DRSLTR 1 filename1.htm DRSLTR

February 2, 2018

Via EDGAR and Overnight Delivery

U.S. Securities and Exchange Commission

Division of Corporation Finance

100 F Street, N.E.

Washington, D.C. 20549

Attention: Barbara Jacobs
  Stephen Krikorian
  Melissa Walsh
  Jan Woo
  Bernie Nolan

 

  Re: Dropbox, Inc.
    Amendment No. 1 to
    Draft Registration Statement on Form S-1
    Submitted December 4, 2017
    CIK No. 0001467623

Ladies and Gentlemen:

On behalf of our client, Dropbox, Inc. (“Dropbox” or the “Company”), we submit this letter in response to comments from the staff (the “Staff”) of the Securities and Exchange Commission (the “Commission”) contained in its letter dated December 20, 2017, relating to the above referenced Amendment No. 1 to Draft Registration Statement on Form S-1 submitted to the Commission on December 4, 2017 (the “Registration Statement”). We are concurrently submitting via EDGAR this letter and a revised draft of the Registration Statement (“Amendment No. 2”). For the Staff’s reference, we are providing to the Staff by overnight delivery copies of this letter as well as both a clean copy of Amendment No. 2 and a copy marked to show all changes from the version confidentially submitted on December 4, 2017.

In this letter, we have recited the comments from the Staff in italicized, bold type and have followed each comment with the Company’s response. Except for page references appearing in the headings and Staff comments below (which are references to the Registration Statement submitted on December 4, 2017), all page references herein correspond to Amendment No. 2.


Securities and Exchange Commission

February 2, 2018

Page 2

 

Prospectus Summary

Our Growth Strategy, Page 4

 

1. In response to prior comment 1, you state that you do not believe disclosing active registered users is necessary to give more context to your disclosure. We note, however, that the 500 million registered user metric that you reference throughout the prospectus accounts for every user that ever registered regardless of whether or not the user has used your platform in any recent period. Likewise, your estimate of 300 million registered users encompasses all registered users with at least one of three characteristics that make them more likely to pay over time, none of which accounts for utilization levels. As it appears that the level of activity on your platform among the registered user base would necessarily bear on the scale of your paid conversion opportunity, please disclose the number of active registered users or other information to help investors understand your consideration of this issue. Your disclosure may explain the limitations of this metric such as seasonal fluctuations and the effect of marketing campaigns, as you advise in your response.

The Company respectfully advises the Staff that its management does not monitor any type of aggregate active user metrics over time as predictors of revenue or conversion. The Company does not charge based on activity level or generate any other revenue (such as advertising) based on activity level, so it is not viewed as an important indicator for the business. Further, as management does not view such metrics as relevant to conversion, the Company does not set goals on these metrics. The Company has added risk factor disclosure on page 35 to clarify that it does not comprehensively track user activity levels for financial planning and forecasting purposes.

The Company further advises the Staff that based on the user activity data the Company does have, the Company has not seen a positive correlation between the number of aggregate active users and the number of paying users. The factors that the Company believes makes certain registered users more likely than others to convert to paying users have already been disclosed in the Registration Statement: users that (i) have used a business domain email to sign up to the Company’s platform; (ii) have used specific types of laptop, phone, or tablet devices to access the Company’s platform; or (iii) signed up from certain countries in more developed markets in North America, Europe, and Asia Pacific. The Company respectfully advises the Staff that it has revised the disclosure on pages 59 and 86 to 87 accordingly.

In addition, the Company respectfully advises the Staff that the 500 million and 300 million registered user metrics do not include users whose accounts have been closed due to inactivity and non-responsiveness. The Company has revised the disclosure on page 65 to reflect this and to also disclose that the Company continues to close long-inactive and non-responsive accounts and, when closed, removes the affected users from its user metrics.

 

2. As you indicate in response to prior comment 2, please revise to state that you derive your estimate of 300 million registered users from your observation that “substantially all of [your] paying users have at least one” of the listed characteristics. Further, clarify that this subset of registered users is more likely “than other registered users” to become paying users over time.

 


Securities and Exchange Commission

February 2, 2018

Page 3

 

The Company respectfully advises the Staff that it has revised the disclosure on pages 4, 59, and 87 to address the Staff’s comment.

