Privacy Policy

A. Personal Information Collected Directly

The personal information that we collect and process will vary depending upon the circumstances and how you interact or engage with us, but generally includes:

Registration and account information. When you register for a user account, we collect personal information such as name, username, email address, and password; account profile information such as your bio, avatar, connected accounts, subscription and billing status, reading and listening preferences, and other information related to your account.

Reading, listening, and content activity. As you use the Services, we collect information about the books, articles, podcasts, videos, and other content you save, open, read, listen to, or engage with, including your progress, ratings, and the recommendations you receive and act on.

Notes, highlights, and imported content. We collect the notes, highlights, annotations, tags, and other content you create or import into the Services. You may import content from third-party sources (for example, Kindle highlights or Readwise), upload files, add links, or capture text via photo import. When you do, we collect the content you provide and associated metadata (such as source titles, authors, locations, and timestamps).

AI features and connections. When you use our AI features (for example, Polaris, which surfaces patterns and connections across your notes, highlights, and other content), we process the content you have saved or created in order to generate connections, summaries, suggestions, and related outputs. We also collect the prompts, queries, and feedback you provide to these features.

Decision history. Polaris can help you work through a decision and, if you choose, save your question, the option you chose, your reasoning, and (later) what actually happened as a private decision record. Saved decisions are visible only to you; they are never projected onto any public profile, share link, social, or feed surface. If you record an outcome for a decision, Polaris may privately reference that past decision and outcome the next time you ask about a similar decision, so it does not repeat guidance you have already learned did not work. You control this: disabling memory in your settings stops any decision from being referenced in future guidance (your saved decisions remain visible to you and can still be edited); a per-decision "use as evidence" setting lets you exclude an individual decision from being referenced even while memory is otherwise on. Deleting a saved decision permanently removes the decision record, its edit history, and any evidence excerpt saved with it, and it can never again be referenced in future guidance. When you save a decision, if any supporting passage came from your own notes/highlights or public-domain material, a copy of that passage is saved with the decision so you can see why it was suggested; passages from licensed or internal sources are referenced by citation only and are never copied into your saved decision.

Profile and identity artifacts. Your SoulPage profile identity is public. When you maintain that profile or create shareable artifacts (for example, a SoulPrint representation of your intellectual identity), we collect the information you include. You control which optional activity, content, and artifacts you make public; see Section 7.

Communications and interactions. When you communicate or interact with us, whether through the Site, Services, via email, chat, or otherwise, we collect and maintain a record of your contact details, contact preferences, communications, chatlogs, and our responses. Interactions may include when you request help, request additional information about our Services, sign up for our mailing lists, report content or users, or otherwise provide us information through the Site or Services.

Payment and billing information. In connection with paid subscriptions, we collect payment and billing information, which may include billing contact name, address, and payment method information in order to facilitate payments through our third-party payment processors.

Events and other programs. For example, if you register for or attend an event that we host or sponsor, we may collect information related to your registration for and participation in such event.

Promotions and surveys. If you participate in sweepstakes, contests, and promotions that we offer, we will collect your name, email address, and other registration information. We may also conduct surveys, which help us evaluate, develop, and improve our Services. If you respond to surveys or similar requests, we will collect your personal information, including name and contact information and survey responses.

B. Personal Information from Third Party Sources

We collect information about you from other sources, such as public sources, business partners, and other third parties. For example, we may collect information such as:

Vendors and service providers. We outsource some of our operations to our service providers and vendors in order to provide and operate our Services. They may collect and provide us with IP address, unique identifiers, and other user activity information.

Payment processors. Our third-party payment processors may provide us with information related to payment processing, subscription status, and account status.

Content and import partners. When you connect a third-party service to import your content (for example, Readwise, a Kindle account, or another reading or note-taking service), we collect the highlights, notes, and associated metadata you authorize us to import, as well as related account and profile information made available through that connection.

Lead information. We may receive lead and prospect information from third parties about prospective users who may be interested in our Services. We may also engage with third parties to enhance or update our user information.

Social media and other third-party platforms. If you post about us or engage with us on social media, or choose to link your account to or log in with a third-party account (e.g., Google, Apple), we may collect personal information about you from that platform, such as profile information. These platforms control the information they share about you; please consult their respective privacy policies.

C. Personal Information We Collect Automatically or Derive

We automatically collect personal information related to your use of our Services, including information we collect using cookies and similar technologies. We may also derive information about you (e.g., your general location) and your use of the Services. Such information includes:

Device and browsing information. We may use cookies, third-party SDKs, pixel tags, and other tracking technologies to automatically collect personal information when you use our Site and other Services. This information may include IP address and other unique identifiers, general location information (and in some instances, device location information), browser type, domain names, access times, page views, date/time stamps, operating system, language, device type, unique ID, Internet service provider, referring and exiting URLs, and similar device and usage information. For more information, see the "Cookies, Targeting, and Analytics" section below.

