Legal

Privacy Policy

Last updated: March 30, 2026

Your privacy matters

This Privacy Policy explains what information Kudosey collects, how we use it, and your rights regarding your data. By using Kudosey, you agree to the practices described here. If you have questions, contact us at privacy@kudosey.com.

1

Who We Are

Kudosey ("we," "us," or "our") is an online marketplace for virtual world content, operated from Texas, United States. For the purposes of applicable data protection law — including the EU General Data Protection Regulation (GDPR) — Kudosey is the data controller responsible for your personal information collected through the Platform.

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at privacy@kudosey.com.

2

Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information received from third parties.

2.1 Information You Provide

Account informationWhen you register, we collect your email address, username, and password. If you sign in via Discord or Google, we receive your name, email address, and profile picture from those services.
Profile informationAny information you choose to add to your public profile, including a display name, bio, avatar image, and links to external profiles.
Date of birthRequired to verify age eligibility and to gate access to NSFW content. Your date of birth is stored permanently and may only be changed by contacting support. We do not use your date of birth for any purpose other than age verification and NSFW access gating.
Payment informationFor buyers, payment details are collected and processed directly by Stripe — we do not store your full card number or banking details. For sellers, we collect the account ownership information required by Stripe Connect, including your name and mailing address, to comply with financial regulations.
CommunicationsMessages you send to other users through the Kudosey messaging system are stored on our servers. Support emails and any other communications you send to us are also retained.
Listings and reviewsContent you submit as a seller (listings, descriptions, preview images) and content you submit as a buyer (reviews, ratings, comments) is stored and may be publicly visible.
Identity verification dataIf you are required to complete identity verification (for sellers earning above certain thresholds), verification is conducted by our third-party partners. We do not store the underlying documents — see Section 5 for details.

2.2 Information Collected Automatically

Log dataWhen you access the Platform, our servers automatically record your IP address, browser type, operating system, referring URLs, pages visited, and timestamps. Log data is retained for up to 90 days for security and debugging purposes.
Device informationGeneral information about the device you use to access the Platform, including device type and screen resolution.
Cookies and similar technologiesWe use essential cookies required for the Platform to function (such as session authentication). We may also use analytics or preference cookies. See Section 6 for details.

2.3 Information from Third Parties

When you connect a third-party account (Discord or Google), we receive basic profile information from that service as permitted by your settings with them. We also receive transaction and fraud-related information from Stripe in connection with payments processed on the Platform.

3

How We Use Your Information

We use the information we collect for the following purposes:

To operate the PlatformCreating and managing your account, processing purchases, facilitating seller payouts, and delivering content.
To verify identity and ageConfirming you meet the minimum age requirement, and verifying your age before enabling access to NSFW content or processing seller payouts above regulatory thresholds.
To process paymentsSharing necessary data with Stripe to process transactions, handle chargebacks and refunds, and comply with financial regulations as merchant of record.
To communicate with youSending transactional emails (order confirmations, payout notifications, dispute updates) via Resend. We may also send platform announcements and policy updates. You can manage email preferences in your account settings.
To operate the Kudos rewards programTracking points earned from purchases, processing redemptions in the Kudos shop, and applying coupon credits to eligible orders.
To detect and prevent fraud and abuseUsing automated systems to flag prohibited content, malicious uploads, and policy violations for human review. See Section 3.1 for details.
To enforce our TermsReviewing flagged listings, messages, and accounts in connection with reported violations and platform policy.
To improve the PlatformUnderstanding how users interact with the Platform to improve features, fix bugs, and optimize performance.
To comply with the lawMeeting our legal obligations, including tax reporting (e.g., 1099-K for US sellers), responding to lawful requests from authorities, and fulfilling GDPR or other data protection obligations.

3.1 Automated Content Scanning

We may use automated systems to scan listings, uploaded files, messages, and other content submitted to the Platform for prohibited content, malicious code, intellectual property violations, and policy violations. Flagged content may be temporarily restricted pending human review. Automated detection is not perfect and may produce false positives or negatives — we are not liable for errors in automated content detection. Final decisions on content compliance rest with Kudosey. If you believe your content has been incorrectly flagged, contact support@kudosey.com.

