Scope
This policy applies to the Soultra prototype and its creator accounts. Fictional sample accounts, names, content, and metrics are used for demonstration. Release version and effective date: 2026-11-06.
What we collect
Account information (name, email, birth date), securely hashed passwords, your creator profile, content, messages, saves, feedback, bookings, applications, membership entitlements, consent history, safety reports, and technical request metadata needed for security. Payment card information is handled by a payment provider, never stored directly by Soultra.
Why
To provide features, authenticate users, protect children and community safety, support age-appropriate defaults, honor consent, resolve abuse reports, operate subscriptions, and offer data portability. No behavioral advertising or cross-app tracking is implemented.
Service providers
Local development uses SQLite on the development computer and local protected media files. Stripe handles web subscriptions only when configured. Google or Apple handles authentication only when enabled. A future production host will process encrypted requests. No analytics or marketing SDK is currently connected. Apply appropriate data-processing terms before launch.
Children
Soultra prohibits accounts for anyone under 13. Members aged 13–17 are assigned a private profile, direct messages limited to connections, and no paid gigs or bookings. Do not falsify a birth date. Report accidental underage accounts for deletion.
Your choices
Export a machine-readable data copy, withdraw optional data-sharing consent, or initiate deletion in Settings. Deletion anonymizes identity and removes personal collections, including original uploads and blocks you created. Messages other people sent, reports, and blocks they created stay. Consent records remain as type, choice, policy version, and time on the anonymized account; the stored IP address and user agent are cleared. Limited safety and audit records may remain to meet safety and legal obligations.
Marketing
Marketing consent is optional, unticked by default, and recorded separately. It does not affect core service functionality. Withdraw where offered; required service communications are distinct from marketing.
Prototype contact & retention
This local development build has no public operating entity, live privacy mailbox, or external processing beyond the optional providers you configure. Before launch, publish the accountable entity, privacy/support email, physical contact where applicable, response target, and formal retention schedule. Current demo consent and security records are retained rather than presented as legally permanent. No unsupported legal retention deadline is asserted.
International & production note
Production requires server-side access controls, encryption, retention/deletion schedules, data-processing terms, cookie/consent review, region-specific disclosures, and a designated privacy contact. This prototype document is not legal advice.