Activities and usage. We collect activity information related to your use of our Site and Services, such as the links clicked, searches, features used, content browsed or saved, notes and highlights created, pages viewed, and time spent. We also collect data logs used to identify the source and destination of a communication; optimize and maintain performance of the Services; and monitor, investigate, prevent, and detect fraud, system abuse, security incidents, unauthorized activities and access, and other misuse of the Services.

Inferred and derived information. Based on your activity and the content you save and create, we may derive information such as your interests, topics of focus, and connections across your content, in order to power recommendations and AI features.

A. Legal Bases for Processing

Certain laws, including the EU General Data Protection Regulation ("GDPR") (and other relevant laws such as UK data protection laws), require that we inform you of the legal bases for our processing of your personal information. Pursuant to the GDPR (and other similar laws), we process personal information for the following legal bases:

Performance of a contract. As necessary to enter into or carry out the performance of our contract with you.

Compliance with laws. For compliance with legal obligations and/or defense against legal claims, including those in the areas of data protection, tax, and corporate compliance laws.

With your consent: where we have your consent (if required), the GDPR and other applicable laws give you the right to withdraw your consent at any time by contacting us using the details at the end of this Privacy Policy. In some jurisdictions, your use of the Services may be taken as implied consent to the collection and processing of personal information as outlined in this Privacy Policy.

In addition, we may process your personal information where necessary to protect the vital interests of any individual.

B. Processing Purposes

In general, we use personal information for the purposes set forth below, and where GDPR or other relevant laws apply, we have set forth the legal bases in parenthesis:

Providing the Services and support. To provide and operate our Services and Site, deliver content and recommendations, enable you to capture and organize notes and highlights, power AI features, communicate with you about your use of the Services, provide troubleshooting and technical support, respond to your inquiries, facilitate payments through our payment processors, and for similar service and support purposes. (Legal bases: performance of our contract and/or our legitimate interests)

Personalization and recommendations. To personalize your experience, recommend books, articles, podcasts, and videos, and surface connections and patterns across the content you save and create through features such as Polaris. (Legal bases: performance of our contract and/or our legitimate interests)

Public profiles and shareable artifacts. To create and display your public SoulPage profile and allow you to share identity artifacts such as SoulPrint. Optional profile activity, content, and artifacts are viewable by others only as allowed by your settings. (Legal bases: performance of our contract and/or our legitimate interests)

Communicating with you about the Services. To send notices, updates, security alerts, and other administrative messages, and to respond to your requests. We may also send user surveys and questionnaires, such as for market research. (Legal basis: performance of our contract)

Analytics and improvement. To better understand how users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve our Services, develop new features, improve our recommendation and AI systems, and for internal quality control and training purposes. (Legal basis: our legitimate interests)

Our advertising services. To promote SoulStack's products and services on third-party websites, as well as to measure and understand the reach and effectiveness of these ads. (Legal basis: our legitimate business interests; and/or with your consent)

Marketing and promotional purposes. For marketing purposes, including to send you newsletters, updates, alerts, and promotional information we think may interest you, as well as to evaluate, measure, and improve our marketing. (Legal bases: our legitimate interests and/or with your consent)

General business operations. To consider and implement mergers, acquisitions, reorganizations, and other business transactions, and where necessary to the administration of our general business, accounting, recordkeeping, and legal functions. (Legal bases: our legitimate interests; and/or compliance with laws)

Security and protection of rights. To protect the Services and our business operations, including to prevent and detect fraud, misuse, and unauthorized activities, and to investigate, prevent, or take action regarding illegal activities, suspected fraud, potential threats to the safety or legal rights of any person, or violations of our Terms of Service or this Policy. (Legal bases: our legitimate interests and/or compliance with laws)

Complying with legal obligations. To comply with the law or legal proceedings, including responding to subpoenas, court orders, and other lawful requests by regulators and law enforcement. (Legal bases: our legitimate interests and/or compliance with laws)

A. European Union/European Economic Area and UK Residents

Subject to the conditions set out in applicable law, data subjects in the European Union/European Economic Area ("EEA") and UK have the following rights with regard to our processing of their personal information:

Right of access. To confirm whether we are processing your personal information and to receive a copy of that personal information (along with certain other details).

