Effective date: 9 October 2026
1. Who is responsible for your information?
Stooper is the service name used for the Malaysia-operated website at stooper.co. For privacy questions, contact hellocs@stooper.co. Business identity information is listed on our Legal Notice.
Owner detail required before paid EU consumer launch: the current website source does not contain the legal operator's full legal name or geographic business address. These details must be supplied by the operator. They must be added to the Legal Notice before enabling paid EU consumer checkout or relying on this site as the complete trader-identification notice.
2. Scope
This policy explains how Stooper handles personal data when you browse the site, use public tools, save information locally in your browser, or contact Stooper. Where the EU General Data Protection Regulation (GDPR), UK GDPR, Malaysia's Personal Data Protection Act or another privacy law applies, Stooper aims to process personal data according to that law.
3. Information we process
Website and security data
Our hosting, content-delivery and security infrastructure may process technical data needed to deliver and protect the site, such as IP address, request date/time, requested URL, browser/user-agent information, response status and security events. Stooper does not use this data to build advertising profiles.
Information you choose to send
If you contact Stooper by email, WhatsApp or another channel, we receive the information you send, which may include your name, email address, phone number, business information, project details and message history. The website contact form itself does not submit or store the enquiry on Stooper's server; it prepares a draft for you to review and send in your chosen app.
Local browser data
Some features store information only on your device using browser storage. Examples include saved-guide preferences, invoice/quotation drafts and your privacy choices. This local data is not automatically uploaded to Stooper. You can remove it using the tool's reset/clear function or your browser's site-data controls.
Tool inputs
Inputs entered into browser-based tools such as the Malaysia Tax Calculator and Invoice & Quotation Generator are designed to be processed on your device. Stooper does not intentionally receive those values merely because you type them into the tool. If you later send, export or share a document, your chosen destination may process it under its own privacy terms.
4. Purposes and lawful bases
| Purpose | Typical data | Lawful basis where GDPR applies |
|---|---|---|
| Deliver the website and requested tools | Technical request data | Legitimate interests in operating a secure, functional service; and contract/steps at your request where applicable |
| Reply to enquiries and discuss projects | Contact and project information | Steps requested before a contract, performance of a contract, or legitimate interests in responding |
| Security, abuse prevention and troubleshooting | Logs, request metadata, error/security events | Legitimate interests in protecting Stooper, users and systems |
| Comply with tax, accounting or legal obligations | Transaction/contract records where applicable | Legal obligation |
| Optional Google Analytics | Page visits, browser/device and network request information | Consent; blocked until Analytics is allowed |
| Google AdSense advertising | Ad requests, device/browser and network information, consent signals and advertising-related identifiers where permitted | Consent where required; otherwise the lawful basis available under applicable law. Google's certified consent message manages advertising choices in regions where it is required. |
5. Cookies and similar technologies
Google Analytics 4 is optional and loads only after you allow Analytics in Cookie settings. It helps us understand page visits using page URLs, titles, browser/device information and network request data processed by Google. Our page-view integration removes URL query strings and fragments and does not intentionally send tool inputs, invoice details or contact messages. Google may process data outside Malaysia under its privacy terms. Analytics cookies are configured for up to 180 days; data retention in Google Analytics follows the property settings.
Rejecting Analytics keeps the Google tag blocked. You can withdraw consent through Cookie settings; the page reloads and accessible Google Analytics cookies are cleared. Withdrawal does not remove previously collected data. Contact hellocs@stooper.co for privacy requests. Google AdSense is active on the production website and may request advertising-related information from Google when pages load. Where advertising consent is required, Google's certified Privacy & Messaging consent message manages those advertising choices. Stooper's separate Cookie settings panel controls Stooper functional storage and Google Analytics; it does not override Google's advertising-consent choices. Cookie policy · Google privacy policy.
6. Recipients and service providers
Personal data may be processed by providers that support website hosting, content delivery, security, email or communications, only to the extent needed for those services. If you choose WhatsApp, Meta/WhatsApp processes your message under its own terms. A small number of legacy browser tools may request open-source libraries from jsDelivr or cdnjs; those network providers can receive ordinary request metadata such as your IP address when the resource is requested.
Stooper does not sell personal data. Advertising is provided through Google AdSense; whether Google may use advertising identifiers or personalization signals depends on the visitor's choices, applicable law and Google's consent controls.
7. International processing
Stooper is based in Malaysia. If you contact Stooper from the EEA, UK or another country, your message may be processed in Malaysia. Service providers may also process data in other countries. Where a provider transfers personal data in a way that requires an international-transfer safeguard, Stooper will use or require an appropriate lawful mechanism where applicable.
8. Retention
- Browser-local drafts/preferences: remain on your device until you clear them, your browser removes them, or a feature-specific reset is used.
- Privacy choice: Stooper asks for a renewed choice after approximately 180 days.
- Enquiry/project correspondence: kept only for as long as reasonably needed to respond, manage the relationship, resolve disputes or establish legal claims.
- Transaction/tax records: if paid work occurs, retained for the period required by applicable accounting, tax and legal rules.
- Routine technical/security logs: retained for the shortest practical period consistent with security and provider operations; provider-level retention may follow the provider's documented schedule.
9. Your rights
Depending on the law that applies, you may have rights to be informed, access your data, correct inaccurate data, request deletion, restrict processing, receive portable data, object to certain processing, and withdraw consent. You may also have rights relating to solely automated decisions with significant effects. Stooper does not currently use solely automated decision-making that produces legal or similarly significant effects.
Where GDPR applies, we aim to respond without undue delay and normally within one month. You can start a request through the Privacy Request page. We may need enough information to verify identity before disclosing or deleting personal data.
10. Complaints
If you are in the EEA and believe your data-protection rights have not been respected, you can complain to the supervisory authority in the country of your habitual residence, place of work or the alleged infringement. We encourage you to contact Stooper first so we can try to resolve the issue.
11. Children
Stooper is designed for business/work use and is not intentionally directed to children. Do not send Stooper a child's personal data unless there is a clear lawful reason and appropriate authority to do so.
12. Security
We use data minimisation, HTTPS, browser-local processing where practical and security headers/controls intended to reduce common web risks. No internet service can guarantee absolute security. See our Security page for more detail.
13. Changes
We may update this policy when the service or legal requirements change. The effective date above will be updated. Material changes affecting existing paid customers should also be communicated through an appropriate channel when applicable.
14. Contact
Email: hellocs@stooper.co
Country: Malaysia
Privacy requests: stooper.co/privacy-request/