Privacy Policy
Version 1.0, effective 23 October 2026
1. Who is responsible
The controller of your personal data is Soul & Power, Sofia, Bulgaria. Contact for any privacy question: [email protected].
2. What we collect and why
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| First name, last name, email, password (stored only as a secure hash) | Create and secure your account, recognise you | Contract (Art. 6(1)(b)) | Until you close your account |
| Your typed name, date, time, text version, IP address and browser when you give consent or type START at checkout | Prove your consent | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | Account life + 5 years |
| Passkey for your private lock (public key only; your face or fingerprint never leaves your device and we never receive it) | Protect your conversations and memory from anyone else using your device | Contract | Until you remove it or close your account |
| Orders, credits, minutes used | Provide what you bought, accounting | Contract, legal obligation (accounting law) | 10 years for accounting records, as required by Bulgarian law |
| Card details | Payment | Processed by Stripe, never stored by us | Under Stripe's policy |
| Conversations with Sophia and Sophia's memory of you (text of your words and her replies, summaries, short notes such as your name and topics you care about) | Only if you turn on Memory: let you reread and continue conversations, let Sophia know you over time | Explicit consent (Art. 6(1)(a) and 9(2)(a)) | Until you delete them, clear them, turn Memory off, or close your account. When Memory is off, nothing is saved |
| Your voice, during a voice conversation | Turn your speech into text in real time | Contract | Not recorded by us. Processed in real time, then discarded |
| Email verification codes for the free trial | Prevent abuse of free minutes | Legitimate interest | Until the trial is used, then 12 months |
| Technical data (IP address, browser) | Security, preventing abuse, rate limiting | Legitimate interest (Art. 6(1)(f)) | Up to 30 days in logs |
| Visit statistics | Count visits to improve the site | Legitimate interest | Aggregated and anonymous; you can opt out on the site |
Sensitive information
When you talk with Sophia, you may share information about your health, mental wellbeing, beliefs, religion or private life. This is "special category" data under the GDPR. We process it only with your explicit consent, given separately when you start using Sophia, and only to hold the conversation and keep it in your account. You can withdraw this consent at any time; Sophia will then no longer be available to you, and you can delete your conversations. Withdrawing does not affect processing that happened before.
We do not analyse your emotions from your voice or face, we do not sell your data, we do not use your conversations for advertising, and we do not use them to train AI models.
Your controls
Memory (saved conversations and Sophia's memory) is off by default. You choose yes or no before your first conversation and can change it at any time in your settings. Saved data is protected by a private lock: it can only be opened with your passkey (face, fingerprint or device code). The lock closes after two minutes of inactivity. Recognition of your face or fingerprint happens only on your device; we receive a cryptographic key, never biometric data. You can delete any conversation, or clear everything Sophia has saved about you, at any time, and deletion is permanent.
3. Who receives your data
We use the following service providers. They process data only on our instructions, under data processing agreements.
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the site, database and stored conversations | Germany (EU) |
| Cloudflare, Inc. | Network security and delivery of the site (all traffic passes through it) | EU and USA |
| Stripe Payments Europe, Ltd. | Payments | Ireland (EU); USA for some processing |
| OpenAI, L.L.C. | AI language model generating Sophia's replies; speech-to-text | USA |
| Anthropic PBC (through Inworld) | AI language model used for some replies, especially in Bulgarian | USA |
| ElevenLabs Inc. | Sophia's voice (text-to-speech) | USA / EU |
| Inworld AI, Inc. | Real-time voice conversation | USA |
| Simli, Inc. | Animated face of Sophia in some rooms (receives Sophia's voice, not yours) | USA |
| Namecheap, Inc. (Private Email) | Sending account and password-reset emails | USA |
AI providers receive the text of the conversation (and, for speech-to-text, your voice) to generate the reply. We use them under paid business terms that do not allow them to train their models on your data. Some keep data for a limited time to detect abuse.
Transfers outside the EU. Some providers are in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
We may disclose data to authorities when the law requires it.
4. Your rights
You can: access your data; correct it; delete it; receive it in a portable format; object to processing based on legitimate interest; restrict processing; withdraw any consent at any time. In your account you can turn Memory on or off, delete one conversation, or clear everything Sophia has saved. To receive a copy of your data or close your account, write to [email protected]. We answer within one month.
You can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the authority of your country.
5. Security
Passwords are hashed, databases are stored on servers in Germany with restricted access, connections are encrypted (HTTPS), and you can protect your private area with a passkey.
6. Children
Soul & Power is for adults (18+). We do not knowingly collect data from minors. If you believe a minor has an account, contact us and we will delete it.
7. Cookies
See our Cookie Policy.
8. Changes
We will inform you by email or in the app before any significant change to this policy.