Privacy Policy.

What data we process

• Account data. On sign-up: your email address and a cryptographic hash of your password (we never store your password itself), plus whether your email address is confirmed.
• Saved listings. Listings you save, including the stored title, price and photo.
• Your own listings. Everything you post yourself: title, description, photos, price, location and the email address buyers can reach you at.
• API usage. Names of your API keys and usage counters for rate limits. The keys themselves are stored only as hashes.
• Search queries. What is requested via search, answer and agent, to operate and improve the service.
• Searching via AI assistants. If you use koopje.ai through a connected AI assistant (such as ChatGPT), we process your search query and your API key usage the same way as direct searches. Only the search query itself is shared with the assistant — never your password or key in readable form.
• Server logs. IP address and browser data in access logs, for security and aggregate statistics.
• Contact messages. Messages you send to a seller via the contact form are forwarded by email.
• Cookies and local storage. Functional only: session, login state and interface preferences. No tracking or advertising cookies.

We process no payment data: koopje.ai is free.

Why (purposes and legal bases)

• Providing the service and managing your account (performance of a contract).
• Countering abuse, spam and attacks (legitimate interest).
• Measuring and improving search quality (legitimate interest).
• Complying with legal obligations where they apply.

Sharing with others

We never sell your data. For operations we use processors: hosting (Oracle Cloud, EU), transactional email (Brevo), search embeddings (OpenAI) and the AI assistant (Groq). In doing so your search queries leave our servers; passwords and API keys never leave in readable form.

Listings you publicly post yourself are — as the name says — public: title, photos, price and location are visible to everyone. We share your contact email address only with buyers to whom you reply via the contact form.

Retention periods

• Account data: until you delete your account.
• Your own listings: active for at most 30 days, then automatically hidden; deleted listings are erased, including photos.
• Server logs: limited in time, then aggregated or deleted.
• Sessions expire automatically.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. Email info@koopje.ai — we respond within one month. If you disagree with our response, you can complain to the Data Protection Authority (GBA), Drukpersstraat 35, 1000 Brussels.

Security

Passwords and API keys are stored exclusively as hashes, traffic runs over encrypted connections (TLS) and access to production data is limited to the minimum.

Changes

For material changes we announce them on the site before they take effect. Older versions are available on request.