Toolza.

Privacy Policy & Personal Data Protection Notice

Last Updated: 13 October 2026  |  Version 1.4

This Privacy Policy and Personal Data Protection Notice ("Policy") describes how Toolza ("Toolza", "we", "us", or "our") collects, uses, discloses and protects personal data when you use our website at https://toolza.online (the "Service").

Toolza is operated from Malaysia. This Policy is written to address the requirements of the Malaysian Personal Data Protection Act 2010 (Act 709) ("PDPA") as the primary applicable law, and also to reflect good practice for users in other jurisdictions including the EEA/UK (GDPR/UK GDPR) and the United States.

We do not claim that this Policy constitutes legal certification under the PDPA, GDPR or any other law. If you have specific legal compliance concerns, please seek independent professional advice.

1. Who Operates Toolza

Toolza was created and is operated by Abdalrahman Qaradaya, a student based in Malaysia. The site was built to help students and employees with their everyday study, work, document, and productivity tasks.

For privacy enquiries, contact us at: gharzaofficial@gmail.com

2. Personal Data We Collect

We collect only the minimum data needed to provide and improve the Service.

2.1 Data You Provide

  • Files and documents you upload to Toolza tools (e.g., PDFs, images, audio files, text). Processing may take place in your browser, on Toolza's servers, or through an AI provider, as stated on the tool page and in Section 4.
  • Text input entered into tools (e.g., text for grammar checking, lecture transcripts, queries).
  • Contact form submissions: your name, email address and message, when you contact us via the Contact page.
  • Tool feedback: the tool identifier, rating, and any optional comment you submit. Feedback is recorded in server logs; do not include sensitive personal information in comments.

2.2 Automatically Collected Data

  • Log data: your IP address, browser type, operating system, referring URL, pages visited, and timestamps. This is collected by our server software for operational and security purposes.
  • Cookies and similar technologies: see Section 5.
  • Usage data: which tools are used and how frequently (aggregated, not linked to identifiable individuals where possible).

2.3 Data We Do Not Collect

Toolza does not require account registration. We do not collect your name, email address or other personal details unless you submit them through a tool, feedback, or contact form. We do not knowingly collect precise geolocation data.

3. How We Use Your Personal Data

We use personal data for the following purposes:

  • To provide and operate the Service and its tools;
  • To process files and text you submit through our tools;
  • To respond to enquiries submitted via the contact form;
  • To maintain security, detect abuse, and prevent fraud;
  • To monitor and improve the performance and reliability of the Service;
  • To manage advertising if it is enabled in the future (currently paused; see Section 7);
  • To comply with applicable laws and legal obligations.

4. Uploaded Files and Document Processing

Each tool page states its processing approach. Browser-only tools process inputs locally without uploading them to Toolza. For tools that upload a file (PDF, image, audio, video, or other document), the following applies:

  • Server-side processing: Your file is transmitted to and temporarily stored on Toolza's server infrastructure for the purpose of processing your request. Processing does not happen entirely in your browser.
  • Post-processing cleanup: Toolza attempts to delete temporary working files when processing for that request finishes, including failed requests.
  • Background cleanup: A background process runs every 5 minutes and removes any remaining temporary files older than 15 minutes. This catches files that may not have been deleted in the immediate post-processing step.
  • No permanent storage: Toolza does not permanently store, retain, or index the content of uploaded files.
  • Server logs: Operational logs may record metadata such as file type, request timestamp and IP address, but do not record file content. Logs are retained for a reasonable operational period.
  • Third-party AI processing: Certain tools send your text, audio or image content through Replit AI Integrations to OpenAI's API for processing. These include text and study tools such as Grammar Checker, Text Summarizer, Paraphraser, Reference Generator, Citation Style Converter, PDF to Flashcards, PDF to Quiz, Study Notes Generator, Question Generator, Mind Map Generator, Presentation Generator, Cover Letter Generator, Professional Email Generator, Meeting Minutes Generator, Meeting Summarizer, Resume Analyzer, Job Description Analyzer, Report Generator, and Business Proposal Generator; Lecture Transcript (audio or video); and Image to Text and AI Image Scanner (image data sent to OpenAI). OpenAI processes submitted content under its Privacy Policy. Review the provider's policy before submitting information you consider sensitive.

