Privacy Policy

1. Who We Are

Sooper is a software-as-a-service platform that enables creators and businesses to build and monetise online memberships. We provide the technical infrastructure but do not own or control user-generated content.

The platform is operated by Sooper Limited, a company registered in England and Wales, at 14 Brow Cottages, Hove Edge, HD6 2PJ, United Kingdom. Sooper Limited is the data controller for your account, your use of the platform, and our own communications and analytics.

When you join a creator's community, that creator decides what information they collect from their members and why. For the data Sooper handles on a creator's behalf, such as memberships, purchases and messages within that community, the creator is the controller and Sooper acts as their processor. Questions about how a creator uses your data are best directed to the creator; we will help where we can.

2. What Information We Collect

Everyone with an account

• Name, email address, profile picture and the preferences you set
• Sign-in details: one-time codes sent to your email, or your Google account if you sign in with Google. From Google we receive your name, email address and profile picture. You can revoke Sooper's access at any time in your Google account settings
• Messages you send to our support team

Members

• The communities you follow or join, your membership tier, and the products or bookings you purchase, including amounts, dates and any discount codes used
• Details you provide when booking or completing a purchase, such as answers to a creator's questions
• Chat messages, comments and other interactions within communities
• Payment details are collected by Stripe, not by Sooper. We receive a payment reference and the outcome, never your full card number

Creators

• Your community details and the content you publish
• Your Stripe Connect account identifier and payout status. Identity, tax and bank details needed for payouts are collected by Stripe under its own privacy policy
• Details of third-party services you choose to connect, such as an advertising pixel, calendar or video conferencing account

Collected automatically

• IP address and an approximate location derived from it
• Device, browser and operating system information
• Usage activity, such as sign-in history, pages viewed and where you left off in a video
• The site you arrived from and, with your consent, advertising click identifiers (see Cookies and Tracking)

We do not collect or store:

• Full payment card details and government-issued IDs (these are handled by Stripe)

3. How We Use Your Information

We use personal data for the following purposes:

• To provide access to Sooper and personalise your experience
• To allow Creators to manage their communities and members
• To process payments, subscriptions, bookings and payouts via Stripe
• To provide customer support and respond to inquiries
• To enforce our Terms of Service
• To prevent fraud, abuse, account sharing or illegal activity
• To improve the platform's performance and features

Emails we send

• Service emails, such as sign-in codes, receipts, booking confirmations and important account notices. These are part of providing the service and cannot be switched off while you have an account
• Notification emails about activity in your communities, which you can adjust in your settings
• Marketing emails about new Sooper features and offers. We send these to existing customers on the basis of our legitimate interest, and to people on our waitlist who signed up for updates. Every marketing email contains an unsubscribe link, and you can also opt out by emailing [email protected]

We do not upload your details to advertising platforms to target you or people like you with Sooper's own advertising.

4. Lawful Basis for Processing

Under the UK GDPR and, for users in the EEA, the EU GDPR, we rely on:

• Performance of a contract: running your account, delivering memberships, purchases and bookings, processing payments, and providing support
• Legal obligations: keeping tax and accounting records, preventing fraud, and responding to lawful requests from authorities
• Legitimate interests: securing the platform, preventing abuse, diagnosing errors, improving our features, and telling existing customers about our services
• Consent: analytics and marketing cookies, and the sharing of conversion data with advertising platforms a creator has connected. You can withdraw consent at any time via the Cookie settings link in the footer

5. Sharing of Data

We do not sell your data.

With creators

When you follow or join a community, its creator and any co-creators can see the information they need to run it: your name, email address and profile picture, your membership tier and its status (including cancellations), your purchases and bookings, the access you hold, messages you send them, your comments, your engagement with their content, and any answers you give when booking or purchasing. Creators are controllers of this data and are bound by our Terms of Service to use it only for operating their community.

With other members

Other members of the same community can see your name and profile picture in chat channels and on your comments. Nothing else about you is shown to other members beyond what you post.