3.2 Law Enforcement Disclosure

We may disclose your personal information to law enforcement agencies, government authorities, or courts when required by applicable law, in response to a valid legal request, to enforce our Terms of Service, or to protect the rights, property, or safety of Kudosey, our users, or others. Where permitted by law, we will attempt to notify you of such a request before disclosing your data.

3.3 Seller Access to Buyer Data

If you are a seller, you may receive certain buyer information — such as username and order details — solely for the purpose of fulfilling purchases. You agree to process that information only for completing the transaction and to comply with all applicable data protection laws, including GDPR where applicable. You may not use buyer information for marketing, contact buyers outside of the Kudosey platform, or share their data with third parties.

3.4 Data Breach Notification

If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant regulatory authorities as required by applicable law. We will take prompt action to contain any breach and will provide information about the nature of the breach and the steps we are taking in response.

4

Legal Bases for Processing (GDPR)

If you are located in the EU or UK, we are required to identify the legal basis under which we process your personal data. We rely on the following:

Contract performanceProcessing necessary to fulfill our agreement with you — including operating your account, processing purchases, and paying out sellers.
Legal obligationProcessing required to comply with applicable law, including tax reporting, anti-money laundering obligations, and responding to lawful authority requests.
Legitimate interestsProcessing for our legitimate business interests where these are not overridden by your rights — including fraud prevention, platform security, and improving the Platform.
ConsentWhere we rely on consent (for example, for optional analytics cookies or marketing emails), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
5

Third-Party Services

Kudosey uses the following third-party services that may process your personal data. Each is subject to its own privacy policy.

Payment processing, seller identity verification (Stripe Connect), tax collection and remittance
Alternative payout method for sellers (EU)
Database and backend infrastructure — stores account data, messages, listings, and reviews
Transactional email delivery — order confirmations, payout notifications, support replies
Platform hosting and edge delivery
CDN, DDoS protection, and asset delivery
Optional OAuth login — we receive your Discord username, email, and avatar
Optional OAuth login (if enabled) — we receive your name, email, and profile picture

We do not sell your personal data to any third party. We do not share your data with third parties for their own marketing purposes. Each third-party service listed above is subject to its own privacy policy. Where required by applicable data protection law, we have executed data processing agreements (DPAs) with these services to ensure your data is handled in accordance with GDPR and other applicable regulations.

6

Cookies

Kudosey uses cookies and similar technologies to operate the Platform. Cookies are small text files stored on your device.

Essential cookiesRequired for the Platform to function — including session authentication and security tokens. These cannot be disabled.
Preference cookiesUsed to remember your settings, such as your NSFW toggle preference and theme selection.
Analytics cookiesIf we implement analytics tools in the future, we will update this section and, where required by law, obtain your consent before setting these cookies.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from using the Platform.

7

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Platform. Specific retention periods are as follows:

Account dataWhen your account is terminated or closed, it is deactivated rather than deleted. Core account records — including your email address, transaction history, and account activity — are retained for legal, tax, financial, and fraud prevention purposes for a minimum of 7 years.
Transaction and financial dataRetained for a minimum of 7 years as required by US tax law and financial regulations.
MessagesStored to support dispute resolution. You may request deletion of message threads by contacting support@kudosey.com, subject to any ongoing disputes or legal holds. We may implement automatic retention limits in the future and will update this policy accordingly.
Public contentReviews, comments, and public profile information remain visible after account closure unless you request removal prior to closing your account.
Purchased content accessBuyers retain access to content they have validly purchased even after a seller's account is terminated. Kudosey retains the right to continue hosting purchased content to fulfill its obligations to buyers.
Logs and IP dataServer logs are retained for up to 90 days for security and debugging purposes.
8

Kudos Rewards Program

Kudosey operates a points-based rewards program ("Kudos"). Both buyers and sellers earn points on eligible transactions based on the listing price — buyers earn 2 points per $10.00 spent and sellers earn 1 point per $10.00 earned. Points are tracked against your account and can be spent in the Point Shop on cosmetic profile items (available to all users) or, for buyers only, converted into Kudos and redeemed as a $5.00 coupon toward a future purchase on a participating seller's listing.

