Privacy policy
This is a translation provided for your convenience. The French version is the reference text and prevails in the event of any discrepancy. This does not affect the mandatory consumer protections available to you under the law of your country of residence.
This policy explains what personal data we collect when you use Kotsu, why we collect it, how long we keep it, and what rights you have over it.
We wrote it to be readable. If anything remains unclear, write to us at contact@kotsu.shop and we will reply.
1. Who is responsible for your data
Anis Rahimi, sole trader (entrepreneur individuel) 173 rue de Courcelles, 75017 Paris, France SIREN 980 419 956 contact@kotsu.shop
We are the data controller within the meaning of the General Data Protection Regulation (GDPR).
One important exception: when a maker uses Kotsu to manage their own commissions, they process their clients' data themselves, on their own behalf. In that relationship, the maker is the data controller and Kotsu acts as processor. Each maker remains responsible for how they use the information their clients entrust to them.
2. The data we collect
2.1 When you create an account
- Email address, username, password (which we never store in plain text)
- Confirmation that you are 16 or over and that you have accepted our terms, with the date and time
2.2 What you choose to add to your profile
Everything below is optional:
- Profile picture, banner, display name, bio, country and city, links to your social media
- Your measurements (head circumference, height, weight, body type and other measurements useful for building a costume)
- Your delivery address
- Your characters ("sonas"): name, species, reference images, description, colour palette, artist credit
Your measurements and your address are never public. They are passed on only to the maker you place a commission with, and only from the moment they accept your request. Your characters are public or private depending on what you decide for each one.
2.3 When you are a maker
- Your workshop name, bio, location, turnaround times, tags, social links
- Your listings: titles, descriptions, photographs, prices, payment terms
- Your terms of service, including their successive versions
- The payment methods you state that you accept
- The reliability indicators we compute from your activity on the service: response time to requests, delivered commissions, activity dates, completeness of your page. They order the directory, under the rules of the ranking transparency page, and the language of your interface is used to match clients who read Kotsu in the same language
- If you subscribe: the information needed for billing. We never see your bank card number; it is handled directly by our payment provider.
2.4 When a commission is placed
- The content of the request: package chosen, options, character involved, measurements provided, answers to the maker's questions, desired budget and deadline, message
- Build tracking: milestones, progress photographs, approvals and rework requests, with their dates
- Payments: amounts, instalments, dates, payment method. Kotsu never collects these sums; the client pays the maker directly. We only record that the payment took place.
- Acceptance of the maker's terms of service, with its version and timestamp
2.5 When you communicate and publish
- The content of your conversations on Kotsu (messages, images, files)
- The reviews you leave after a commission has been delivered, with the rating, the text and the pseudonym shown (or the label "verified client" if you choose to remain anonymous)
- The reports you send us
2.6 Automatically, when you browse
- IP address, date and time of connection, browser and device type
- Pages viewed and actions taken, for security and to keep the service working properly
- Cookies and trackers, as described in our cookie policy
2.7 What the "For you" sort uses
If you have an account and Discover is sorted "For you", the order of listings takes into account data you have already entrusted to us, described above: the species, description and markings of your characters (never their colours or images), the listings you saved, the makers you follow, the type of work, species and budget range of your past requests, the language of your interface and your preferred currency. This computation happens at each display and is not kept; it relies neither on your browsing nor on your clicks; it never applies to a visitor without an account. The balancing measure is the "By merit" sort: identical for everyone, with no personalisation at all, available without an account, and always one click away from "For you". We rely on our legitimate interest for this processing (section 3), which you object to at any time by choosing that sort. The full rules are on the ranking transparency page.
2.8 When you leave your address to hear from us
On the home page and in Discover, you can leave your address so that we write to you when there is something new. No frequency is promised: we write rarely, and sometimes not at all for a long while. We record the address, the language, the date and the exact text you consented to, then send you a confirmation email: nothing is sent before you click, and an unconfirmed address is erased after 30 days. Every email carries an unsubscribe link that acts at once. The same rule applies when you ask, from a workshop's page, to be told when it reopens: the address, the text you read and the date are recorded, a confirmation email goes out before any alert, and every alert carries its removal link.
