koppop Privacy Policy
This Privacy Policy explains how koppop (the "Application", "we", "us") collects, uses, stores, shares, retains and deletes information when you use its Google-related features. koppop is an internal email operations platform for the koppop.com team. The application entry point is https://crm.koppop.com, and this policy is published at https://koppop.com/privacy.html. The Application is available only to authorized koppop.com personnel and is not offered to the general public.
Google user data at a glance
Google scopes requested: openid, email, and https://www.googleapis.com/auth/postmaster.traffic.readonly (read-only access).
Google data accessed: the domains registered in your Gmail Postmaster Tools account and the aggregate traffic and reputation metrics for those domains — delivery rate, spam rate, bounce rate, feedback-loop data, domain reputation and reporting dates. We do not access email bodies, subjects, headers, attachments, recipients, contacts, Drive, Calendar or any other Google service.
Why we access it: only to display these metrics and domain reputation in the koppop dashboard. The integration is read-only: it does not send, modify or delete anything in your Google account.
Limited Use: we do not sell Google user data, use it for advertising, credit assessment, AI/ML training or AI NCII, and we do not let humans read it except for security, legal compliance, or with your affirmative agreement. Section 7 contains the full Google API Services User Data Policy statement.
Retention and deletion: OAuth tokens are deleted when you disconnect. Metrics are kept for trend comparison until you request deletion. To delete your data, revoke koppop's access in your Google Account and email easonbiz008@gmail.com with the subject "Data deletion request"; active systems are cleared within 30 days.
Summary
- What we collect from Google: your Google account email address, OAuth access and refresh tokens, the list of Postmaster Tools domains you authorize, and aggregate Postmaster traffic and reputation metrics for those domains. We do not read email content, contacts or attachments.
- Why we use it: to display domain traffic and reputation metrics and operate the internal email management features you request. We do not use it for advertising, profiling, credit assessment, sale or AI training.
- Who we share it with: no one for marketing or resale. Only our cloud hosting provider as necessary to run the service, or where required by law.
- How we protect it: OAuth tokens are encrypted at rest with AES-256-GCM; data in transit uses HTTPS/TLS; access is limited to authorized personnel.
- How long we keep it: tokens are deleted when you disconnect or revoke access; metrics and business data are kept for trend comparison until you request deletion.
- How to delete your data: revoke access in your Google Account and email easonbiz008@gmail.com with the subject "Data deletion request". Active systems are cleared within 30 days.
- AI NCII: koppop does not create or facilitate AI-generated non-consensual intimate imagery and does not use Google data for any AI purpose.
- Contact: easonbiz008@gmail.com.
1. Who we are and scope of this policy
The Application is operated by the koppop.com team. The application name shown on the Google OAuth consent screen is koppop. Contact for all privacy matters: easonbiz008@gmail.com.
This policy applies to information processed by koppop, including information received from Google APIs. It does not apply to third-party websites or services that koppop does not control.
2. Information we collect
| Category | What it includes | Source |
|---|---|---|
| Google account identifier | The email address of the Google account you use to authorize koppop. It is used only to identify the connected account in the administration interface. | Google OAuth 2.0 (openid, email) |
| OAuth credentials | Access tokens and refresh tokens issued by Google after you grant consent. Refresh tokens let koppop retrieve updated Postmaster statistics without asking you to sign in again. | Google OAuth 2.0 |
| Gmail Postmaster Tools data | The list of domains registered in your Postmaster Tools account that you authorize koppop to access, and aggregate traffic and reputation metrics for those domains, such as delivery rate, spam rate, bounce rate, feedback-loop data, domain reputation and the relevant reporting dates. These metrics are aggregated and do not include individual recipient addresses or email content. | Gmail Postmaster Tools API (read-only) |
| Platform business data | Sender account configuration, email campaigns, sending queues, delivery results and bounce records created through your use of koppop. This data is separate from your Google account data. | Your use of koppop |
Information we do NOT collect from Google
- We do not read email bodies, subjects, headers, attachments, recipients or any other content of a Gmail mailbox.
- We do not access Gmail, Google Contacts, Google Calendar, Google Drive or any other Google service.
- We do not send, modify or delete email or any other data through Google APIs.
- We do not collect your name, profile photo or other Google profile information beyond the account email address.
3. How we collect information
Google-related information is obtained only through the Google OAuth 2.0 consent flow. koppop receives access only after you explicitly approve the requested scopes. We request exactly three scopes: openid, email, and https://www.googleapis.com/auth/postmaster.traffic.readonly. The Postmaster scope is read-only. We do not access Google data without your authorization.
4. How we use information
- Display domain traffic, reputation trends and sending performance in the koppop administration interface, to support internal email operations decisions.
- Aggregate and retain historical statistics by date for trend comparison and troubleshooting.