Risk Factors

“We are subject to export and import control laws and regulation . . . ,” page 26

 

3. In response to prior comment 6, you state that you discovered that your platform had been accessed by users with IP addresses in Iran, Syria, Sudan and North Korea. North Korea was designated as a state sponsor of terrorism on November 20, 2017. Please describe to us your contacts with Iran, Syria, Sudan and North Korea. Your description should include any contacts related to Dropbox Plus, Dropbox Professional, Dropbox Business, and other products, services, technology or software that may not involve personal communications as set forth in OFAC general licenses. Please also discuss the materiality of your contacts with those countries, in quantitative terms and in terms of qualitative factors that a reasonable investor would deem important in making an investment decision. You should address the potential impact of the investor sentiment evidenced by divestment and similar initiatives that have been directed toward companies with operations associated with U.S.-designated state sponsors of terrorism.

The Company respectfully advises the Staff that its contacts with Iran, Syria, Sudan, and North Korea involve only the provision of the Company’s “personal communications” software and services to free and paying customers in certain of those countries.

The Office of Foreign Assets Control’s (OFAC) “personal communications” general licenses have authorized the Company’s provision of its software and services to its free and paying users in Sudan and Iran for all Dropbox accounts, including Dropbox Plus, Dropbox Professional, and Dropbox Business. Accordingly, the Company is unaware of any OFAC violations with respect to those countries.

OFAC’s personal communications general licenses have also authorized the Company’s provision of its software and services to its free users in Syria. The Company historically employed IP address blocking in an effort to prevent the provision of its paid services into embargoed countries and regions. However, the Company discovered that, from 2014-2017, some users were able to register for and use paid services in Syria due to implementation gaps in the Company’s IP address blocking logic, which have since been remediated. The Company estimates that from 2014-2017, it had 992 users (across Dropbox Plus and Dropbox Business) potentially located in Syria amounting to an aggregate of $23,355.07 of revenue, or 0.0008% of its total revenue for that time period. The Company respectfully advises the Staff that this amount is de minimis and the Company is voluntarily disclosing the potential violations to OFAC.

North Korea does not appear to have an OFAC personal communications general license available. From 2016-2017, a small number of users in North Korea were able to register for and use paid services in North Korea due to implementation gaps in the Company’s IP address blocking logic, which have since been remediated. Specifically, the Company estimates that from 2016-2017 it had 24 paying users potentially located in North Korea amounting to an aggregate of $294.69 of revenue, or 0.00002%

 


Securities and Exchange Commission

February 2, 2018

Page 4

 

of its total revenue for that time period. The Company has since implemented IP address blocking logic to prevent both free and paid users from using its services within North Korea. The Company respectfully advises the Staff that North Korean use of its services has been de minimis and the Company is voluntarily disclosing these potential violations to OFAC.

Finally, the Company notes that with respect to both Syria and North Korea, other OFAC exemptions and general licenses may authorize the various services provided by Dropbox, thus any potential violations are unconfirmed.

Although violations of U.S. sanctions laws could result in fines and penalties for the Company, the Company believes that the potential impact of these potential OFAC violations is de minimis and will not materially affect investor sentiment as evidenced by divestment or similar initiatives.

Management’s Discussion and Analysis of Financial Condition and Results of Operations

Our Business, page 56

 

4. We note your response to prior comment 10. Please, however, address the recent changes to your Dropbox Business subscription plans if they are reasonably likely to have a material impact on your liquidity, capital resources, or results of operations. Further, to the extent material, address the opportunities, challenges and risks presented by your plan to pursue enterprise businesses as well as the actions that you are taking to address them. Refer to Sections III.A and III.B.3 of SEC Release No. 33-8350.

The Company respectfully advises the Staff that its recent product announcements have not had a material impact on its Dropbox Business subscription plans and do not represent a material change to the Company’s business model or focus. As a result, the Company does not expect such changes to have a material impact on its liquidity, capital resources, or results of operations, and it believes the current disclosure is appropriate. In the event that this expectation changes prior to the effectiveness of the Registration Statement, the Company will undertake to update the disclosure appropriately.

The Company further advises the Staff that, as disclosed in the Registration Statement, the Company utilizes a viral marketing approach and generates over 90% of its revenue from self-serve channels (i.e., users who purchase a subscription through its app or website). The Company focuses on increasing individual paying users, whether such users are grouped in teams on a Dropbox Business team plan or are individuals on a Plus or Professional plan. In cases where an organization already has had substantial organic adoption of the Dropbox platform, the Company will complement its self-serve strategy with a small and focused outbound sales effort. As such, the Company believes the current disclosure of its opportunities, challenges and risks as described in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” is appropriate.

