Privacy Policy

Last updated: October 10, 2026

1. Data Controller

The data controller for the personal data processed through the Kops platform (kops.gg) is:

SAPE2SELL
Entrepreneur Individuel — Alexandre VARGAS LOPEZ
984 Chemin de l'Hubac, 06740 Châteauneuf-Grasse, France
SIREN: 923 752 596
Email: [email protected]

2. Data We Collect

2.1 Data You Provide

2.2 Data Collected Automatically

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR) — Processing necessary to provide the Service you subscribed to.
• Legitimate interest (Art. 6(1)(f) GDPR) — Security, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c) GDPR) — Compliance with tax, accounting, and legal requirements.
• Consent (Art. 6(1)(a) GDPR) — Where specifically requested, such as for marketing communications.

4. How We Use Your Data

• Providing and operating the Kops monitoring and purchasing service.
• Signing you in with Google or Discord, when you choose to (section 10).
• Processing subscription payments via Stripe.
• Sending transactional emails (account verification, purchase notifications, security alerts).
• Analyzing usage patterns to improve the Service (using aggregated, anonymized data).
• Preventing fraud, abuse, and unauthorized access.
• Complying with legal obligations.

5. Third-Party Processors

We share personal data only with the following categories of processors, bound by data processing agreements:

For transfers outside the EU/EEA, adequate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as required by GDPR Chapter V.

6. Data Retention

7. Cookies & Tracking

The Service uses the following categories of cookies:

• Strictly necessary cookies — Authentication tokens and session management. These are essential for the Service to function and cannot be disabled.
• Analytics — We use a privacy-friendly, self-hosted analytics solution that does not use cookies and does not track users across websites. No personal data is shared with third-party advertisers.

We do not use advertising cookies, social media trackers, or any cross-site tracking technologies.

8. Your Rights

Under the GDPR and French data protection law (Loi Informatique et Libertés), you have the following rights:

• Right of access — Obtain a copy of your personal data.
• Right to rectification — Correct inaccurate or incomplete data.
• Right to erasure — Request deletion of your data ("right to be forgotten").
• Right to restrict processing — Request limitation of data processing in specific circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to file a complaint with the French data protection authority: CNIL — Commission Nationale de l'Informatique et des Libertés
www.cnil.fr

9. Security

We implement industry-standard security measures to protect your personal data, including:

• Passwords hashed using strong one-way algorithms.
• All data transmitted over HTTPS/TLS encryption.
• Access controls and role-based permissions.
• Regular security monitoring and incident response procedures.

No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].

10. Signing In with Google or Discord

You can create your Kops account, or sign in to it, with your Google or Discord account instead of a password. This is optional: a password or a passkey works just as well. This section describes what Kops receives from Google and Discord when you do, and what we do with it.

10.1 Google

When you choose "Continue with Google", Google asks for your permission to share your basic profile with Kops: the openid, email and profile permissions, and nothing else. Kops never asks for access to your Gmail, Google Drive, contacts, calendar or any other Google service.

To complete a sign-in, Google also gives us a one-time code and short-lived tokens. We use them only to confirm your identity at that moment and do not store them. Kops keeps no Google access or refresh token, so it cannot read anything from your Google account or act on it after you sign in.

10.2 Discord

When you choose "Continue with Discord", or connect Discord in your settings, Discord asks for your permission to share your account details and email address with Kops, and to let Kops add you to the Kops Discord server: the identify, email and guilds.join permissions. Kops never reads your messages, your friends list or the servers you belong to.

10.3 Storage, Sharing and Deletion

• Storage — This data is stored with your account in our database and protected by the measures described in section 9.
• No selling, no advertising — We do not sell this data, use it for advertising or use it to train artificial intelligence models, and we do not share it with third parties. Only the service providers that run Kops on our behalf, such as our hosting and email delivery providers, process it for us.
• Retention and deletion — We keep it while the sign-in method stays connected. Disconnecting Google or Discord under Settings → Sign-in methods deletes it at once, provided you keep another way to sign in. Otherwise it is deleted with your account, like the rest of your account data (section 6).
• Revoking access — You can also remove Kops from your Google account at myaccount.google.com/connections, and from Discord under User Settings → Authorized Apps.

Kops's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Third-Party Applications and AI Assistants

You may connect a third-party application — an AI assistant such as Claude or ChatGPT, or software you or your organization writes — to one of your workspaces. Nothing is connected unless you approve it on a screen that names the application, the workspace it will act in, and every permission it is asking for. We are the data controller for the data such an application reads from Kops; the operator of the application is the controller for whatever it does with that data afterwards, which is outside our control and governed by their own policy.

A connected application acts as you, in one workspace, and can never do more than your own role allows. It never receives your password, and it cannot spend money: purchase and payment endpoints are excluded from what a connected application can reach, by construction rather than by configuration. The complete set of permissions you may be asked to approve is:

• See the Vinted accounts connected to your workspace — each one's username and Vinted id, whether it is still working, its email address, the delivery address saved on it, and the brand and last four digits of its payment cards
• See every purchase your workspace attempted, including which ones failed and at which step
• Read the conversations your buying accounts are having with sellers, and see how many are unread
• Get the codes and barcodes that collect your parcels — whoever holds one can pick a parcel up at the counter
• See the pre-orders waiting in your workspace's queue and how they turned out
• See the items your workspace has bought and where each parcel currently is
• See what your account is allowed to do in this workspace
• Create saved filters and folders, and add sellers to the list you refuse to buy from
• Delete your saved filters and folders, and take sellers off the list you refuse to buy from
• Change your saved filters and folders, including turning a filter on or off
• See your saved filters, your filter folders, the sellers you have blocked, and try a draft filter against recent listings
• See this workspace's name and who owns it
• See which workspaces your account belongs to

You can see every application you have connected, and withdraw any of them, under Settings → Connections. Withdrawal is immediate: every credential that application holds stops working at that moment, and it is the same mechanism as the right to object described in section 8. We keep a record of which application was granted what and when, as part of the security logs described in section 6.

Text that reaches an assistant through Kops — listing titles, seller names, conversation messages — is written by third parties on a marketplace. We pass it on as data to report on and never as instructions to follow. See the connector documentation for the full tool list.

12. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 30 days before taking effect. The "Last updated" date at the top will reflect the latest revision.

14. Contact

For any questions or requests regarding this Privacy Policy or your personal data, contact us at:

SAPE2SELL — Alexandre VARGAS LOPEZ
984 Chemin de l'Hubac, 06740 Châteauneuf-Grasse, France
Email: [email protected]