- Identify the connected Google account so that authorized staff can manage or disconnect it.
- Maintain the security, integrity and proper operation of the Application.
We do not use Google user data for advertising, retargeting, interest-based or personalized advertising, user profiling, credit assessment, or sale or rental to third parties. We do not use Google user data to train, develop or provide artificial intelligence or machine-learning models, and we do not use it for any AI-generated non-consensual intimate imagery (AI NCII).
5. Legal basis and consent
We process Google user data on the basis of your explicit consent given through the Google OAuth consent screen, and as necessary to provide the internal features you request. You may withdraw consent at any time as described in Section 11.
6. How we share information
- We do not sell, rent, trade or transfer Google user data to third parties.
- We do not share Google user data with advertising platforms, data brokers or information resellers.
- We may share data with the cloud infrastructure provider that hosts the Application, solely to operate the service, under confidentiality and data-protection obligations and only on our instructions.
- We may disclose data if required by applicable law or a lawful request from a competent authority, or if necessary to protect the rights, safety and security of the Application, our users or the public.
- We do not transfer Google user data to any other application except as necessary to provide the features described in this policy and in compliance with the Google API Services User Data Policy.
7. Google API Services User Data Policy and Limited Use
koppop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, with respect to Google user data:
- We do not use Google user data for serving ads, including retargeting, personalized or interest-based advertising.
- We do not sell Google user data to third parties.
- We do not use Google user data to determine credit-worthiness or for lending purposes.
- We do not use Google user data to train, develop or improve artificial intelligence or machine-learning models, and we do not use it for AI NCII.
- We do not allow humans to read Google user data unless: (a) you have given affirmative agreement for specific messages; (b) it is necessary for security purposes, such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized.
- We use Google user data only to provide or improve user-facing features that are prominent in the Application's interface.
8. Storage and security
- Data is stored in the Application's own databases on servers located in the People's Republic of China.
- Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. Encryption keys are managed separately from the encrypted data.
- Data in transit is protected by HTTPS/TLS.
- Access is restricted to authorized internal personnel who need it to operate and maintain the Application. We apply access controls and operational safeguards appropriate to the sensitivity of the data.
- No system can be guaranteed to be completely secure. If a data security incident occurs, we will handle it and notify affected parties as required by applicable law.
9. Data retention
- OAuth tokens: retained while the connection remains active. When you disconnect koppop in the Application or revoke access in your Google Account, we stop using the tokens and delete them from the active system.
- Postmaster traffic statistics: retained to support historical trend comparison, until you request deletion or the feature is discontinued.
- Platform business data: retained according to internal business and compliance requirements, and deleted upon a valid deletion request as described below.
- Backups: residual copies may remain in backup storage for a limited period under the backup rotation cycle, normally no longer than 90 days, after which they are overwritten or deleted.
10. Deletion of your data
You can request deletion of the data koppop holds about you or your Google account at any time:
- Revoke koppop's access in your Google Account under Security → Third-party apps and services → koppop → Remove access. This immediately prevents further access to Google data.
- Send an email to easonbiz008@gmail.com with the subject "Data deletion request" and the Google account email address you used. We may ask you to verify control of that address.
After verification, we will delete the associated OAuth tokens and the Google-related data we hold, and will confirm completion by email. Active systems are normally cleared within 30 days; residual backup copies are removed within the backup cycle described in Section 9. We may retain the minimum information required by applicable law, in which case we will explain the retention obligation.
11. Your rights
- Withdraw consent: revoke access at any time through your Google Account or by contacting us.
- Access and portability: request confirmation of whether we process data about you and request a copy.
- Correction: request correction of inaccurate data.
- Deletion: request deletion as described in Section 10.
- Objection or restriction: object to or request restriction of certain processing.
- Complaint: contact us with any concern; you may also complain to a competent data-protection authority.
12. International transfers
The Application's servers are located in the People's Republic of China. If you access the Application from another country or region, your information will be transferred to and processed in China. We take measures required by applicable law for such transfers.
13. Children's privacy
The Application is an internal business tool and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.
14. Changes to this policy
We may update this policy to reflect changes in the Application, legal requirements or Google policies. The updated policy will be published on this page with a new effective date. Material changes will be communicated through appropriate channels within the Application where practicable. Continued use after an update means you accept the updated policy.