The following terms apply to Kudos points:

No cash valueKudos points have no monetary value and cannot be exchanged for cash, transferred to a bank account, or used outside of the Kudos shop and coupon system.
Non-transferablePoints are tied to your account and may not be gifted, sold, or transferred to another user under any circumstances.
No expiryKudos points do not expire while your account is active.
Forfeiture on closureAny unredeemed Kudos points are permanently forfeited when your account is closed or terminated. No compensation will be provided for forfeited points.
Program changesKudosey reserves the right to modify, suspend, or discontinue the Kudos program at any time, including changing earn rates, redemption values, or available rewards. We will provide reasonable notice of material changes. See the Kudos Program Terms for full details.
Fraud and abusePoints earned through fraudulent transactions, chargebacks, or abuse of the program may be reversed or forfeited. Accounts found to be abusing the program may be suspended.

Kudos points do not constitute property and you have no vested ownership interest in your points balance. Points are a conditional license to access platform rewards and may be modified or revoked in accordance with these terms. Full program rules, conversion rates, and limits are described in the Kudos Program Terms.

9

Your Rights

Depending on where you are located, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@kudosey.com. We will respond within 30 days.

AccessRequest a copy of the personal data we hold about you.
CorrectionRequest that we correct inaccurate or incomplete data. Note that your date of birth can only be corrected by contacting support with proof.
DeletionRequest deletion of your personal data. Note that we are required to retain certain data for legal and financial compliance and cannot delete it on request — for example, transaction and financial records are retained for a minimum of 7 years and account records are retained indefinitely for fraud prevention. See Section 7 for full retention periods.
PortabilityRequest a machine-readable export of your personal data (EU/UK users).
RestrictionRequest that we restrict processing of your data in certain circumstances (EU/UK users).
ObjectionObject to processing based on legitimate interests (EU/UK users).
Withdraw consentWhere we rely on consent as a legal basis, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

9.1 EU/UK Users — Right to Complain

If you are located in the EU or UK and believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In the EU, this is the data protection authority in your member state.

9.2 California Users (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, the right to delete your personal information (subject to legal retention requirements), and the right not to be discriminated against for exercising your privacy rights. Kudosey does not sell personal information as defined under the CCPA. To submit a request, contact privacy@kudosey.com.

10

Children's Privacy

Kudosey permits users aged 13 and older to register, in compliance with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will immediately terminate their account and delete their data.

Users aged 13–17 must have parental or guardian consent to use the Platform. Parents or guardians who believe their child has registered without consent may contact us at privacy@kudosey.com to request account removal.

NSFW content is strictly inaccessible to users under 18. Age is verified via the date of birth provided during account setup.

11

International Data Transfers

Kudosey is operated from the United States. If you are accessing the Platform from the EU, UK, or another jurisdiction with data protection laws that differ from US law, your data will be transferred to and processed in the United States.

Where we transfer personal data from the EU or UK to the US, we rely on appropriate safeguards — including Standard Contractual Clauses (SCCs) where applicable — to ensure your data is protected to a standard equivalent to that required under EU/UK law. Our third-party processors (listed in Section 5) are selected in part for their compliance with applicable international transfer requirements.

12

Data Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. These include encrypted data storage via Supabase, TLS encryption for data in transit, access controls limiting who within Kudosey can access personal data, and Cloudflare's infrastructure for DDoS protection and secure delivery.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security vulnerability or breach, please notify us immediately at privacy@kudosey.com.

13

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and in-platform announcements at least 7 days before taking effect. The version in effect at the time you use the Platform governs the processing of your data at that time.

Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree, you must stop using the Platform before the changes take effect.

This Privacy Policy is part of your agreement with Kudosey, alongside our Terms of Service, Refund Policy, and Seller Terms & Fees. For privacy-related questions, contact privacy@kudosey.com.