 


Securities and Exchange Commission

February 2, 2018

Page 5

 

Our Subscription Plans, page 63

 

5. Please refer to prior comment 13 and clarify the extent to which you derive your paying users from the enterprise market versus the consumer market. In this regard, we note that you have been targeting the enterprise market since 2013 and that you launched Dropbox Enterprise to address the requirements of large organizations in 2015. Please disclose the number of customers that are organizations and the percentage of paying users that derive therefrom. Disclose this information with respect to large organizations as well. In addition, in order to understand the opportunity available to you to grow your enterprise business, disclose the number of organizations and, more specifically, large organizations within which Dropbox is being used. In this regard, we note your website states that “52% of the Fortune 500 use Dropbox Business to run their companies,” that “200,000 organizations rely on Dropbox to grow and secure their businesses,” and that “4 million businesses use Dropbox to work smarter.”

The Company respectfully advises the Staff that, as discussed in response to comment 4, the Company utilizes a bottom-up viral marketing approach. The Company respectfully advises the Staff that it has revised the disclosure on page 63 to clarify that it intends to continue utilizing this approach to grow its number of paying users. Further, the Company respectfully notes that while its Enterprise subscription plans offer more opportunities for customization for larger customers, companies and teams within companies do not need to subscribe to an Enterprise plan to use Dropbox for their business needs. The vast majority of Dropbox Business teams purchase the Company’s Standard or Advanced subscription plans, which offer robust capabilities for business uses. The Company has added disclosure on page 58 to this effect.

The Company respectfully advises the Staff that it cannot track the number of teams within organizations with certainty, as a single organization could have one or more teams, and the Company does not have sufficient information to confirm that any particular team is part of a single organization. The Company does not always have centralized billing for organizations and does not have an enterprise-driven sales team. As a result, the only way for the Company to track whether Dropbox Business is being used at a particular organization is through the domain email addresses that are associated with Dropbox Business team users, which is not a reliable way to track the number of organizations. Further, the Company does not generally track the size of organizations that use Dropbox (such as small- and medium-sized businesses and large enterprises) other than in isolated and limited circumstances, such as cross-checking the domain names of users within teams against the list of Fortune 500 companies.

The Company further advises the Staff that it has already disclosed information in the Registration Statement to help investors understand the opportunity available to the Company to grow the number of Dropbox Business teams. Specifically, the Company has disclosed that it has 290,000 Dropbox Business teams, and that of its 10 million paying users, approximately 30% use Dropbox for work on a Dropbox Business team plan.

The Company supplementally advises the Staff that the statistic on the Company’s website referencing 52% of the Fortune 500 refers to the percentage of Fortune 500 companies that have at least one Dropbox Business team within their organizations. As mentioned above, the Company arrived at this number through the manual process of cross-checking the individual user e-mail domain names within a Dropbox Business team against the Fortune 500 list. This analysis was possible given the limited sample size of the Fortune 500. The Company has added disclosure on pages 98 and 99 to provide this statistic (updated to reflect the latest percentage). The statistic on the Company’s website regarding 200,000

 


Securities and Exchange Commission

February 2, 2018

Page 6

 

organizations is a reference to the number of unique business e-mail domains and, as of September 30, 2017, would correspond to the 290,000 Dropbox Business teams. To be consistent with the disclosure in the Registration Statement, the Company has updated its website to reflect the current number of paying Dropbox Business teams. The statistic on the Company’s website regarding 4 million businesses refers to the fact that the Company has users at over 4 million different businesses, calculated based on the number of unique e-mail domains. While this information has been used for marketing purposes, the Company is not able to confirm that the number of business is sufficiently verifiable for the purposes of disclosure in the Registration Statement for the reasons discussed above and has removed this statistic from its website.

*****

 


Securities and Exchange Commission

February 2, 2018

Page 7

 

Please direct any questions regarding the Company’s responses or the revised draft of the Registration Statement to me at (650) 849-3223 or TJeffries@wsgr.com.

 

Sincerely,

WILSON SONSINI GOODRICH & ROSATI

Professional Corporation

/s/ Tony Jeffries
Tony Jeffries

 

cc: Andrew W. Houston, Dropbox, Inc.

Ajay V. Vashee, Dropbox, Inc.

Bart E. Volkmer, Dropbox, Inc.

Mary Anne Becking, Dropbox, Inc.

Cara M. Angelmar, Dropbox, Inc.

Rezwan D. Pavri, Wilson Sonsini Goodrich & Rosati, P.C.

Lisa L. Stimmell, Wilson Sonsini Goodrich & Rosati, P.C.

Kevin P. Kennedy, Simpson Thacher & Bartlett LLP