Privacy Policy
Effective Date: 2026-06-12 · Version 1.1
1. Introduction
Soulbound Stories ("we", "us", or "our") operates the Soulbound Stories platform. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
By using our service, you acknowledge that you have read and understood this policy. We will ask for your explicit consent where required.
2. Data Controller
Soulbound Stories is the data controller responsible for your personal data. For inquiries about your data, contact us at privacy@soulboundstories.com.
3. Data We Collect
We collect the following categories of personal data:
3.1 Account Data
- Full name
- Email address
- Date of birth
- Authentication data (managed by Clerk — see section 7)
3.2 Content You Create
- Loved ones (names, emails, relationships)
- Automated messages (emails, media links, schedules)
- Memories and life stories
- Interview questions and answers
- Public memorial pages
3.3 Subscription Data
- Subscription tier and billing status
- Payment details (processed by Polar; we never store card data)
3.4 Usage Data
- Alive check responses and timestamps
- Consent records (what you consented to and when)
- Referral source (the invite or promotional code you signed up through, if any)
4. Purpose and Legal Basis
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Provide the core service | Performance of contract |
| Alive-check monitoring & death confirmation | Performance of contract / Legitimate interest |
| Store & deliver messages to loved ones (recipients) | Performance of contract (with you) / Legitimate interest (in respect of recipients) |
| Process payments | Performance of contract |
| Send transactional emails | Performance of contract |
| Marketing communications | Explicit consent (opt-in) |
| Gentle reminder emails about your own account | Legitimate interest (opt-out anytime in Settings) |
| Referral attribution & fraud-resistant rewards | Legitimate interest |
| Fraud prevention & security | Legitimate interest |
5. Data Retention
- Active accounts: Data is retained for the lifetime of your account.
- Subscription expiry: Content is preserved but editing is frozen. Life-critical pipelines (alive checks, death confirmation) run for up to 100 days post-expiry.
- Account deletion: Upon requesting deletion, your account is soft-deleted immediately. All data is permanently and irreversibly purged after 30 days.
- Alive check records: Automatically deleted after 30 days.
- Execution logs: Automatically deleted after 90 days.
6. Your Rights
Under GDPR, you have the following rights:
- Right of access (Art. 15): You can export all your data from Settings → Your Data.
- Right to rectification (Art. 16): You can edit your profile, loved ones, memories, and automations at any time.
- Right to erasure (Art. 17): You can delete your account from Settings → Danger Zone. All data is purged within 30 days.
- Right to data portability (Art. 20): Your data export is provided in machine-readable JSON format.
- Right to object (Art. 21): You can withdraw marketing consent at any time from Settings.
- Right to restrict processing: Contact us to restrict processing of your data.
To exercise any right, email privacy@soulboundstories.com or use the self-service tools in your dashboard.
6a. If Someone Added You as a Loved One
Our users provide us with the name and email address of the people they wish to send messages to ("recipients"). If you are a recipient, we process this limited data on the basis of our and the sender's legitimate interest in letting people stay connected. We protect your rights as follows:
- Transparency & consent: before any messages are delivered to you, we email you to confirm the connection. Nothing is sent to an unconfirmed address.
- Right to object & erasure (Arts. 21 & 17): every email we send you contains a "Remove my information" link. Using it immediately deletes your information from Soulbound Stories, across all senders, and prevents anyone from adding you again. No account is needed.
- Other rights: to access, correct, or otherwise enquire about your data, contact privacy@soulboundstories.com.
7. Third-Party Data Processors
We share data with the following processors under data processing agreements:
| Processor | Purpose | Data Shared |
|---|---|---|
| Clerk | Authentication & identity | Email, name, auth tokens |
| Polar (Merchant of Record) | Payment processing, tax collection, invoicing | Email, name, billing address, payment method details, transaction history |
| Resend | Transactional email delivery | Email addresses, email content |
| Twilio | SMS check-in reminders & phone verification | Phone number, SMS message content |
| Cloudflare (R2) | File storage for media attachments | Uploaded files (photos, videos, audio, documents) |
8. International Data Transfers
Your data may be processed in countries outside the European Economic Area (EEA). Our third-party processors (Clerk, Polar, Resend, Twilio, Cloudflare) maintain appropriate safeguards including Standard Contractual Clauses (SCCs) and industry-standard security certifications.
9. Data Security
We implement technical and organizational measures to protect your data, including:
- Encryption in transit (TLS/HTTPS)
- Encrypted database connections
- Rate limiting and abuse prevention
- Secure authentication via Clerk
- HMAC-verified webhook payloads
- Sanitized inputs to prevent injection attacks
10. Cookies
We use only strictly necessary cookies for authentication (session management via Clerk). We do not use analytics, advertising, or tracking cookies. See our Cookie Policy for details.
11. Children's Privacy
Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us immediately.
12. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Effective Date" at the top and, where required, seek renewed consent. Material changes will be communicated via email.
13. Contact Us
If you have questions, complaints, or wish to exercise your rights, contact our Data Protection team:
Email: privacy@soulboundstories.com
You also have the right to lodge a complaint with your local data protection supervisory authority.