Privacy Policy

Soul Shift 360° is operated by Soulshift360 SRL, a company registered in Romania (the "Company," "we," "us" or "our"). Registered address and company registry number will be added on incorporation.

For GDPR purposes, we act as the data controller for the personal information we collect from you. For any privacy-related question, request, or complaint, contact us at contact@soulshift360.com.

We only collect the information we need to provide the service. The categories are:

Account & identity data. Email address, password (stored only as a salted hash), display name, and authentication tokens. Created when you sign up.

Soul Signature inputs. The personal details you provide to generate your reading — first name, birth date, birth time, birth place, focus area, current feeling, and any block or fear you describe.

Cycle data. The inputs you provide at each step of a Reality Recode™ cycle — your stated intention, identified limiting belief, somatic notes, reclaimed-fragment language, identity statement, daily anchors, and pattern interrupt.

Higher Self Concierge conversations. Text messages you send to the Concierge, and audio recordings of voice sessions you initiate. Voice recordings are speech-to-text transcribed for processing; the audio file is retained only as long as needed to deliver and review the session, and deleted on a rolling basis.

Payment data. Subscription tier, billing cycle, and transaction history. All card payments are processed by Stripe, our sole payment processor and a GDPR sub-processor. Stripe handles payment-card data directly under PCI-DSS compliance — we never receive or store your full card number, only a tokenised reference and the metadata above.

Subscriptions are only available inside the mobile app. This website does not collect any payment details from you.

Usage & device data. IP address, device type, operating system, app version, language, and basic analytics about how you use features (which screens you view, which steps you complete). We do not use third-party advertising trackers.

Some of the information you share with us — your fears, emotional states, descriptions of trauma or mental-health experiences, journal entries, or voice recordings — may reveal information about your mental or emotional health. Voice recordings can also, depending on how they are processed, be considered biometric data under GDPR.

Under GDPR Article 9, these are "special categories" of personal data and require a stronger legal basis. We process them on the basis of your explicit consent, which you give by voluntarily entering or recording them as part of the service. You may withdraw this consent at any time by deleting the relevant content or your account.

We do not analyse voice recordings for emotion or personality profiling. We do not derive a biometric identifier from your voice. Audio is processed to deliver the conversation and then deleted on a rolling basis as described above.

We process your data for the following purposes:

To provide the service. Generating your personalised Soul Signature reading, guiding you through each Reality Recode™ cycle, powering your Higher Self Concierge conversations, and producing your evolving New Identity Narrative — all rely on processing the data you provide.

To personalise your experience.Your cycle history, identity statements, and prior breakthroughs are used to make the Concierge's responses specific to you, and to expand your New Identity Narrative with each completed cycle.

To process payments. Through Stripe, to enable subscription billing and handle cancellations or refunds.

To improve the service. Aggregated, de-identified usage data helps us understand which parts of the experience work and where users get stuck.

To communicate with you. Account notifications, transactional emails (receipts, password resets, renewal reminders), and — only if you opt in — occasional product updates.

We do not sell or rent your personal data. We do notuse your journal entries, voice sessions, Soul Signature reading, or any other content you submit to train AI models, our own or anyone else's.

Under GDPR, we process your personal data on the following legal bases:

Performance of a contract (Art. 6(1)(b)) — most processing (account creation, generating readings, running cycles, powering the Concierge) is necessary to deliver the service you signed up for.

Explicit consent (Art. 9(2)(a)) — for the special-category data described above (mental-health related content, voice recordings).

Legitimate interests (Art. 6(1)(f)) — improving the service, preventing fraud and abuse, and ensuring system security. We have weighed these interests against your rights.

Consent (Art. 6(1)(a)) — for marketing communications and any other processing that goes beyond what is necessary to deliver the service. You can withdraw consent at any time without affecting prior processing.

Legal obligation (Art. 6(1)(c)) — where we are required to keep records (e.g. for tax or accounting purposes).

Your data is stored in encrypted databases hosted on MongoDB Atlas on a reputable cloud provider. Communication between your device and our servers is encrypted in transit using TLS 1.2 or higher. Passwords are hashed with an industry-standard, salted algorithm — we never see your password in plain text.

Access to user data inside the Company is restricted to personnel who need it to operate the service, is logged, and is bound by confidentiality obligations.

No system is perfectly secure. While we take reasonable technical and organisational measures appropriate to the risk, we cannot guarantee absolute security.

Breach notification. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and notify affected users without undue delay as required by GDPR Article 34.

We rely on a small number of carefully selected sub-processors to operate the service:

— MongoDB Atlas — database hosting

— Stripe — payment processing

— OpenAI and Anthropic — large-language-model and speech APIs used to generate the Soul Signature reading, parts of the cycle content, and the Higher Self Concierge responses

— Email-delivery and infrastructure providers as needed

Where we transmit your data to AI providers, we do so under their API terms (not their consumer product terms), which prohibit them from using your data to train their underlying models. AI processing is performed only on the inputs you provide, only for the purpose of generating your guidance, and only for the duration needed to return a response.

A current list of sub-processors is available on request from contact@soulshift360.com.

Soul Shift 360° serves users in the EU, US, and elsewhere. Some of our sub-processors (notably Stripe, OpenAI, and Anthropic) are based in or process data in the United States. This means EU personal data may be transferred outside the European Economic Area.

Where we transfer EU personal data to a country that has not been recognised by the European Commission as offering an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms approved under GDPR, supplemented by additional safeguards where appropriate.

We retain your data for as long as your account is active, plus a reasonable period afterward to handle any post-cancellation disputes and to meet our legal obligations.

If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain it longer (for example, payment records for tax purposes are kept for the period required by Romanian tax law). Backup copies may persist for up to 90 days before being overwritten in normal backup rotation.

Voice recordings have a shorter retention — see "Higher Self Concierge conversations" above.

You can request an export of your data (including your Soul Signature reading, cycle history, and Identity Narrative) before deletion.

Under GDPR and similar laws, you have the right to:

Access the personal data we hold about you, and receive a copy in a portable format.

Rectify any inaccurate or incomplete data.

Eraseyour data (the "right to be forgotten"), subject to legal-retention exceptions.

Restrict or object to certain processing.

Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing that already took place.

Data portability — receive your data in a structured, commonly-used, machine-readable format.

Lodge a complaint with your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

California residents have additional rights under CCPA / CPRA, including the right to know what categories of personal data we collect, the right to delete, the right to correct, and the right to opt out of any sale or sharing — note again that we do not sell or share your personal data.

To exercise any of these rights, email contact@soulshift360.com from the address on your account. We respond within 30 days, as required by GDPR.

Our website uses only essential, first-party cookies and similar storage to remember whether you have seen the welcome screen, your selected billing cycle on the pricing page, and similar functional preferences. These are strictly necessary to operate the site and do not require consent under EU rules.

We do not currently use third-party advertising, profiling, or cross-site tracking cookies. If we add analytics in the future (e.g. privacy-respecting tools such as Plausible or a self-hosted alternative), this policy will be updated and, where required, consent will be requested through a cookie banner.

Soul Shift 360° is not directed to or intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal information, contact us immediately and we will delete it.

We may update this policy from time to time. Material changes will be communicated by email to the address on your account or via in-app notification at least 14 days before they take effect. Continued use of the service after a change constitutes acceptance of the updated policy.