Privacy Policy

The protection of your personal data is important to us. We process your data exclusively within the framework of applicable legal provisions, in particular the General Data Protection Regulation (GDPR).

This Privacy Policy informs you about the data we collect, how we use it, and what rights you have.

Responsible for data processing:

We collect and process personal data only to the extent necessary to provide our service. The following data categories may be processed:

a) Account Data

• Email address
• Name (optional)
• Account settings

b) Platform Connection Data

• OAuth (a secure login standard that never shares your password with us) access tokens for connected social media platforms (e.g. Instagram, Facebook, YouTube)
• We do not store passwords for the respective platforms

c) Content Data

• Public comments from connected social media profiles
• These are processed exclusively to provide SoulVeil's core functionality

Public comments from connected social media profiles are processed for real-time classification. The full comment text is NOT permanently stored — only the classification result and metadata are retained (see Section 8).

For the purpose of behavioral pattern detection, we store metadata about comment authors (publicly visible username, platform user ID, assigned harm category, impact score, and timestamp). This data relates to third parties (the comment authors) and is processed on the basis of the legitimate interest of the account holder in protection against harmful interaction patterns (Art. 6(1)(f) GDPR). No comment text is stored.

This content may contain personal data, particularly in connection with publicly visible profile information (e.g. username, profile picture, or other published information).

Access to content takes place only to the extent that this is necessary for technical processing within the scope of the service.

d) Usage Data

• Interactions with the platform
• Filter settings
• Dashboard activities

e) Device Data

• IP address
• Browser type and version
• Operating system
• Time of request
• Approximate location data (country level)

We process data for the following purposes:

• Provision and operation of the SoulVeil service
• Analysis of content for potentially harmful content and interaction patterns
• Generation of summary presentations of online interactions
• Ensuring system security and abuse prevention
• Communication related to the user account
• Fulfillment of legal obligations

Important note:

Processing serves exclusively to support the user in dealing with online content. No medical or psychological diagnosis is made.

We note that, despite careful technical implementation, complete detection or filtering of all potentially distressing content cannot be guaranteed.

To provide our services, we use artificial intelligence technologies (Anthropic Claude API) for the automated classification of comments into psychological harm categories.

Comments are classified by category (e.g. identity attacks, emotional manipulation, boundary violations), impact severity (1–10), and confidence level. The classification result is stored; the comment text itself is not.

No automated decisions within the meaning of Art. 22 GDPR with legal or similarly significant effects are made.

Comment content submitted to Anthropic for classification is not used to train Anthropic's AI models, in accordance with Anthropic's commercial API terms.

The analyses provided serve exclusively as supportive information and do not replace human judgment or professional advice.

When you connect your social media account (e.g. Instagram, Facebook, YouTube) to SoulVeil:

• we only access data you have authorized
• we limit ourselves to content required for the function (e.g. comments)
• we do not access private messages, contacts, or financial data

You can revoke access at any time:

• via the settings of the respective platform
• or via your SoulVeil account

After revocation, further data collection will cease.

Processing is based on the following legal bases:

• Art. 6(1)(b) GDPR — performance of a contract
• Art. 6(1)(f) GDPR — legitimate interest in the secure, stable, and functional provision of our service, as well as in protecting against misuse and harmful interactions
• Art. 6(1)(a) GDPR — consent, in particular when linking external accounts
• Art. 6(1)(c) GDPR — legal obligation

• Account data: until account deletion
• Classification data (category, impact score, confidence score, author identifier, timestamp, comment reference): up to 12 months
• Full comment text: not permanently stored; retrieved live from the respective platform on demand ('Reveal' function)
• Waitlist data (email address, signup source, timestamp): until launch or until deletion is requested
• Usage data: up to 90 days
• Backups: deleted within 90 days

In individual cases, complete deletion may be delayed for technical reasons (e.g. in backups), but will take place no later than within the time limits stated above.

Personal data is only disclosed:

• to technical service providers (e.g. hosting, infrastructure, or AI providers)
• as required by legal obligations

We do not sell personal data and do not use it for advertising purposes.

To provide our services, we use the following external service providers:

• Hosting: Contabo GmbH (server operations in Germany)
• AI services: Anthropic (Claude API) for automated comment classification

Where necessary, these service providers process data exclusively on the basis of data processing agreements in accordance with Art. 28 GDPR.

Processing takes place only within the scope of the functional provision of our service.

We use technically necessary cookies required for the operation of the platform (e.g. for authentication, session management, and system security).

In addition, technically required storage mechanisms may be used that are necessary for the stability and functionality of the service.

Should additional cookies or technologies be used in the future (e.g. for analytics purposes), this will only take place on the basis of corresponding consent.

The use of Anthropic (Claude API) for comment classification may result in data being transferred to the USA.

In such cases, the transfer takes place exclusively on the basis of appropriate safeguards, in particular the Standard Contractual Clauses approved by the European Commission.

We take appropriate technical and organizational measures to protect your data:

• Encryption (TLS)
• Access restrictions
• Security monitoring

In the event of a data breach, we will notify the competent authorities and affected users in accordance with legal requirements.

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) — see our Data Deletion Instructions
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, contact us at: contact@soulveil.app

You have the right to lodge a complaint with a data protection supervisory authority.

In Germany, the competent authority is the Federal Commissioner for Data Protection and Freedom of Information (BfDI) or the relevant state authority.

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or new features.