Privacy Policy

1. Data controller

JAVI MANZANO L.L.C-FZ, a company incorporated in the United Arab Emirates, with registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Contact email: javi@kolpu.com.

Website: https://kolpusites.com. This policy covers the account, the template and background library, paid plans, GitHub repository access, the contact form, and the newsletter.

2. Data protection officer

We have not appointed a data protection officer or a representative in the European Union. The controller is in the United Arab Emirates. For privacy, write to javi@kolpu.com. If you are in the EU, the GDPR applies because the service is offered to people in the Union.

3. Data we process

We may process the following categories of data:

• Identity and contact data: email address, profile name or display name if provided, avatar (including from Google when you use Google sign-in).
• Authentication data: password (stored encrypted by our auth provider; we never store it in plain text), session identifiers, email confirmation status.
• Usage data: templates viewed, searches, filters, likes, prompt copies (with the plan in force for that copy), video plays, preferred language, and the first-party session identifier.
• Technical data: IP address, browser user agent, referrer and UTM parameters when available, collected for internal analytics.
• Communication preferences: on signup the box «Yes, tell me about new templates and offers» starts unticked. If you tick it, we record that you want the newsletter. If you leave it that way, we do not subscribe you. The notice on a template is another way to subscribe, only if you press «Yes, let me know».
• Payment data: plan, amount, currency, payment status, refunds, promo code, buyer email, and Whop membership id. Whop handles the card number; we do not store it.
• GitHub: if you connect an account, the username and numeric id, and organisation membership while the paid plan is active.
• Contact form: name, email, and message. The notice goes to hello@kolpu.com and is stored as a ticket.

4. Purposes and legal bases

We process your data only where a legal basis applies:

• Creating and managing your account, authenticated access, and support: contract performance or pre-contractual steps (Art. 6(1)(b) GDPR).
• Email confirmation, password recovery, and session security: contract performance and legitimate interest in protecting the service (Art. 6(1)(b) and (f)).
• Usage measurement (visits, searches, filters, copies, plays and, when you are signed in, the link to the account) with the kolpu_sid cookie and, if we enable it, Microsoft Clarity: only if you accept measurement in the cookie notice. Basis: consent (Art. 6(1)(a) GDPR and the ePrivacy rule on storing information on your device). There is no advertising and no ad profiling.
• Newsletter with news and promotions. The signup box starts unticked: if you tick it, we subscribe you. If you do not, we do not. A notice on a template page may ask as well: it subscribes nobody until you press «Yes, let me know». You can unsubscribe in each email or by writing to javi@kolpu.com. Google on the signup screen follows that same box. Google from the login screen does not subscribe you, because that screen has no box.
• Charging for the plan, paid access, and keeping the purchase record: contract performance and accounting duties (Art. 6(1)(b) and (c)).
• Inviting your GitHub user to the plan repositories and removing them when the plan ends: contract performance (Art. 6(1)(b)).
• Replying to the contact form: pre-contractual steps or legitimate interest in answering the message (Art. 6(1)(b) and (f)).
• Hosting security logs used to detect abuse, not as product analytics: legitimate interest (Art. 6(1)(f)).
• Legal compliance and handling claims: legal obligation or legitimate interest (Art. 6(1)(c) and (f)).

5. Recipients and processors

We share data only with providers that deliver necessary services, under data processing agreements where required:

• Supabase (authentication and database) — US/EU, with contractual safeguards.
• Cloudflare (hosting, CDN, and serverless functions) — may process technical data internationally.
• Resend (transactional email and newsletter contact management) — US, with standard contractual clauses.
• Google (Google OAuth sign-in) — only if you choose that method; Google is an independent controller of its service.
• Whop (plan checkout) — controller of the card payment. We receive the purchase record, not the card number.
• GitHub (username, id, and organisation invitation) — only if you connect GitHub. GitHub is the controller of your account on its service.
• Microsoft (Clarity) — only if you accept the notice. It is used to see how the site is used, not for advertising.

We do not sell your personal data or share it with third parties for unrelated commercial purposes.

6. International transfers

Supabase, Cloudflare, Resend, Google, Whop, GitHub and, if you accept Clarity, Microsoft may process data outside the European Economic Area. We rely on GDPR safeguards (standard contractual clauses, adequacy decisions, or other recognised measures). You can ask for more detail at javi@kolpu.com.

7. Retention periods

• Account data: while your account is active and, after closure, as long as needed for legal claims (typically up to 5 years).
• Internal analytics, including IP address and session id: up to 24 months, unless a duty or a claim requires longer.
• Purchases: as long as accounting and tax rules require, and while needed to prove the plan.
• Newsletter: until you unsubscribe.
• GitHub: username and id while the account exists. Organisation access while the paid plan is active; when it ends, we remove the member.
• Contact tickets: 7 days if we do not touch them. If we mark one as waiting, until we solve or delete it.
• Security logs: as long as needed to detect abuse.

8. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction, portability, and withdrawal of consent (where processing is consent-based) by emailing

javi@kolpu.com.

You may also complain to the data protection authority in your country. If you live in Spain, that is the Spanish Data Protection Agency (www.aepd.es).

9. Minors

The service is not directed at children under 14. If you are under 14, do not register. If we detect accounts of minors without valid parental consent, we may delete them.

10. Security

We apply appropriate technical and organisational measures (encryption in transit, access control, database security policies, hosting with recognised certifications). No system is 100% secure; report abuse to

javi@kolpu.com.

11. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.

12. Changes to this policy

Last updated: 6 November 2026. We may update this policy to reflect legal or service changes. The current version will always be published at this URL.