Privacy Policy

1. Personal data controller

The company operating AskSoma ("we", "us", "our" or the "Company") is the controller of your personal data. You can find our contact details in Section 13 (Contact us).

2. Categories of personal data we collect

We collect the following data about you:

• Data you provide to us — for example, name, gender, date of birth, time of birth, place of birth, email address, and any other profile or preference data you enter in the App.
• Data we receive from third parties — for example, when you sign in via Google or Apple, we may receive identifiers and basic profile information from those providers.
• Data we collect automatically — when you use the Service we may collect your IP address, device type and model, operating system, language and time zone, advertising IDs (e.g. IDFA, GAID where applicable), and other technical or usage data.

3. Purposes and legal bases for processing your personal data

We collect and use your data primarily to provide and improve the Service. Below is a summary of the purposes and lawful bases for processing your personal data.

4. With whom we share your personal data

We share information with third parties that help us operate, provide, improve and market the Service. We aim to have agreements in place that limit how these parties use your data. The types of third parties we may share information with include:

• Cloud and infrastructure: We use cloud providers (e.g. for hosting and running the Service) to store and process data.
• Analytics and performance: We may use services to monitor and analyze how the Service is used (e.g. crash reporting, usage analytics) and to measure the effectiveness of features and advertising.
• AI and content generation: To provide personalized astrological and numerological insights, we may use AI services (e.g. Google Gemini or similar). Where we send data to such providers, we do so in accordance with our agreements and applicable law; we may send only de-identified or necessary data where possible.
• Payment processing: We use payment and gateway providers to process subscriptions and payments. We do not store your full card details on our servers.
• Authentication: We may use Google, Apple or other sign-in providers to verify your identity and enable account creation.
• Communications: We may use email, push notification and in-app messaging providers to send Service-related and (with your consent) marketing communications.
• Security and delivery: We may use content delivery and security services to protect and deliver the Service.
• Advertising and marketing: We may use advertising platforms (e.g. Meta, Google, TikTok, or similar) to deliver and measure ads. These parties may collect their own identifiers (e.g. cookies, advertising IDs) as described in their privacy policies.
• Law enforcement and authorities: We may disclose personal data when required by law, or to protect our rights, safety or property, or that of users or others.
• Corporate transactions: In the event of a merger, acquisition, sale of assets or bankruptcy, your information may be transferred as part of that transaction, subject to applicable law.
• Affiliates: We may share your information with companies in our corporate group, who will use it in line with this Policy.

AI gateway and abuse protection: Some features send your messages and related context to our backend before they reach third-party AI providers. We may run automated checks to protect users and the integrity of the Service—for example, to limit attempts to override instructions or to extract internal system prompts. Depending on settings, we may log security-relevant events in a form that does not unnecessarily retain message content. Non-streaming AI responses may be additionally checked before they are returned to your app; streaming responses may not receive the same checks end-to-end.

Multi-account and free-tier abuse: Free Ask Soma messages and other limited free or promotional entitlements are meant for one person, one account. We may process and compare account identifiers (such as email fingerprints, birth-detail signatures, IP addresses, and related usage signals) to detect patterns of creating multiple accounts to bypass those limits or otherwise abuse the Service. Where our Terms allow, we may permanently ban linked accounts and retain abuse-prevention denylist entries so banned users cannot simply sign up again. See Sections 5 and 11 and our Terms (Account integrity / permanent bans).

5. How you can exercise your rights

You have the following rights in relation to your personal data:

• Access, review, update, correct: You may review and update the personal data you provided in the App (e.g. in Settings). You may also request a copy of the personal data we hold about you by contacting us via the contact or support page.
• Delete: You can delete your account and erase your personal data yourself using the in-app account deletion function (Settings → Profile → "Delete my account & erase all my data"), or request erasure by contacting us via the contact or support page. We will honour your request where we are not required or permitted to retain the data by law (e.g. for legal, tax or dispute resolution purposes). To prevent a deleted or banned account from being re-created or used to abuse the Service (including creating new accounts to bypass free-message or other usage limits), we retain a one-way, irreversible fingerprint (hash) of your email and may add the email, birth details and IP address associated with the account to an internal abuse-prevention denylist; this means the same email and birth details may not be usable to sign up again (see Section 11).
• Object or restrict: You can ask us to stop using all or some of your personal data, or to limit our use, by contacting us via the contact or support page.

