figures on outside-EU transfers — the privacy charter cites standard contractual clauses for transfers to subcontractors outside the EU while the compliance pages say no personal data is transferred outside the EU. 2 3 5
The DACH Sales Director
The captured legal pages name a French company with an RCS Bobigny registration, state hosting on EU servers with processing exclusively in Europe and no transfer outside the EU, and the CNIL — granted direct access to servers, stored data and source code — closed its audit with no fine. What keeps this short of the top: I found no public information on a published subprocessor list or named infrastructure, and the captured pages give different positions on non-EU transfer, with the privacy charter also citing standard contractual clauses with subcontractors. 2 3 5
The Skeptic
The vendor's own pages show a French entity registered at RCS Bobigny, EU-only processing with no personal data transferred outside the EU, a published DPA with audit rights over subcontractors, and a closed CNIL audit that examined servers, stored data and source code. We found no public information on ownership, named hosting infrastructure, or a published subprocessor list; a privacy-charter clause on standard contractual clauses for outside-EU subcontractor transfers sits beside help-page assurances that nothing leaves the EU, and the subcontractors themselves are never named. 2 3 5
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone — including credits per email, phone number and mobile, credit expiry, seat pricing, visitor-identification tiers and the API — in a category where the unit of billing is often invented by the vendor.
0 — No public prices at all; every tier is a sales conversation.
3 — A monthly headline exists, but what a credit buys, whether credits expire, or the cost of an additional seat is unstated — the invoice is unknowable.
5 — Tier prices public with credit allowances given, but at least one commonly needed piece (mobile numbers, extra seats, API access, CRM sync) is unpriced or behind a sales call.
8 — Every tier priced publicly with credits per data type, credit expiry and rollover, per-seat costs, overage rates, minimum term and VAT treatment stated.
10 — Complete price computability: the annual invoice derivable for a given number of seats, exported contacts by data type, identified companies and API calls, with every credit cost and the refund rule for inaccurate data published.
The SDR Team Lead
The only public number I found is 50 free emails; I found no public information on tier prices, credit costs by data type, seat pricing, credit expiry, minimum term or VAT treatment, so a month's invoice for my pod is not computable from the pages. A help entry confirms the first year is priced differently with a CRM subscription but gives no figure. 1 6
The RevOps Manager
The only public number I can find is fifty free emails; there is no tier price, seat cost, credit expiry, overage rate or VAT treatment anywhere in the captures. A help-center question confirms the first year is priced differently with a CRM subscription, which tells me the invoice is shaped in ways the pages do not show. 1 6
The Data Protection Officer
The only public price point on the captured pages is 50 emails for free, alongside a help-center note that the first year is priced differently with a CRM subscription. I found no public information on tier prices, what a credit buys per data type, credit expiry or rollover, per-seat costs, minimum term, VAT treatment, or API pricing, so a buyer cannot compute the annual invoice from the public pages. 1 6
The ABM Marketer
The only concrete numbers I could find are 50 free emails, a free trial of the CRM integration, and a help-center note that the CRM subscription has a different first-year price. No tier prices, credit costs per data type, credit expiry, seat costs or VAT treatment appear in the captured pages, so a buyer cannot begin to compute the annual invoice from public pages. 1 6
The DACH Sales Director
The only figure the captured pages give is 50 emails for free; I found no public information on tier prices, credit costs, expiry, seat pricing or API costs. The CRM pricing FAQ even acknowledges a different first-year price without stating it, so an annual invoice cannot be computed from what is published. 1 6
The Skeptic
The only figure we found is 50 emails for free; no tier prices, credit costs per data type, credit expiry, seat pricing, overage rates or API rates appear in the captured pages, and a pricing FAQ about the first year of a CRM subscription points to tiered pricing that is not shown. From these pages the annual invoice is unknowable. 1 6
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Dropcontact
Is Dropcontact European?
Not determined: the vendor’s pages as captured do not say where Dropcontact is based.
Where does Dropcontact store data?
Not stated on the vendor’s pages as of 20 Oct 2026.
Does Dropcontact have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to Dropcontact?
As of 21 Oct 2026, the panel rates Cognism (3/5), Dealfront (2.5/5) and Apollo.io (2.5/5) highest among the other 35 Lead Generation products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Cognism (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Dropcontact alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (7)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.dropcontact.com Checked 20 Oct 2026 Details →
- 2 Privacy policy — found from the homepage www.dropcontact.com Checked 20 Oct 2026 Details →
- 3 Data processing agreement (dpa) — found from the homepage www.dropcontact.com Checked 20 Oct 2026 Details →
- 4 Prospecting workflow & outreach rules — found from sitemap www.dropcontact.com Checked 20 Oct 2026 Details →
- 5 Prospecting workflow & outreach rules — found from sitemap www.dropcontact.com Checked 20 Oct 2026 Details →
- 6 CRM sync, enrichment & export — found from sitemap www.dropcontact.com Checked 20 Oct 2026 Details →
- 7 CRM sync, enrichment & export — found from sitemap www.dropcontact.com Checked 20 Oct 2026 Details →