SOULTY
Where Hearts Are Heard
PRIVACY POLICY FOR USERS
Version 1.0 | Last Updated: Oct 2026
Governed by the Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025
1. About This Policy & Legal Framework
This Privacy Policy is issued by Soulty (hereinafter “Soulty”, “we”, “us”, or “our”) and applies to all users of the Soulty platform (website, mobile application, and related services). It is drafted in compliance with:
The Digital Personal Data Protection Act, 2023 (“DPDPA”)
The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”)
The Information Technology Act, 2000 and IT (Amendment) Act, 2008
The Consumer Protection Act, 2019
Any other applicable Indian laws and regulations
By using Soulty, you acknowledge that you have read, understood, and consent to the terms of this Privacy Policy. Your Right to Privacy is protected under Article 21 of the Constitution of India (as interpreted by the Supreme Court in K.S. Puttaswamy v. Union of India, 2017). We are committed to upholding this fundamental right.
2. Identity of the Data Fiduciary
As defined under the DPDPA 2023, Soulty acts as the Data Fiduciary for personal data collected through this platform.
Soulty has voluntarily appointed a Data Protection Officer (“DPO”) to oversee data protection compliance, although this is not currently mandated by the DPDPA for entities that have not been designated as Significant Data Fiduciaries. You may contact the DPO at dpo@thesoulty.com for any data protection concerns.
2.1 Consent Manager Framework
Soulty will support Consent Managers registered with the Data Protection Board of India under the DPDP Rules, 2025, once the framework becomes operational (expected November 2026). You will be able to manage, review, and withdraw consent through a registered Consent Manager of your choice.
3. Information We Collect
3.1 Information You Provide Directly
Account Information: Name, email address, phone number, date of birth, gender, profile photo.
Payment Information: Wallet recharge details processed securely through RBI-compliant third-party payment gateways. We do NOT store card numbers or CVV details.
Communications: Content of calls and chats conducted on the platform (only with your explicit, prior, opt-in consent for recording).
Feedback & Ratings: Ratings and reviews submitted after sessions.
3.2 Information Collected Automatically
Device & Technical Data: IP address, device type, operating system, browser type, app version.
Usage Data: Features accessed, session duration, navigation patterns.
Location Data: Approximate city-level location (only with your explicit consent) to improve service delivery and match relevant Buddies.
Log Data: Timestamps, error logs, access records.
3.3 Sensitive Personal Data
4. Lawful Basis for Processing & Your Consent
Under the DPDPA 2023, we process your personal data on the following lawful bases:
Explicit Consent (Section 6, DPDPA): For collecting and processing your personal data to provide our services. Consent is obtained at the time of account creation and before any recording of sessions.
Certain Legitimate Uses Without Consent (Section 7, DPDPA): Where processing is necessary for: (i) compliance with any law or court order; (ii) response to a medical emergency involving a threat to life; (iii) ensuring safety during a disaster or breakdown of public order; or (iv) purposes related to employment (where applicable).
Contractual Necessity: To fulfil our obligations under the Terms of Use.
You have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw consent:
In-App: Use the “Privacy Settings” section in your account settings to withdraw consent with a single tap — as easy as giving consent.
Email: hello@thesoulty.com
Via Consent Manager: Once the Consent Manager framework is operational (see Section 2.1).
5. How We Use Your Information
We use your personal data strictly for the following purposes:
To provide, operate, and improve our emotional support services.
To match users with suitable Buddies.
To process payments and manage wallet transactions.
To ensure platform safety, quality monitoring, and compliance.
To send service-related communications, notifications, and updates.
To comply with legal obligations under Indian law.
To conduct anonymised research to improve mental wellness services (using irreversibly de-identified data — see Section 5.1).
To prevent fraud, misuse, and harmful conduct on the platform.
5.1 Anonymisation Standard
When we refer to “anonymised” data, we mean data that has been irreversibly de-identified such that it cannot be linked back to any individual, whether directly or through combination with other data. Our anonymisation process removes all direct identifiers (name, phone, email) and applies aggregation techniques to prevent re-identification. Anonymised data is no longer “personal data” under the DPDPA 2023.
6. Conversation Privacy & Confidentiality
6.1 User-Buddy Conversations
All conversations are private and confidential between you and your Buddy.
Calls and chats may be recorded ONLY with your explicit, prior, opt-in consent for quality assurance and safety purposes. You will be notified before recording begins and may decline.
Recorded conversations are stored on encrypted servers and accessible only to authorised Soulty personnel.
Conversation content will NOT be shared with third parties except as required by law.
Buddies are strictly prohibited from recording, screenshotting, or storing conversation content outside the platform — this constitutes a serious breach and grounds for immediate termination and potential legal action.
6.2 Anonymity Options
You may choose to remain anonymous — no real name is required.
Buddies see only the information you choose to share.
You may use a pseudonym for all interactions.
6.3 Mandatory Exceptions to Confidentiality
We may disclose information without your prior consent ONLY in the following circumstances:
When required by a court order, law enforcement, or applicable law.
When necessary to prevent imminent harm to you or others (e.g., suicidal crisis, abuse).
To protect the rights, property, or safety of Soulty, users, or the public.
In all such cases, we will disclose only the minimum information necessary and, where legally permissible, notify you of such disclosure.
7. Data Sharing & Disclosure
7.1 We Do NOT Sell Your Data
Soulty will never sell, rent, or trade your personal information to third parties for commercial or marketing purposes.
7.2 Permitted Sharing
Service Providers: Payment processors (e.g., Razorpay), cloud storage, analytics tools — all under strict contractual agreements compliant with DPDPA 2023 Section 8(2) and DPDP Rules 2025.