Right to correction (rectification). To request that we correct any personal information we hold about you that is inaccurate or incomplete.

Right of erasure. To request that we delete your personal information under certain circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). (NOTE: If you request that we delete your personal information, we may do so by deleting your account(s) with us.)

Right of restriction. To request that we restrict the processing of your personal information under certain circumstances, such as where you contest its accuracy or object to our use or stated legal basis.

Right to data portability. To receive a copy of personal information we have obtained from you in a structured, commonly used, and machine-readable format and to reuse it elsewhere or ask us to transfer it to a third party of your choice, under certain circumstances.

Right to object. To object to our processing of your personal information on the basis of our legitimate interests, in which case we must stop such processing unless we have compelling legitimate grounds that override your interest or need to process it for the establishment, exercise, or defense of legal claims.

Right to object to marketing. To request that we stop processing your personal information for marketing purposes. If you do so, we will stop such processing for our marketing purposes.

Right not to be subject to automated decision-making. To not be subject to a decision based solely on automated processing if it produces a legal effect or similarly significantly affects you, unless it is necessary for entering into or performing a contract between us.

Right to withdraw your consent. Where you have consented, to withdraw your consent to our processing of your personal information, without affecting the lawfulness of our processing prior to the withdrawal.

Right to lodge a complaint. To lodge a complaint with a supervisory authority if you believe our processing of your personal information infringes the law.

Submitting a GDPR Request. Please contact us as set out in the Contact Us section above to exercise one of these rights. Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data.

B. U.S. Residents

Residents of certain U.S. states (including California, Virginia, Colorado, Connecticut, and Utah) have additional privacy rights under applicable privacy laws, subject to certain limitations, including:

Right to correction. To correct inaccurate personal information, taking into account the nature and purposes of the processing.

Right to deletion. To delete personal information provided to or obtained by us.

Right of access. To confirm whether we are processing personal information and to obtain a copy in a portable and, to the extent technically feasible, readily usable format.

Right to appeal. To appeal our denial of your privacy request, which you can do by contacting us at support@soulstack.so.

You may submit a request to exercise your privacy rights by contacting us at support@soulstack.so. We will take steps to verify your request by matching the information provided in your request with the information we have in our records. You must provide all information requested so that we can verify your identity. Authorized agents (where applicable) must provide proof of their authorization, and we may also require the relevant consumer to directly verify their identity and the authority of the authorized agent. If we deny your request, you may appeal our decision by emailing support@soulstack.so.

C. CCPA Privacy Notice for California Residents

Below, we provide information, as required under California privacy laws, including the California Consumer Privacy Act and its implementing regulations, each as amended ("CCPA"). This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments or other personal information subject to an exemption under California privacy laws.

Categories of Personal Information We Collect. Our collection, use, and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions. The table below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect and disclose to others for a business or commercial purpose.

Sales and Sharing. California privacy laws define a "sale" as disclosing or making available to a third party personal information in exchange for monetary or other valuable consideration, and "sharing" includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation, we may "sell" or "share" (as defined by the CCPA) Identifiers, Customer Records, Commercial Information, and Usage Data to third-party advertising networks, analytics providers, and social networks. We do not sell or share sensitive personal information, nor do we sell or share any personal information about individuals who we know are under sixteen (16) years old.

Sensitive Personal Information. We do not use or disclose sensitive personal information beyond the purposes authorized by the CCPA. Accordingly, we only use and disclose sensitive personal information as reasonably necessary (i) to perform the services requested by you, (ii) to help ensure security and integrity, (iii) to detect, prevent, and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who perform services on our behalf, and (vii) for purposes other than inferring characteristics about you.

Retention. We will retain your personal information as long as necessary for the purposes for which it was collected and is used by us, as stated in this Policy. If you request that we no longer use your personal information to provide Services to you, please contact us using the contact information provided in this Policy. To the extent permitted by applicable law, we will retain and use your personal information as necessary to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements.

When you submit a request to know, delete, or correct, we will take steps to verify your request by matching the information you provide with the information we have in our records. To verify your request, we will request your name, email, and contact details and confirmation of your email address. In some cases, we may request additional information.

Authorized agents may initiate a request on behalf of another individual by contacting us in writing at the contact information above. Authorized agents will be required to provide proof of their authorization, and we may also require the relevant consumer to directly verify their identity and the authority of the authorized agent. We will respond to verifiable requests as required by law. If we are unable to adequately verify a request, we will notify the requestor.

Requests to Opt-Out of Sales and Sharing. California residents may submit requests to opt out of "sales" and "sharing" (including targeted advertising) of their personal information by emailing support@soulstack.so.