Privacy Policy

1. Two kinds of information

Your own account: when you sign up for Soopaly, ask for a system, or run one, we decide how your account information is used, and this policy explains how.

A business's records: a business that runs its system on Soopaly keeps its own records here, such as its staff, clients, orders, stock, bookings and invoices. We hold and process those records only to run that business's system and follow its instructions. If your details are in a business's system, ask that business first; we will help it answer you. You can also write to hello@soopaly.com.

2. What we collect

• Account details: your name, email address and password. Passwords are stored only in scrambled (hashed) form by our sign-in provider; we never see them.
• Sign in with Google: if you choose it, Google shares your name, email address and profile picture with us. We ask Google for nothing else: no contacts, no files, no Gmail.
• What you tell us about your business: your answers in the discovery questions, any description you write in your own words, and your requests for changes.
• What you keep in your system: the records you and your team enter, plus files and photos you upload.
• Payments: card payments are handled by Stripe. We never see or store your full card number; we keep only the payment reference and amount.
• Technical information: the cookies that keep you signed in, your light or dark display choice (saved in your own browser), and the standard request logs our hosting provider keeps, such as IP address and browser type.

We do not use advertising or tracking cookies, we do not show ads, and we never sell or rent personal information.

3. How we use it

• To create your account, sign you in and keep your account secure.
• To design your system, show you a demo, prepare a proposal and recommend a price.
• To run your system, including sending the emails it needs, such as invitations and notices.
• To take payment and keep the financial records the law requires.
• To answer your questions and give you support.
• To find and fix problems and to prevent abuse.

4. How we use AI

If you describe your business in your own words or use Ask AI, the text you write is sent to Anthropic, the maker of the Claude AI, so it can suggest answers to our questions. Anthropic uses that text only to give us the answer and, under its business terms, does not use it to train its models.

The AI only suggests. Every suggestion is checked against fixed rules, and nothing it says becomes part of your system, your price or your settings until you confirm it. If the AI is unavailable, Soopaly works without it.

5. Information from Google

We use the name, email address and profile picture Google shares only to create your Soopaly account and sign you in. We do not use them for advertising, we do not sell them, and we share them only with the service providers listed below, only as needed to run Soopaly.

Soopaly's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Who helps us run Soopaly

We use these companies to run the service. Each one gets only what it needs to do its job for us:

• Supabase: accounts and sign-in, the database, and stored files (United States).
• Vercel: hosting of the website and app (United States).
• Anthropic: the AI that reads a description you write in your own words or answers Ask AI.
• Stripe: card payments.
• Resend: sending email from Soopaly.
• Cloudflare: the soopaly.com domain and forwarding of email sent to us.
• Google: Sign in with Google, when you choose it.

We may also share information when the law requires it, to protect people's safety or our rights, or as part of a sale or merger of our business (in which case this policy keeps applying to your information).

7. How we protect it

• All traffic to Soopaly is encrypted (HTTPS).
• Each business's records are kept apart by rules enforced inside the database itself, so one business can never read another's.
• Within a business, people see only what their role allows.
• Only a small number of Soopaly staff can reach production systems, and only to run and support them.

No system is perfectly secure. If a breach affects your information, we will tell you without undue delay.

8. Where it is kept and for how long

Your information is stored in the United States. We keep it while your account or your business's system is active.

If you ask us to delete your account, we delete it, or remove anything that identifies you, within 30 days. The exceptions are records the law requires us to keep, such as invoices and payment records. A business that stops using Soopaly can ask us for a copy of its records before we delete them.

9. Your choices and rights

• See your information: ask us for a copy.
• Correct it: update it in Soopaly, or ask us to.
• Delete it: ask us to delete your account.
• Take it with you: ask us for a copy you can use elsewhere.
• Object or limit: ask us to stop using your information for a purpose.
• Disconnect Google: remove Soopaly from your Google Account's third-party access page at any time.

Write to hello@soopaly.com for any of these. We answer within 30 days. Depending on where you live (for example California, the EU or the UK), you may have more rights; we honor them too, and we will not treat you differently for using them.

10. Children

Soopaly is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect information from children.

11. Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change is significant, we will also email account holders before it takes effect.

12. Contact us

Soopaly is run by SooGi Group. Questions or requests about your privacy: hello@soopaly.com.