EEA / UK users: In addition to the above, you have the right to lodge a complaint with a supervisory authority (e.g. in your EU Member State or, in the UK, the Information Commissioner's Office). You also have the right to data portability: you may request your personal data in a machine-readable format by contacting us.

6. Age limitation

We do not knowingly process personal data from persons under 16 years of age. If you are under 16, please do not use the Service or provide us with personal data. If you learn that someone under 16 has provided us with personal data, please contact us via the contact or support page and we will take steps to delete such data.

7. International data transfers

We may transfer personal data to countries other than the country where it was collected, in order to provide the Service and for the purposes described in this Policy. Where those countries do not provide an adequate level of data protection under your local law, we implement appropriate safeguards. For example, when we transfer personal data from the EEA or UK, we may rely on adequacy decisions, the EU-U.S. Data Privacy Framework (where applicable), or standard contractual clauses approved by the European Commission or UK authorities.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other means and give you an opportunity to review the updated policy. By continuing to use the Service after changes take effect, you agree to the revised Privacy Policy.

9. For California residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect and how we use it, the right to delete, the right to correct, the right to limit use of sensitive personal information, and the right to non-discrimination. You can exercise these rights by contacting us via the contact or support page. We do not "sell" or "share" personal information as defined under the CCPA except as described in this Policy (e.g. for advertising where you have not opted out).

California's "Shine the Light" law allows California residents to ask once per year what categories of personal information we have disclosed to third parties for their direct marketing purposes. To make such a request, contact us via the contact or support page and indicate "Request for California Privacy Information". We will respond at your email address.

10. For Virginia residents

This section supplements the Policy for residents of the Commonwealth of Virginia under the Virginia Consumer Data Protection Act (VCDPA). Sections 2 and 3 describe the categories of personal data we collect and the purposes. Section 4 describes sharing. In addition to the rights in Section 5, Virginia residents may:

• Opt out of targeted advertising: Contact us via the contact or support page to exercise this choice.
• Confirm whether we process your personal data: Contact us via the contact or support page.
• Appeal: If we decline or reject your request, you may contact us to appeal (e.g. subject line "Appeal of Refusal to Take Action on Privacy Request"). We will respond within 60 days. If your appeal is denied, you may contact the Virginia Attorney General (www.virginia.gov/agencies/office-of-the-attorney-general).

11. Data retention

We retain your personal data for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes and enforce our agreements. For example, we may retain account and usage data while you have an account; we may retain certain payment and tax-related data for longer where required by law. Even after you request deletion, a small portion of data may be retained where we have a legal obligation to keep it. In addition, to detect and prevent fraud and abuse — including multiple accounts created to bypass free Ask Soma messages, free trials, credits, or other usage limits — and to stop a deleted or permanently banned account from being silently re-created, we retain a one-way, irreversible cryptographic fingerprint (hash) of the email address associated with a deleted or banned account, and we may retain the birth details and IP address associated with the account on an internal denylist. We do this on the basis of our legitimate interests in protecting the Service and its users and enforcing our Terms (and, where applicable, to comply with law). These retained identifiers are kept only for as long as necessary for that purpose and contain no readable personal information beyond what is required to recognise a previously removed or banned account. You may contact us if you believe an identifier has been denylisted in error.

12. "Do not track" requests

Many browsers offer a "Do Not Track" (DNT) setting. This App does not currently respond to DNT signals in a uniform way. Whether third-party services we use honour DNT depends on their own policies; please refer to their privacy policies.

13. Contact us

For any questions about this Privacy Policy, your personal data, or to exercise your rights, please contact us via the contact or support page available on the AskSoma app or website. You may also request previous versions of this Policy from us.

14. For India users

If you are located in India, the following applies in addition to the rest of this Policy:

• Data protection: We process your personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act) and rules thereunder, where applicable.
• Grievance Officer: In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have designated a Grievance Officer for complaints from users in India. You may contact the Grievance Officer via the contact or support page (e.g. by selecting "Grievance Officer" or "India Complaints"). We will endeavour to respond within the timeframe required under applicable Indian law.
• Consent: Where required by Indian law, we will obtain your consent before processing your personal data for the purposes described in this Policy. You may withdraw consent where applicable by contacting us.

15. For United Kingdom users

If you are located in the United Kingdom, our processing of your personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You have the rights set out in Section 5, including the right to access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with the Information Commissioner's Office (ICO). Our legal bases for processing are as set out in Section 3. For any questions or to exercise your UK data rights, please contact us via the contact or support page.