Publicly

Creator profiles and community pages are public. If you comment on a public post, your name, profile picture and comment are visible to anyone who can view that post. There are no public member profile pages.

With our service providers

We use third-party providers for payments, hosting, email, messaging, analytics and support. They process personal data only on our instructions. The providers and where they are located are listed on our Sub-processors page, which we update before a new provider starts processing your data.

With authorities

We may share data with law enforcement, regulators or courts where the law requires it, or to protect the rights and safety of our users and the platform.

6. Data Retention

We keep your account and community data for six years after your account was last active, or until you ask us to delete it, whichever comes first.

Some records are kept regardless of a deletion request: transaction, invoice and tax records for six years after the end of the tax year they relate to, as UK law requires, and data we need to establish or defend legal claims or to comply with a legal hold. Short-lived data, such as advertising click identifiers and your cookie choice, has its own retention period set out under Cookies and Tracking.

When data is no longer needed we delete it or anonymise it so that it can no longer be linked to you.

7. Cookies and Tracking

When you first visit Sooper we ask for your cookie preferences. Non-essential cookies are only used with your consent, and you can change or withdraw your choices at any time via the "Cookie settings" link in the footer of every page. We use three categories:

Essential (always active)

• Signing you in and keeping your session secure
• Remembering your cookie preferences (stored for up to 6 months)
• Security, fraud and abuse prevention, which may include processing device and browser characteristics
• Core platform features, such as remembering where you left off in a video

Analytics (with your consent)

• Google Analytics and our own product analytics, to understand how Sooper is used and improve it

Error diagnostics run without your consent being required, because they store nothing on your device.

Marketing (with your consent)

• Creators on Sooper can connect advertising platforms (such as Meta, TikTok, Google and OpenAI) to measure whether their promotions led to visits, follows or purchases in their community
• For this purpose we may store advertising click identifiers from the link you arrived on for up to 30 days, and share conversion data (such as a purchase and its value) with the relevant advertising platform

Rejecting or withdrawing consent never limits your access to Sooper. You can additionally block or delete cookies in your browser settings, though essential cookies are required for signing in.

8. International Transfers

Sooper Limited is based in the United Kingdom and our infrastructure and database are hosted in the European Union. If you are in the EEA, the transfer of your data to the UK is covered by the European Commission's adequacy decision for the United Kingdom.

Some of our service providers process data in other countries, including the United States. Those transfers rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified providers) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. The location of each provider is listed on our Sub-processors page.

9. Your Rights

Under the UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your data erased ("right to be forgotten")
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time, without affecting processing that took place before

To exercise any of these rights, email [email protected] from the email address on your account. We may ask you to confirm the request from that address or by signing in, so that we do not act on requests from someone else. We respond within one month; for complex requests we may take up to two further months and will tell you if so. There is no fee unless a request is clearly unfounded or excessive.

To delete your account, email us at the address above. We close the account and delete your data within 30 days, apart from the records described under Data Retention. Creators should note that deleting an account also removes their communities and content.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). If you are in the EEA you can complain to the authority in your own country. We would appreciate the chance to address your concern first, but you are not required to contact us before making a complaint.

10. Data Security

We protect your data with encrypted connections (TLS), access controls and multi-factor authentication on our infrastructure and administrative accounts, and regular security reviews and penetration testing. Card details never reach our servers; they are handled by Stripe.

No platform can guarantee absolute security. You are responsible for keeping your sign-in details and devices secure, and for letting us know if you believe your account has been accessed without your permission.

11. Children's Privacy

Sooper is not intended for children under the age of 18. We do not knowingly collect personal data from anyone under this age. If you believe a minor is using Sooper, please contact us immediately.

12. Updates to This Policy

We may update this Privacy Policy from time to time and will show the date of the latest version at the top of this page. If we make material changes that affect your rights, we will notify you by email or through the platform before they take effect.