Privacy Policy - Soulloop

1. What this notice is for

It explains which personal data we process, why, on what legal basis, with whom we share it, how long we keep it and what your rights are. It covers both products.

Controller: Soulloop Desenvolvimento de Softwares Ltda., CNPJ 35.677.330/0001-09.

Contact: privacidade@soulloop.com

2. One-page summary

Question	Short answer
Do you sell my data?	No.
Do you advertise to under-18s?	No. Not through profiling, not otherwise.
Do you train AI on my conversations?	Only with those that do not include intimate content. For under-18s, on nothing at all.
Do you record my screen?	Only for 18+, if you give us authorization, and never on journal, mood, dream or conversation screens.
Can I delete everything?	Yes, by yourself, in the app or on the site.
Do you know my age?	Yes — we need the date of birth for the chart. We use it to protect.

3. Data we process

3.1 Categories

Category	Examples
Identification	name, preferred name, email, phone
Birth	date, time and place of birth; astrological derivations
Account and use	creation date, language, time zone, preferences, usage history
Content	AI conversations, journal, mood, dreams, reading topics
Transaction	plan, subscription status, tax records
Technical	IP address, device identifiers, access logs
Campaign	source parameters (UTM, gclid) — only for 18+

3.2 Age band

We process the date of birth — already required for the astrological calculation — also to determine your age band and apply the protections in Annex F. That determination is made on our server, refreshed daily, and is the only secondary use we make of that data. It exists to restrict what we do, never to expand it.

3.3 Sensitive data

We do not have the intention to process sensitive data, but certain interactions related to journal, mood, dreams, conversations and reading topics, may contain information provided by users themselves that reveals sensitive personal data. If this occurs, processing will be limited to what is strictly necessary for the given function and will use a valid legal basis compatible with the scope of processing, ensuring that the processing is conducted in compliance with the applicable data protection legislation. We do not use this sensitive personal data for marketing, profiling or training of AI models. For under-18s, we process only the minimum needed to deliver the feature requested, with no secondary use whatsoever — no analytics, no inference, no training, no segmentation.

3.4 Data about other people

If you provide another person’s birth data (synastry, connections), we use it only for the reading requested. We discard it with the reading, or 90 days after the last viewing, whichever comes first. Similarly, we do not use this information for analytics, AI training or marketing purposes. We build no profile of that person and do not contact them. You confirm you are authorised to provide us with that data.

4. Children and adolescents

4.1 Our position

We do not exclude adolescents from the Service. We modulate the Service by age. International law, including Brazilian law — the Statute of the Child and Adolescent (ECA), LGPD Art. 14 and the Digital Statute of the Child and Adolescent (ECA Digital) — requires best interest, protection by design, privacy by default and measures proportionate to risk. Mass exclusion is none of those things.

4.2 Children (0 to 12)

They do not hold their own account. Existing accounts in that band have functionality suspended and receive no communication from us, pending the guardian’s choice between verified linkage and closure with export.

4.3 Adolescents (13 to 17)

Full astrological service, with:

the most protective privacy settings by default — no tracking, no communications, until you ask;
no advertising, offers, prices or purchases;
no advertising identifiers, session recording or intimate inference;
age-appropriate language in everything we explain;
notifications by opt-in only, at limited frequency, never between 22:00 and 07:00 in your time zone, and unsubscribable in one tap;
simple, granular controls, one per purpose — never a single button that accepts everything.

4.4 What happens on your birthday

Every day, early in the morning, we recalculate each user’s age band. On turning 18, you become able to choose what was unavailable. Nothing is switched on until you say yes.

4.5 If the date is wrong

If you gave a date that is not yours, correct it in your profile. Protections and calculations are redone immediately. We do not penalise the correction.

5. Advertising and profiling

5.1 The rule

For all users under the age of 18, profiling or behavioral analysis for targeted commercial advertising is prohibited and we do not practise it. This includes any data obtained in any age-verification process, which is used for no other purpose.

5.2 What we do with adults

Campaign measurement and conversion events to Google Ads, including campaign parameters (gclid); product analytics; marketing communications. These purposes rely on legitimate interests (LGPD Art. 7, IX or equivalent in your jurisdiction) and each has its own simple opt-out, available at any time. Where local law requires consent, it is obtained before processing.

5.3 What is not advertising

Adapting language, time zone and accessibility; telling you about a relevant astronomical event in your region; delivering the editorial content you subscribed to. This applies for every age group, as long as the purposes are purely functional or editorial and does not involve promoting products, discounts, upselling or personalized commercial pushes.

6. Purposes and legal bases

6.1 Core functionality — performance of a contract (LGPD Art. 7, V · GDPR Art. 6(1)(b))

Account, authentication and continuity; date, time and place of birth for the chart; transits, solar return and synastry; chat and the history needed to deliver responses.

