Data Collection
Policy

We collect only what is necessary to make Soulmate work for you. Here is a precise breakdown of each category of data, why we collect it, and how long we keep it:

Encryption is not optional for Soulmate — it is the default state of every piece of personal content you store.

Your photos, memories, and notes are encrypted before being stored. Only you and your linked partner have access. Even our own engineers cannot read your personal content.

Your data is stored on secure, redundant cloud infrastructure. We use established, industry-leading cloud providers with ISO 27001, SOC 2 Type II, and other recognised security certifications.

All primary data storage is on servers located in India, in compliance with applicable data localisation requirements. Automated encrypted backups are maintained to protect against data loss. Backup data is also stored within India.

Access to your stored data is strictly controlled. Only a handful of authorised Soulmate engineers can access the infrastructure, and all access events are logged and audited.

These are unconditional commitments — not subject to future business decisions, policy changes, or commercial pressure:

The only exceptions to the consent requirement are narrow and legally mandated:

• Legal requirement — if a court order, subpoena, or government authority legally compels us to disclose specific data
• Imminent harm prevention — if disclosure is necessary to prevent serious harm or illegal activity, as required by applicable law
• Trusted service providers — for specific technical functions (payments, cloud storage) under strict data processing agreements, with no access to your personal content

In each case, we share the minimum amount of data necessary and no more.

We keep your data for as long as your account is active. Once your account is deleted, your data is removed from our live systems and from backups within the periods shown below:

You may request early deletion of your billing records where this is legally permissible. Contact us at [email protected].

We use a small, carefully selected group of third-party services to operate the App. Each is bound by a data processing agreement that restricts their use of any data to the specific function they perform for us.

Payment processing — Your payment details are handled entirely by our payment provider. Soulmate never sees or stores your full card number. The payment provider processes your data under their own PCI-DSS compliant security standards.

Cloud infrastructure — We use industry-leading cloud providers for secure, redundant storage of your encrypted data. These providers have no ability to decrypt or access your personal content.

Crash reporting — To detect and fix bugs quickly, we use a crash reporting tool. This tool receives anonymised technical information about errors — it has no access to your personal content, memories, or notes.

None of these providers are permitted to use your data for their own marketing, analytics beyond the function specified, or any other purpose.

You have direct control over your data within the App. From your account settings, you can:

• Export your data — download a full copy of your memories and account data in a portable format
• Delete your account — permanently remove your account and all associated data
• Edit or correct your information — update your name, email, or any other account details at any time
• Manage notifications — choose what emails and push notifications you receive
• Disconnect your partner — unlink your accounts at any time, which removes access to shared content

For requests that require our assistance (access to historical data, corrections to billing records, etc.), email us at [email protected] and we will respond within 30 days.

Despite our comprehensive security measures, no system can be guaranteed 100% secure. In the unlikely event of a security incident affecting your personal data, we commit to:

• Notifying affected users within 72 hours of becoming aware of the breach, where feasible
• Providing clear information about what data was affected and what steps we are taking
• Notifying relevant authorities as required by applicable law
• Taking immediate steps to contain and remediate the incident

If you ever believe your account has been compromised, please contact us immediately at [email protected].

If you have any questions about this Data Collection Policy, want to exercise your data rights, or have any concerns about how your data is handled, please contact us at [email protected].

We read every message and take data concerns seriously. We aim to respond within 48 hours.