15. Contact us
For any question, request or complaint about this policy or our data processing, contact: easonbiz008@gmail.com. We will respond within a reasonable period.
koppop 隐私政策
本隐私政策说明 koppop（以下简称「本应用」或「我们」）在您使用其 Google 相关功能时，如何收集、使用、存储、共享、保留和删除信息。koppop 是 koppop.com 团队内部使用的邮件发送与域名信誉管理平台，入口为 https://crm.koppop.com，本政策发布在 https://koppop.com/privacy.html。本应用仅向 koppop.com 经授权的内部人员开放，不向公众提供服务。
摘要
- 从 Google 收集什么：您的 Google 账号邮箱地址、OAuth 访问令牌和刷新令牌、您授权访问的 Postmaster Tools 域名列表，以及这些域名的聚合流量与信誉指标。我们不读取邮件内容、联系人或附件。
- 用来做什么：展示域名流量与信誉指标，运行您请求的内部邮件管理功能。我们不用于广告、用户画像、信用评估、出售或 AI 训练。
- 与谁共享：不向任何第三方出售或用于营销。仅在运行服务所必需的范围内向云托管服务商共享，或按法律要求披露。
- 如何保护：OAuth 令牌使用 AES-256-GCM 加密存储；传输使用 HTTPS/TLS；仅经授权人员可访问。
- 保留多久：您断开连接或撤销授权后删除令牌；统计和业务数据为趋势对比而保留，直至您要求删除。
- 如何删除：在 Google 账号中撤销授权，并发送邮件至 easonbiz008@gmail.com，主题填写「Data deletion request」。在用系统 30 天内清理完毕。
- AI NCII：koppop 不创建、不协助 AI 生成的未经同意的私密影像，也不将 Google 数据用于任何 AI 目的。
- 联系方式：easonbiz008@gmail.com。
一、我们是谁以及本政策的适用范围
本应用由 koppop.com 团队运营，Google OAuth 同意屏幕上显示的应用名称为 koppop。隐私相关事宜的联系方式：easonbiz008@gmail.com。
本政策适用于 koppop 处理的信息，包括从 Google API 获取的信息；不适用于我们不控制的第三方网站或服务。
二、我们收集哪些信息
| 类别 | 具体内容 | 来源 |
|---|---|---|
| Google 账号标识 | 您授权 koppop 时使用的 Google 账号邮箱地址。该地址仅用于在管理界面中标识当前连接的账号。 | Google OAuth 2.0（openid、email） |
| OAuth 授权凭据 | 您授权后 Google 颁发的访问令牌（access token）和刷新令牌（refresh token）。刷新令牌用于在您不重新登录的情况下定期获取最新的 Postmaster 统计数据。 | Google OAuth 2.0 |
| Gmail Postmaster Tools 数据 | 您在 Postmaster Tools 中已登记并授权本应用访问的域名列表，以及这些域名的聚合流量与信誉指标，例如送达率、垃圾邮件率、退信率、反馈循环数据、域名信誉及相应统计日期。上述数据均为聚合统计，不包含具体收件人地址或邮件内容。 | Gmail Postmaster Tools API（只读） |
| 平台业务数据 | 您在使用 koppop 过程中创建的发件账号配置、邮件营销活动、发送队列、投递结果和退信记录。这些数据与您的 Google 账号数据相互独立。 | 您对 koppop 的使用 |
我们不会从 Google 收集的信息
- 我们不读取邮件正文、主题、邮件头、附件、收件人或 Gmail 邮箱中的任何其他内容。
- 我们不访问 Gmail、Google 通讯录、Google 日历、Google 云端硬盘或任何其他 Google 服务。
- 我们不通过 Google API 发送、修改或删除邮件或任何其他数据。
- 除账号邮箱地址外，我们不收集您的姓名、头像或其他 Google 个人资料信息。
三、我们如何收集信息
Google 相关信息仅通过 Google OAuth 2.0 授权流程获取。只有在您明确同意所请求的权限后，本应用才会获得访问权限。我们仅请求 openid、email 和 https://www.googleapis.com/auth/postmaster.traffic.readonly 三项权限，其中 Postmaster 权限为只读。我们不会在您未授权的情况下访问任何 Google 数据。
四、我们如何使用信息
- 在 koppop 内部管理界面中展示域名流量、信誉趋势和发送表现，辅助内部邮件运营决策。
- 按日期聚合和保存历史统计，用于趋势对比和异常排查。
- 识别当前连接的 Google 账号，便于经授权的人员在平台上管理和断开连接。
- 维护本应用的安全性、完整性和正常运行。
