Effective Date: April 29, 2026

At SOULPAD, we respect your creative autonomy and your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your data when you interact with our Platform.

1. Information We Collect (The Ingestion)

1.1. Voluntarily Provided Information:

• Account Identity: Email address, username, and authentication tokens from third-party providers (Google, Spotify, etc.).
• Author Profile: Your Pen Name, biography, profile images, and social links.
• Creative Assets: Stories, chapters, metadata, character designs, and any images or files you upload to the Platform.
• Communications: Any information you provide when contacting our support or legal teams.

1.2. Automatically Collected Information:

• Technical Logs: IP address, browser type, operating system, and device identifiers.
• Usage Metrics: Reading history, interactions (likes, follows), time spent on pages, and navigation paths.
• Cookies & Tracking: We use essential session cookies and local storage to maintain your login state and security.

1.3. AI-Generated Metadata:

• Analysis Scores: Originality percentages, sentiment analysis, and content classification tags generated by our internal AI systems.
• Assistant History: Logs of prompts and outputs generated using our AI-assisted creation tools.

2. Purpose of Data Processing

We process your data for the following legal bases:

• Contractual Necessity: To provide the core services of SOULPAD, including hosting your stories and managing your account.
• Legitimate Interests: To improve our discovery algorithms, prevent fraud, and maintain platform security.
• Content Integrity: To perform AI-driven checks that ensure the authenticity and quality of the SOULPAD library.
• Compliance: To satisfy legal obligations (e.g., tax reporting for monetized authors).

3. AI & Data Sovereignty

3.1. Training Policy: SOULPAD does not use your proprietary stories, manuscripts, or world-building notes to train "foundation" large language models (LLMs) for external sale or general distribution without your explicit, opt-in consent.

3.2. Automated Decision Making: We use AI to automate certain moderation tasks. If your content is flagged or removed by an automated system, you have the right to request a human review by contacting moderation@soulpad.app.

4. Data Sharing & Disclosure

We do not sell your personal data. We share information only with:

• Core Infrastructure: Providers like Supabase (database), Vercel (hosting), and Cloudflare (CDN) who are bound by strict data processing agreements.
• Payment Processors: Stripe or other financial partners for processing Essence purchases or author payouts.
• Legal Mandates: When required by law, subpoena, or to protect the safety of our community.

5. International Rights (GDPR / CCPA / UK-GDPR)

Depending on your location, you may have the following rights:

• Right to Access: Request a copy of all data we hold about you.
• Right to Rectification: Correct any inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of your account and associated data.
• Right to Data Portability: Export your stories and profile data in a machine-readable format.
• Right to Object: Object to our processing of your data for specific purposes (e.g., marketing).

To exercise these rights, please email privacy@soulpad.app. We will respond to all requests within 30 days.

6. Security Protocols

We employ enterprise-grade security measures, including end-to-end encryption for sensitive data and regular vulnerability scanning. However, you acknowledge that no transmission over the internet is 100% secure.

7. Children's Privacy

SOULPAD is not intended for individuals under the age of 13. If we discover we have inadvertently collected data from a child under 13, we will delete it immediately. Parents can contact us at legal@soulpad.app for concerns.

8. Data Retention & Deletion

8.1. Active Data: We retain your data as long as your account is active.

8.2. Deletion Process: Upon account deletion, your primary identifiers (email, name) and creative works are removed from our active production database within 30 days. Backups may persist for up to 90 days.

8.3. Anonymized Analytics: Aggregated, non-personally identifiable data (e.g., total view counts on a deleted story) may be retained for historical analytics.

9. Changes to the Protocol

We may update this policy to reflect changes in law or technology. We will notify you of significant changes via the Platform dashboard or email.