Legal Compliance: Disclosure to law enforcement, courts, or regulators as required under Indian law.
Business Transfers: In the event of a merger, acquisition, or sale of assets, with continued privacy protections and at least 30 days’ prior notice to you.
Safety & Crisis: To emergency services or crisis helplines where there is imminent risk to life.
7.3 Third-Party Data Processors
All third-party processors handling your data are bound by valid contracts (per DPDPA Section 8(2)) that require them to:
Process data only on Soulty’s documented instructions.
Implement appropriate technical and organisational security measures.
Not transfer data outside India without adequate safeguards (see Section 13).
Assist Soulty in fulfilling data principal rights requests.
Delete or return all personal data upon termination of the processing relationship.
8. Data Security
We implement industry-standard and legally required security measures:
Encryption in transit: SSL/TLS encryption for all data transmitted to and from our servers.
Encryption at rest: AES-256 encryption for data stored on our servers.
Conversation encryption: All conversations are encrypted in transit and at rest. We are progressively implementing end-to-end encryption across all communication channels and will update this policy once full E2E encryption is available.
Regular security audits and penetration testing.
Strict access controls — only authorised personnel can access personal data.
Multi-factor authentication for internal systems.
Data breach detection and response protocols.
However, no system is 100% secure. We cannot guarantee absolute security.
8.1 Data Breach Notification
In the event of a personal data breach affecting your rights:
We will notify the Data Protection Board of India promptly and in accordance with the timelines prescribed under the DPDP Rules, 2025 (Rule 7).
We will notify affected users without unreasonable delay, providing details of the breach, likely consequences, and remedial measures taken.
We maintain an internal breach register documenting all incidents, assessments, and corrective actions.
8.2 Data Protection Impact Assessments
Given that Soulty processes sensitive emotional and mental health data, we conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including the introduction of new features, changes to data sharing practices, and deployment of automated decision-making systems. This is a best-practice measure that will become mandatory if Soulty is designated a Significant Data Fiduciary.
9. Data Retention
We retain your personal data only for as long as necessary for the stated purpose or as required by law:
Account Data: Retained while your account is active and for 30 days after account deletion to facilitate any pending requests or disputes.
Conversation Records: Retained for up to 12 months for quality, safety, and legal purposes, then securely deleted.
Crisis & Incident Records: May be retained longer as required for legal compliance and safety review.
Financial Records: Retained for 7 years as required under Indian tax and accounting laws.
Monitoring/QA Records: Retained for a maximum of 12 months, then securely deleted.
After account deletion, all personal data is removed within 30 days, except where legal retention is required (e.g., financial records for 7 years). Anonymised data (which is no longer personal data) may be retained indefinitely for research purposes.
10. Your Rights Under the DPDPA 2023
10.1 Right of Access (Section 11, DPDPA)
You have the right to obtain confirmation of whether we process your personal data and to access a summary of such data. Submit requests to privacy@thesoulty.com We will respond within 30 days.
10.2 Right to Correction & Erasure (Section 12, DPDPA)
You may request correction of inaccurate personal data or erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
10.3 Right to Grievance Redressal (Section 13, DPDPA)
You may raise a grievance with our Grievance Officer at grievance@thesoulty.com We will acknowledge your grievance within 24 hours and resolve it within 30 days. If unsatisfied, you may escalate to the Data Protection Board of India.
10.4 Right to Nominate (Section 14, DPDPA)
You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, in accordance with the DPDPA 2023.
10.5 Right to Withdraw Consent (Section 6(6), DPDPA)
You may withdraw consent at any time via account settings (one-tap withdrawal in the “Privacy Settings” section) or by writing to privacy@thesoulty.com. This will not affect the lawfulness of processing prior to withdrawal.
Additional Rights We Voluntarily Offer
11. Children’s Privacy
Soulty is strictly intended for users who are 18 years of age or older. We do not knowingly collect or process personal data of minors (persons under 18 years of age).
If we discover that a minor has provided personal information, we will delete it immediately and terminate the associated account.
If you are a parent or guardian and believe your child has provided information to Soulty, please contact support@thesoulty.com immediately. We take child protection seriously and will act promptly.
12. Cookies & Tracking Technologies
We use cookies and similar technologies for the following purposes:
Essential Cookies (Session Management): To keep you logged in securely. These are strictly necessary and do not require separate consent.
Analytics Cookies: To understand app usage and improve performance using anonymised data. These require your explicit opt-in consent.
Personalisation Cookies: To remember your preferences. These require your explicit opt-in consent.
When you first access the Soulty platform, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies. You may change your preferences at any time through the “Privacy Settings” section in your account. Disabling certain cookies may affect platform functionality.
13. International Data Transfers
Your personal data is primarily stored on servers located within India. Any international transfer of data will only occur where:
The transfer is to a country or territory notified by the Central Government under Section 16(1) of the DPDPA 2023 as permitting such transfers.
You have provided explicit, informed consent for the transfer.
The transfer is necessary for compliance with applicable law.
We will notify you of any international data transfers and ensure that adequate safeguards are in place as prescribed under the DPDPA 2023 and DPDP Rules 2025.
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in law, technology, or our services. We will provide at least 30 days’ prior notice of significant changes via email and in-app notification. Your continued use of Soulty after the effective date of changes constitutes acceptance of the updated policy.
If changes are material and affect your rights (including changes to data collection, sharing, retention, or processing purposes), we will seek fresh consent where required under applicable law.
. Contact Us & Grievance Redressal
Your trust is everything to us. We are committed to protecting your privacy and your fundamental Right to Privacy.