Note on residual copies: We cannot guarantee that server infrastructure, cloud provider systems, or third-party services (including OpenAI) do not retain temporary copies of data in logs, backups or error-reporting systems on their end. We take reasonable steps to minimise this but cannot make an absolute guarantee.

5. Cookies and Similar Technologies

Toolza uses cookies and similar browser-based storage technologies. You can manage your preferences at any time via the in the footer.

5.1 Cookie Categories

  • Strictly Necessary: Required for the website to function. These cannot be disabled through the analytics controls. Browser storage remembers your privacy choice, requested theme, CV and invoice drafts, and feedback choices to provide those features. CV and invoice drafts can contain personal data and remain in this browser until cleared or replaced. Clear your browser's site data to remove local records, especially on shared devices. Toolza does not require an account.
  • Analytics: Optional custom interaction events are sent only when you enable Analytics in Toolza's privacy controls. Replit Project Analytics may separately collect published-site traffic metrics when enabled by Toolza in Replit Publishing settings; see Section 6.
  • Advertising: Google AdSense and Google's Privacy & Messaging consent message may use cookies and similar technologies for advertising. Google manages advertising consent separately; Toolza's local analytics controls do not grant or revoke it. See Section 7.

5.2 Managing Cookies

You can change your custom analytics choice at any time by clicking in the footer. Google advertising choices are managed separately through its consent message and the Google ad privacy choices link in Toolza's Privacy Settings. Browser settings can also limit cookies; disabling necessary storage may affect the Service.

6. Analytics

When enabled by Toolza in Replit Publishing settings and published, Replit Project Analytics automatically collects traffic metrics such as visitor counts, page views, referrers, and IP addresses. The analytics tracker is injected by Replit; Toolza does not add a separate analytics script. See Replit's Project Analytics documentation for details about its data collection and processing.

Toolza also sends custom interaction events through Replit Project Analytics only when you opt into Analytics in Toolza's privacy controls. Events record tool search-result selections, AI-tool outcomes, standard result panels shown by supported tools, download-button clicks, feedback ratings, and affiliate-link clicks. Affiliate click events include only the selected tool and offer identifiers; they do not include the HopLink URL. Event properties do not include search text, submitted prompts, uploaded files or filenames, generated content, or feedback comments.

Replit's automatic traffic metrics are controlled by the site owner's Publishing settings and are separate from Toolza's local custom-event preference.

7. Advertising and Google AdSense

Toolza loads the Google AdSense publisher tag across its pages. Google may use cookies, web beacons, IP addresses, and other identifiers for ad delivery and measurement, and for personalization where permitted. Whether an ad is displayed depends on the publisher's AdSense settings and eligible placements. Google's Privacy & Messaging consent message manages advertising choices separately from Toolza's custom analytics controls.

For more information about how Google uses data when you use partner websites and applications, see How Google uses data when you use our partners' sites or apps.

For European regulations, Google's certified Consent Management Platform (CMP) provides the consent message and communicates consent through the IAB Transparency and Consent Framework. Visitors can reopen the available Google consent choices from Toolza's Privacy Settings. The local analytics toggle does not replace or modify the Google CMP's advertising choices.

8. Third-Party Services

The following third-party services may process personal data in connection with the Service:

  • OpenAI — AI language model and audio transcription processing for AI-powered tools. Privacy Policy: openai.com/policies/privacy-policy
  • Google AdSense / Google LLC — Advertising delivery and Google's Privacy & Messaging consent service. Privacy Policy: policies.google.com/privacy
  • Google Fonts — Web font delivery. May log your IP address. policies.google.com/privacy
  • ClickBank and product vendors — If you follow an affiliate recommendation, your browser visits the ClickBank HopLink and then the vendor's site. Those services receive the resulting request and may use their own data, cookies, and tracking under their privacy policies. Toolza's custom affiliate-click event is optional and is sent only when you enable Analytics in Toolza's privacy controls.
  • Replit, Inc. — Server infrastructure and hosting. Privacy Policy: replit.com/site/privacy
  • Resend — Contact messages are sent through Resend to Toolza's contact mailbox when email delivery is configured. Name, email, subject, and message are also recorded in server logs. Privacy Policy: resend.com/legal/privacy-policy

These third parties operate under their own privacy policies. We encourage you to review them.