3. Why we collect it, and on what basis
| What we do | Why | Legal basis |
|---|---|---|
| Creating and managing your account | To give you access to the service | Performance of the contract |
| Displaying your public page and your listings | This is the purpose of the service | Performance of the contract |
| Passing your commission request on to a maker | This is what you ask us to do | Performance of the contract |
| Enabling build tracking and communication | Likewise | Performance of the contract |
| Billing and collecting the subscription | You are a subscriber | Performance of the contract |
| Keeping a record of accepted terms and milestone approvals | To provide evidence in the event of a dispute between a maker and their client | Legitimate interest |
| Sending notifications about your commissions | To keep you informed | Performance of the contract |
| Sending you news of the service and workshop openings | You asked for it, and confirmed it from your inbox | Consent, which can be withdrawn at any time with the link in every email |
| Telling you when a workshop you follow reopens | You asked for it on its page | Consent, which can be withdrawn at any time with the link in every email |
| Preventing fraud, abuse and spam | To protect users and the service | Legitimate interest |
| Handling reports and moderating content | To remove illegal content | Legal obligation (European Regulation on digital services) |
| Retaining identification data for content authors | French law requires it | Legal obligation |
| Issuing and keeping invoices | Accounting and tax | Legal obligation |
| Measuring site traffic in aggregate form | To understand what works | Consent or exemption, see the cookie policy |
| Ordering Discover for you, in the "For you" sort | To show you first what matches what you are looking for, without keeping anything; the merit sort, not personalised and available without an account, stays one click away | Legitimate interest |
| Computing makers' reliability indicators and the directory order | A directory whose order is honest and publicly described | Legitimate interest |
When we rely on our legitimate interest, we have checked that this interest does not disproportionately affect your rights. You can object at any time (see section 7).
4. Who has access to your data
4.1 Other users
- Your public profile: what you have chosen to make public. You set the visibility of your characters, your commissions and the makers you follow in your settings.
- The maker you place a commission with receives your full request: measurements, character, answers to the questions, and your delivery address once the commission is accepted. They can export the record of your commission from their settings, as you can export yours: they need it to build and for their accounting, and that export shows them nothing they do not already see.
- The people you communicate with see your messages.
- Visitors see the reviews you publish, under the pseudonym you have chosen or anonymously.
4.2 Our technical providers
We use a small number of providers, all bound by a contract that prohibits them from using your data for their own purposes:
| Provider | Role | Data location |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | European Union (Frankfurt, Germany) |
| Vercel Inc. | Website hosting | United States |
| Stripe Payments Europe, Ltd | Subscription payments | Ireland (European Union) |
| Resend, Inc. | Sending emails | United States |
4.3 The authorities
We may be required to disclose certain data at the formal request of an authorised judicial or administrative authority.
4.4 What we do not do
We do not sell your data. We do not rent it out. We do not pass it on to any data broker or any advertiser. Kotsu does not display any advertising.
5. Transfers outside the European Union
Our database is hosted in the European Union. Some of our providers, however, are established in the United States (Vercel, Resend). These transfers are governed either by the EU-United States data protection framework or by the standard contractual clauses adopted by the European Commission, supplemented where appropriate by additional security measures.
6. How long we keep it
These periods are applied by the service itself, every night: what the table announces, the code erases when the time comes, without anyone having to ask. The periods live in one place in the code, and the site refuses to publish itself if this page no longer states them.
| Data | Period |
|---|---|
| Account and associated content | For as long as your account exists |
| After you delete your account: what is yours alone (profile, images, characters not tied to a commission in progress, reopening alerts, drafts, saved listings) | Erased immediately; what stays is listed below and explained in 6.1 |
| Identification data of a deleted account (email address, username, creation and deletion dates) (legal obligation) | 5 years after deletion |
| Pseudonym and workshop name of a deleted account | 1 year after deletion |
| IP address in the send counters of public forms | 24 hours |
| Log of emails sent, in-app notifications, contact form acknowledgements | 1 year |
| Request drafts left untouched | 1 year |
| Commission history (request, quote, steps, photos, recorded payments, commission thread), accepted terms, milestone approvals | 5 years after delivery or cancellation, for evidentiary purposes |
| Commission request that went nowhere (declined, cancelled, left unanswered) | 1 year; waitlisted or awaiting information, 2 years |
| IP address and connection logs (authentication) | 1 year |
| Messages exchanged outside a commission | For as long as one of the two accounts exists, and at most 3 years after the last message, unless a commission is in progress between the two people |
| Published reviews | Displayed for as long as the maker's page exists, kept for 5 years after their removal or the closure of the workshop |
| Reports, case files and moderation decisions, sanctions | 5 years |
| Name and address of the author of a report | 6 months after the decision |
| Closure notices sent to the clients of a workshop that closes | 5 years; the client's address, 1 year after sending |
| Console audit log | 5 years |
| Accounting records of the subscription | 10 years |
| Newsletter and reopening alerts, if you consented to them | Until you unsubscribe, and at most 3 years after our last email; an unconfirmed sign-up is erased after 30 days, and so is an unsubscription |
| Archive of your data downloaded from your settings | 24 hours on our servers |
| Requests to exercise your rights received through the form | 5 years |
| Page prepared for an invited artist, never claimed | Until the deadline stated in the invitation; afterwards only a fingerprint of the address, so as not to offer again |
| Profile of a closed workshop | 5 years after closure, once no commission, request or review refers to it any more |
Some of these periods are imposed on us by law and we cannot shorten them, even at your request.