For users under 18: Where local law does not allow a minor to enter into a contract, certain processing strictly necessary for providing the services may rely upon legitimate interest as the relevant legal basis, as long as the best interests of the child or adolescent, the necessity of the processing, their legitimate expectations and the appropriate safeguards have been demonstrated.

6.2 Experience — legitimate interests with safeguards (LGPD Art. 7, IX · GDPR Art. 6(1)(f))

Language and locale; editorial and contextual notifications without commercial pressure; minimised, transparent internal recommendations.

Safeguards: opt-in for under-18s; simple opt-out for everyone; no intimate, emotional or commercial inference; a documented assessment of necessity, proportionality and impact (LGPD Art. 10 §3), a summary of which you may request.

6.3 Protection, security and evidence — legitimate interests / legal obligation / exercise of rights

Minimum logs, anti-fraud, security and incidents (Art. 7, IX); tax records, payments and chargebacks (Art. 7, II); limited retention for proof and defence of rights (Art. 7, VI); age verification and compliance with Art. 14 (Art. 7, II); sanctions screening before payment (Art. 7, II and IX — Annex C).

6.4 Optional — consent (LGPD Art. 7, I and Art. 11, I · GDPR Art. 6(1)(a) and 9(2)(a))

Where applicable and necessary for specific features that require explicit user consent; cookies/SDKs; non-necessary analytics; behavioral profiling / Google Ads.

For users in the European Union and the United Kingdom, product analytics, advertising and campaign measurement, and marketing communications, where local law so requires.

Consent is reserved for the optional. We do not use it as a blanket answer for all processing of minors’ data — which would be legally fragile and would shift onto an adolescent responsibility for decisions that are ours.

6.5 Consolidated table

Certain functions and consents requirements may follow different age brackets, depending on the user’s jurisdiction and local laws

Purpose	LGPD basis	GDPR basis	Minors 13–17
Account, authentication	Art. 7, V / Art. 7, IX	6(1)(b)/6(1)(f)	✅
Chart, transits, solar return, synastry	Art. 7, V / Art. 7, IX	6(1)(b)/6(1)(f)	✅
Chat and the history needed to deliver it	Art. 7, V / Art. 7, IX	6(1)(b)/6(1)(f)	✅ protected mode
Language, time zone, accessibility	Art. 7, IX	6(1)(f)	✅
Editorial notifications	Art. 7, IX + opt-in	6(1)(f) / 6(1)(a)	⚠️ opt-in only, limited frequency
Age-band determination	Art. 7, II (Art. 14)	6(1)(c) + Art. 8	✅ mandatory
Security and anti-fraud	Art. 7, IX	6(1)(f)	✅ minimum
Payments and tax obligations	Art. 7, V and II	6(1)(b) and (c)	⛔ n/a
Sanctions screening	Art. 7, II and IX	6(1)(c) and (f)	⛔ n/a
Product analytics	Art. 7, IX	6(1)(a) + ePrivacy	⛔
Advertising and campaign measurement	Art. 7, IX	6(1)(a) + ePrivacy	⛔ prohibited
Marketing communications	Art. 7, IX	6(1)(a)	⛔ prohibited
Session recording	Art. 7, I	6(1)(a)	⛔
Intimate inferences / long-term memory	Art. 7, IX	6(1)(a)	⛔
AI model training	Art. 7, IX	6(1)(a)	⛔ never
Exercise of rights in proceedings	Art. 7, VI	6(1)(f)	✅ minimum

For data subjects under 18, the purposes of account and authentication, chart and calculations, and chat rely on legitimate interests (Art. 7, IX), per Item II.6.1.

7. Who we share with

We do not sell personal data. We share only with processors acting under our instructions, under contracts requiring confidentiality and security measures (LGPD Art. 39 / GDPR Art. 28). The complete, current list is in Annex A and at https://soulloop.com/sub-processors/.

Processor	Purpose	Location	Product	Minors
Supabase	database and authentication	Ireland (EU)	AstroLumi	✅
Google (Gemini API)	conversational engine	USA/EU	AstroLumi / Soulloop	✅ no retention for training
Meta (WhatsApp)	message delivery	global	AstroLumi	⚠️ opt-in only
Stripe	payments	USA/EU	both	⛔
Resend	transactional and editorial email	USA/EU	AstroLumi	✅ transactional / ⚠️ editorial opt-in only
Amplitude	analytics and session recording	USA	AstroLumi	⛔
Google Analytics / Google Ads	analytics and campaigns	USA	AstroLumi	⛔
MoEngage	communication and campaigns	USA/India	Soulloop	⛔
UXCam	session recording	USA	Soulloop	⛔
Firebase	authentication, messaging, diagnostics	USA/EU	Soulloop	✅ minimum, no advertising
RevenueCat	subscriptions	USA	Soulloop	⛔

8. Where your data is processed

8.1. The AstroLumi database is physically located in Ireland (European Union).

8.2. Your data may be transferred outside your country of origin to partners and suppliers necessary to run our operations, including for storage purposes. In those cases, we adopt measures consistent with the obligations of your country so that the transfer takes place in accordance with applicable law, which may include the use of standard contractual clauses and other applicable safeguards. Additional information regarding the measures applicable to each transfer may be requested through our privacy channel.

