Privacy Policy
Last updated: February 20, 2026
1. Data Controller
The data controller for the personal data processed through the Kops platform (getkops.com) is:
SAPE2SELL
Entrepreneur Individuel — Alexandre VARGAS LOPEZ
984 Chemin de l'Hubac, 06740 Châteauneuf-Grasse, France
SIREN: 923 752 596
Email: [email protected]
2. Data We Collect
2.1 Data You Provide
| Data | Purpose |
|---|---|
| Email address | Account creation, authentication, notifications |
| Password (hashed) | Account security |
| Marketplace credentials | Connecting your marketplace accounts for monitoring and automated purchasing |
| Filter configurations | Providing the monitoring and autocop service |
| Payment information | Processed by Stripe — we do not store full card details |
2.2 Data Collected Automatically
| Data | Purpose |
|---|---|
| IP address | Security, abuse prevention, rate limiting |
| Browser / device information | Service optimization, debugging |
| Usage analytics | Improving the Service — collected via privacy-friendly analytics (no cookies, no cross-site tracking) |
| Authentication tokens | Session management (stored as secure cookies) |
3. Legal Basis for Processing
Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:
- Performance of a contract (Art. 6(1)(b) GDPR) — Processing necessary to provide the Service you subscribed to.
- Legitimate interest (Art. 6(1)(f) GDPR) — Security, fraud prevention, and service improvement.
- Legal obligation (Art. 6(1)(c) GDPR) — Compliance with tax, accounting, and legal requirements.
- Consent (Art. 6(1)(a) GDPR) — Where specifically requested, such as for marketing communications.
4. How We Use Your Data
- Providing and operating the Kops monitoring and purchasing service.
- Processing subscription payments via Stripe.
- Sending transactional emails (account verification, purchase notifications, security alerts).
- Analyzing usage patterns to improve the Service (using aggregated, anonymized data).
- Preventing fraud, abuse, and unauthorized access.
- Complying with legal obligations.
5. Third-Party Processors
We share personal data only with the following categories of processors, bound by data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Web hosting and content delivery | United States (EU SCCs) |
| Hetzner Online GmbH | API hosting and data storage | European Union (Germany) |
| Stripe Inc. | Payment processing | United States (EU SCCs) |
| Cloudflare Inc. | Bot detection and abuse prevention (Turnstile) | United States (EU SCCs) |
| Self-hosted analytics | Privacy-friendly usage analytics | European Union |
For transfers outside the EU/EEA, adequate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as required by GDPR Chapter V.
6. Data Retention
| Data | Retention Period |
|---|---|
| Account data | Duration of the account + 30 days after deletion |
| Payment records | 10 years (French tax obligation) |
| Usage analytics | 13 months (aggregated) |
| Server logs / IP | 12 months |
| Purchase history | Duration of the account + 30 days |
7. Cookies & Tracking
The Service uses the following categories of cookies:
- Strictly necessary cookies — Authentication tokens and session management. These are essential for the Service to function and cannot be disabled.
- Analytics — We use a privacy-friendly, self-hosted analytics solution that does not use cookies and does not track users across websites. No personal data is shared with third-party advertisers.
We do not use advertising cookies, social media trackers, or any cross-site tracking technologies.
8. Your Rights
Under the GDPR and French data protection law (Loi Informatique et Libertés), you have the following rights:
- Right of access — Obtain a copy of your personal data.
- Right to rectification — Correct inaccurate or incomplete data.
- Right to erasure — Request deletion of your data ("right to be forgotten").
- Right to restrict processing — Request limitation of data processing in specific circumstances.
- Right to data portability — Receive your data in a structured, machine-readable format.
- Right to object — Object to processing based on legitimate interests.
- Right to withdraw consent — Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to file a complaint with the French data protection authority: CNIL — Commission Nationale de l'Informatique et des Libertés
www.cnil.fr
9. Security
We implement industry-standard security measures to protect your personal data, including:
- Passwords hashed using strong one-way algorithms.
- All data transmitted over HTTPS/TLS encryption.
- Access controls and role-based permissions.
- Regular security monitoring and incident response procedures.
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].
10. Children's Privacy
The Service is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 30 days before taking effect. The "Last updated" date at the top will reflect the latest revision.
12. Contact
For any questions or requests regarding this Privacy Policy or your personal data, contact us at:
SAPE2SELL — Alexandre VARGAS LOPEZ
984 Chemin de l'Hubac, 06740 Châteauneuf-Grasse, France
Email: [email protected]