9. Data Sharing and Disclosure

We do not sell your personal data. We may share personal data in the following circumstances:

  • Service providers: Third-party processors who assist in operating the Service (see Section 8), under appropriate data processing arrangements.
  • Legal obligations: Where required by law, regulation, court order or governmental authority in Malaysia or another applicable jurisdiction.
  • Protection of rights: To protect the rights, property or safety of Toolza, our users, or the public.
  • Business transfer: In the event of a merger, acquisition or sale of assets, your data may be transferred as part of that transaction.

10. International and Cross-Border Data Transfers

Toolza is operated from Malaysia. When you use our Service, your data may be transferred to and processed in other countries, including the United States (where OpenAI's infrastructure is located).

Under the Malaysian PDPA, personal data may only be transferred to countries or territories specified by the Minister of Digital. Where transfers occur outside those jurisdictions, we take reasonable steps to ensure your data is protected to a standard comparable to that required under Malaysian law.

11. Data Retention

  • Uploaded files: Temporary working files are removed after processing. While the server is running, a cleanup runs every 5 minutes to remove working directories older than 15 minutes; this is not a guaranteed 15-minute deletion deadline. Provider-side copies may have different retention (see Section 4).
  • Server logs: Used for operations, security, contact messages, and feedback. Retention is managed by our hosting provider; Toolza does not currently enforce a fixed deletion period for these logs.
  • Contact form data: Retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter in logs and, when delivered, the email provider and contact mailbox. There is no automated mailbox deletion schedule.
  • Consent records: Stored locally in your browser's localStorage and not sent to our servers. The record includes your custom analytics choice and the time you saved it; it remains until replaced or browser site data is cleared.

12. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These include HTTPS encryption for data in transit and access controls on server infrastructure.

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data breach notification: In the event of a personal data breach, we will take prompt steps to mitigate harm and notify affected individuals and relevant authorities as required by applicable law, including the Malaysian PDPA.

13. Your Rights and How to Exercise Them

13.1 Malaysian PDPA Rights

Under the Malaysian Personal Data Protection Act 2010, you have the right to:

  • Access your personal data held by us;
  • Correct inaccurate, incomplete or outdated personal data;
  • Withdraw consent to our processing of your personal data (where processing is based on consent);
  • Limit processing of your personal data in certain circumstances;
  • Enquire about our data protection policies and practices.

13.2 EEA / UK GDPR Considerations

If you are located in the European Economic Area or United Kingdom, you may have additional rights under the GDPR or UK GDPR, including the right to erasure ("right to be forgotten"), data portability, and to lodge a complaint with a supervisory authority. The lawful bases we rely on include legitimate interests (for operational data and security logs) and consent (for optional cookies and third-party AI processing).

13.3 US Privacy Considerations

Toolza does not knowingly sell personal information. Depending on your state of residence, you may have rights under applicable US state privacy laws (such as the California Consumer Privacy Act or similar state laws). We will respond to verified requests as required by applicable law.

13.4 How to Submit a Request

To exercise any of the rights above, contact us at: gharzaofficial@gmail.com

We will respond within a reasonable time and in accordance with applicable law. We may need to verify your identity before processing certain requests.

14. Children's Privacy

Toolza is not directed at children under the age of 13 (or 18 where required by applicable law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

15. Data Protection Officer

Toolza does not currently appoint a formal Data Protection Officer. For all privacy enquiries, please contact us at gharzaofficial@gmail.com.

16. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page with a revised "Last Updated" date. For material changes, we may provide additional notice. Your continued use of the Service after changes are posted constitutes acceptance of the updated Policy.

17. Contact Us

For questions, complaints or requests about this Policy or your personal data, please contact:

Toolza Privacy Contact
Email: gharzaofficial@gmail.com