9. How long we keep data

Concrete periods in Annex B. In summary: content and profile for the life of the account plus 30 days; third-party synastry data no more than 90 days; access logs 6 months; consent records 5 years after withdrawal; tax records 5 years.

10. Your rights

10.1. Your rights depend on the law that applies to you. The data protection law of your country gives you rights over how your personal data is processed. The table below sets out the rights granted in some of the main countries where we operate. If more than one law applies to your situation, you may exercise the rights provided under each of them.

Country	Applicable rights
Brazil	confirmation that processing is taking place access to your data correction of incomplete, inaccurate or out-of-date data anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully portability to another provider deletion of data processed on the basis of consent information about the parties with whom we share data information about the option not to give consent and about the consequences of refusing withdrawal of consent objection to processing carried out under an exemption from consent review of decisions made solely on an automated basis petition against the controller before the ANPD
European Union	access to your data and to information about the processing rectification erasure restriction of processing portability objection to processing, including objection to direct marketing at any time not to be subject to a decision based solely on automated processing, including profiling withdrawal of consent at any time complaint to the supervisory authority of your Member State
United Kingdom	access to your data and to information about the processing rectification erasure restriction of processing portability objection to processing, including objection to direct marketing at any time not to be subject to a decision based solely on automated processing, including profiling withdrawal of consent at any time complaint to the ICO
Argentina	information about the existence of the database, its purpose and the identity of the controller free access to your data, at intervals of no less than six months rectification, updating and suppression confidentiality of your data removal from or blocking of your record in databases used for advertising purposes complaint to the AAIP and habeas data proceedings
Colombia	to know, update and rectify your data to request proof of the authorisation you gave to be informed of the use made of your data to withdraw the authorisation and request deletion, where no legal or contractual duty to retain applies to access your data free of charge to file a complaint with the SIC
Mexico	access rectification cancellation objection withdrawal of consent limitation of the use or disclosure of your data portability request for protection of rights before the competent authority
Venezuela	access to the data held about you to know the purpose and use of that data to request the updating, rectification or destruction of data that is inaccurate or unlawfully affects your rights judicial protection through habeas data

10.2. Response time: 15 days, or sooner where the law of your country so requires. Channel: privacidade@soulloop.com

10.3. Children and adolescents may exercise these rights directly, using plain language and through age-appropriate channels, without prejudice to the possibility of such rights also being exercised by their parents or legal guardians and to situations in which legal representation or assistance is required by law.

11. Closing your account and deleting your data

11.1 Self-service (recommended)

In the app or on the site: Profile → Privacy → Delete account. Deletion is immediate and irreversible, subject to the minimum in Annex B.

11.2 By email or WhatsApp

privacidade@soulloop.com or STOP on WhatsApp to end that channel.

11.3 What happens

Profile, birth data, derivations, conversations, journal, mood and caches are deleted within 30 days. Only the following remain: tax records (5 years), consent records, when applicable (5 years), and data under litigation.

11.4 Alternatives to deletion

Instead of deleting you may: export everything; disable channels individually; delete only the conversation history; or delete only the journal and mood entries.

12. Security

12.1. We adopt technical and administrative security measures appropriate to the risk, including encryption in transit and at rest, and we review our suppliers periodically.

12.2. Incidents: in case there is a security incident involving personal data, we notify the competent authority and affected users within statutory deadlines, according to the obligations set by the legislation. Where an incident affects a minor’s data, notification is prioritised and given in age-appropriate language.

13. Cookies and similar technologies

13.1. Categories: necessary (always on), functional, analytics and marketing.

13.2. Nothing beyond the necessary loads before your choice. For people under 18, only the necessary load — regardless of any choice made in the banner.

13.3. Your choice is recorded on our server and you may change it at any time under Privacy → Preferences.

14. Reporting and support channel

See Item I.14.3. The channel is the same for both products, visible on every page, with no login required, acknowledged within 24 hours and answered within 15 days or sooner, when required by the applicable legislation.

15. Changes to this notice

See Item I.18. Fixed date, explicit version, public archive.

Version 3.0 · 21/09/2026