6.1 What is not erased, and why
When you delete your account, or ask us to erase your data, everything that is yours alone disappears at once: your profile and its images, your characters, your saved listings, your drafts, your reopening alerts. Some lines stay, and we would rather tell you which than let you find out:
- Commission records (request, quote, approved steps, progress photos, recorded payments, commission thread) stay 5 years after delivery or cancellation. They prove what was agreed and delivered between a maker and their client, for the other party and for a dispute. Your name stays in them as the other party knew it: without it, the record means nothing.
- Reviews you published stay displayed for as long as the maker's page exists, under the pseudonym you chose. Your address is removed from them when the commission is purged.
- Accounting records of a subscription (confirmations, billing notices, cancellations, withdrawals, annual statements) stay 10 years, with the name and address they carry, like an invoice: that is the law.
- Reports, case files, moderation decisions and sanctions stay 5 years: the European Regulation on digital services requires us to account for a decision, and a contested decision has to be defended. After 6 months, your name and address are removed from a report you sent: the report stays, not its author.
- Closure notices sent to the clients of a workshop that closes stay 5 years, and the client's address is removed from them 1 year after sending.
- The acknowledgement of the contact form stays 1 year, as a fingerprint of your address (not the address) and a date: it is the proof of our commitment to acknowledge, never your message.
- The log of emails we sent you (recipient, subject, date, result) stays 1 year, to know who is right when someone says they received nothing.
- The audit log of our console (every action of our team on an account) stays 5 years: the action, the date, the reason key. The pseudonym or address the action targeted is removed from it after 1 year.
- Identification data of a deleted account (address, username, dates) stays 5 years, because French law requires us to keep what identifies the author of published content. The pseudonym and workshop name are erased after 1 year.
These lines carry a reference and a fact, never a photo, a drawing, a reference sheet or a full profile, and they are erased at the end of their period without anyone having to ask. An erasure request always receives an answer that says what was erased and what stays, with the reason.
7. Your rights
You have the following rights:
- Access: obtaining a copy of the data we hold about you
- Rectification: correcting inaccurate information
- Erasure: requesting the deletion of your data, within the limits of our legal obligations
- Restriction: requesting that processing be frozen while a check is carried out
- Portability: retrieving your data in a machine-readable format
- Objection: objecting to processing based on our legitimate interest, or to marketing outreach
- Withdrawal of consent: at any time, without affecting what was done before
- Post-mortem directives: setting out what happens to your data after your death
How to exercise them: from your settings if you have an account, through the rights request form if you do not, or by writing to us at contact@kotsu.shop. We will reply within one month, which can be extended by two months if the request is complex, in which case we will let you know. We may ask you to prove your identity if we have reasonable doubt.
Many of these rights can be exercised directly from your settings, immediately: changing your information, setting the visibility of your content, downloading your data (a complete archive, readable and structured, ready in seconds), deleting your account. An erasure request, wherever it comes from, receives an answer that says what was erased and what stays, with the reason (section 6.1).
If you consider that we have not handled your request properly, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. If you live in another European Union country, you can contact the supervisory authority of your country.
8. Security
We implement appropriate technical and organisational measures: encrypted communications, passwords stored as hashes, compartmentalised database access, sensitive data restricted to the people it concerns, access logging, regular backups.
No system is perfectly secure. In the event of a data breach likely to create a risk to your rights, we will notify the CNIL within 72 hours and, if the risk is high, we will inform you directly.
9. Minors
Kotsu is restricted to people aged 16 or over. We ask you to confirm your age when you sign up.
If we learn that an account has been created by someone younger, we delete it. If you are a parent or guardian and believe this is the case, write to us at contact@kotsu.shop and we will act quickly.
10. Cookies
We describe our use of cookies and trackers in our cookie policy, where you can also change your choices at any time.
11. Changes to this policy
We may update this policy. If we make a significant change, we will tell you by email or by a notification in the service at least 15 days before it takes effect. The date of the last update appears at the top of this page.
12. Contact us
For any question about your personal data: contact@kotsu.shop