我们不会将 Google 用户数据用于广告投放、再营销、个性化或兴趣导向广告、用户画像、信用评估，也不会向第三方出售或出租。我们不会使用 Google 用户数据训练、开发或提供人工智能或机器学习模型，也不会将其用于 AI 生成的未经同意的私密影像（AI NCII）。
五、法律依据与同意
我们基于您通过 Google OAuth 同意屏幕作出的明确同意，以及为提供您所请求的内部功能所必需，处理 Google 用户数据。您可以随时按本政策第十一条所述方式撤回同意。
六、我们如何共享信息
- 我们不出售、不出租、不交换、不转让 Google 用户数据。
- 我们不会将 Google 用户数据共享给广告平台、数据经纪商或信息转售商。
- 我们可能向托管本应用的云基础设施服务商共享数据，仅限于运行本服务所必需，并要求其承担保密和数据保护义务、仅按我们的指示处理数据。
- 如适用法律或有权机关的合法要求，或为保护本应用、用户或公众的权利、安全和安保所必需，我们可能披露相关数据。
- 除为提供本政策所述功能所必需且遵守《Google API 服务用户数据政策》外，我们不会将从 Google API 获取的数据传输给任何其他应用。
七、Google API 服务用户数据政策与有限使用
koppop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
中文说明：koppop 对从 Google API 获取的信息的使用和向任何其他应用的传输，均遵守《Google API 服务用户数据政策》，包括其中的有限使用（Limited Use）要求。具体而言：
- 我们不将 Google 用户数据用于投放广告，包括再营销、个性化广告或兴趣导向广告。
- 我们不出售 Google 用户数据。
- 我们不使用 Google 用户数据判断信用状况或用于放贷目的。
- 我们不使用 Google 用户数据训练、开发或改进人工智能或机器学习模型，也不将其用于 AI NCII。
- 我们不允许人工读取 Google 用户数据，除非：(a) 您已针对特定信息明确同意；(b) 出于安全目的所必需，例如调查滥用行为；(c) 为遵守适用法律所必需；或 (d) 数据已经聚合和匿名化。
- 我们仅将 Google 用户数据用于提供或改进本应用界面中明确呈现的面向用户的功能。
八、存储与安全
- 数据存储在本应用自有的数据库中，服务器位于中华人民共和国境内。
- Google OAuth 访问令牌和刷新令牌使用 AES-256-GCM 加密后静态存储，加密密钥与加密数据分开管理。
- 传输中的数据通过 HTTPS/TLS 保护。
- 访问权限仅授予为运行和维护本应用所必需的经授权内部人员。我们采取与数据敏感程度相适应的访问控制和运营保护措施。
- 任何系统都无法保证绝对安全。如发生数据安全事件，我们将按适用法律的要求及时处置并通知相关方。
九、数据保留
- OAuth 令牌：在连接保持有效期间保留。当您在本应用中断开连接或在 Google 账号中撤销授权后，我们将停止使用相应令牌，并从在用系统中删除。
- Postmaster 流量统计：为支持历史趋势对比而保留，直至您要求删除或本应用停止提供该功能。
- 平台业务数据：按内部业务和合规需要保留，并在收到有效删除请求后按下述方式删除。
- 备份：备份存储中可能残留副本，保存时间受备份轮换周期限制，通常不超过 90 天，之后将被覆盖或删除。
十、数据删除
您可以随时请求删除 koppop 持有的与您或您的 Google 账号相关的数据：
- 在 Google 账号的「安全性 → 第三方应用和服务的访问权限 → koppop → 移除访问权限」中撤销授权，立即阻止进一步访问 Google 数据。
- 发送邮件至 easonbiz008@gmail.com，主题填写 「Data deletion request」，并注明您授权时使用的 Google 账号邮箱地址。我们可能要求您验证对该地址的控制权。
验证通过后，我们将删除相关的 OAuth 令牌及我们持有的 Google 相关数据，并通过邮件确认完成。在用系统通常在 30 天内清理完毕；备份中的残留副本按第九条所述备份周期删除。如适用法律要求保留最低限度的信息，我们将说明该保留义务。
十一、您的权利
- 撤回同意：随时通过 Google 账号撤销授权，或联系我们。
- 访问与可携带：请求确认我们是否处理您的数据，并请求获取副本。
- 更正：请求更正不准确的数据。
- 删除：按第十条所述方式请求删除。
- 反对或限制：反对或请求限制某些处理行为。
- 投诉：向我们提出任何疑虑；您也可以向有管辖权的数据保护机构投诉。
十二、跨境传输
本应用的服务器位于中华人民共和国境内。如您从其他国家和地区使用本应用，您的信息将被传输至中国境内并在那里处理。我们会按照适用法律的要求采取相应的保护措施。
十三、儿童隐私
本应用是面向企业内部的业务工具，不面向儿童。我们不会有意收集儿童的个人信息。如您认为儿童向我们提供了信息，请联系我们，我们将予以删除。
十四、政策更新
我们可能根据本应用的变化、法律要求或 Google 政策更新本政策。更新后的政策将在本页面发布，并标注新的生效日期。对于重大变更，我们会在可行的情况下通过本应用内的适当方式提示。更新后继续使用即视为接受更新后的政策。
十五、联系我们
如对本政策或我们的数据处理有任何疑问、请求或投诉，请联系：easonbiz008@gmail.com。我们将在合理期限内回复。