Privacy

James Vanhecke, operating as MauTechSolutions, a Belgian sole proprietorship, Avenue Air Marshal Coningham 7, 1000 Brussels, Belgium, is the data controller for personal data processed through this service. You can reach us at support@telldearsoul.com.

Enterprise number 0785492439, VAT BE0785492439.

[needs review: whether a Data Protection Officer is required — likely, given large-scale processing of sensitive conversation data]

• Your email address, used to sign in and to contact you about your account.
• The chat export files you upload, and the text messages inside them.
• The messages you write in the app, and the replies generated for you.
• Payment records, if you subscribe. Card details are handled by Stripe and never reach our servers.

We read only text. Photos, voice notes, videos and other attachments in an export are skipped and never stored.

We count page visits, using Vercel Analytics. It records which pages were opened, roughly where in the world from, and what kind of device — enough to know whether the site works, and nothing more.

Vercel Analytics sets no cookies and does not follow you between sites. It never sees your conversations, uploads, or anything you write.

If you allow advertising measurement, we also use Meta Pixel and TikTok Pixel and Events API on the public landing page, the setup steps, and the payment confirmation page. Meta receives permitted page views and the funnel events described here, including the free limit and paywall. TikTok receives permitted page views, landing-page interest, completed registration, checkout, and a verified subscription purchase with its public plan and EUR value. Checkout is measured from a neutral redirect page, never a private chat URL. We do not send names, account details, Soul or chat identifiers, uploads, or message content to Meta or TikTok.

Meta Pixel and TikTok advertising measurement are disabled unless you choose Allow. You can refuse without losing any part of the service and change your choice from Privacy choices in the footer. Your choice is kept on this device for up to six months. Meta and TikTok may use the information under their own privacy terms, including for advertising measurement.

A conversation export necessarily contains messages written by someone who has died, and often by other living people in group chats. Neither group has agreed to this, and that deserves to be stated rather than buried.

• Messages written by the person you have lost are used to build the style profile and to answer questions about your shared past. They are stored against your account only.
• Third parties in a group conversation are pseudonymised before permanent materialisation — their names are replaced, and the replacement is what persists in the Soul's corpus.
• We do not use anyone's messages to train or improve models, ours or anyone else's.
• We do not sell, rent, or share your conversations, and there is no advertising in this product.

When you upload a group conversation, everyone's messages are read so that you can identify yourself and the person you are remembering. Unselected participants are pseudonymised and excluded from style extraction. Your consent is not treated as consent from anyone else.

[needs review: pseudonymisation reduces exposure but is not a lawful basis or an Article 9 exception. No legal opinion approving this group-import treatment exists. See docs/17 §4]

If someone has built a Soul from conversations with a person you were close to and you want to raise an objection, contact us at support@telldearsoul.com. Tell us who you are and your relationship to the person. We will acknowledge within five working days and give you a substantive answer within thirty. A person decides, not a rule.

If you are alive and your own messages appear in a conversation somebody else uploaded, that is a different and stronger case: you can ask us to erase them and we will.

[needs review: confirm the process in docs/15 §4 — in particular that an objection about a deceased person is a discretionary balancing decision, since deleting a user's conversations affects their rights too]

• Supabase — database, authentication and file storage, hosted in the EU.
• OpenAI — generates replies and builds the style profile. Sent through the API, which is not used for model training.
• Stripe — payments and subscription management.
• Vercel — application hosting, in Frankfurt.
• Vercel Analytics — counts page visits. It sees no conversation content.
• Meta — measures consented funnel events and purchase value. Private routes are replaced by a neutral paywall address, and it sees no conversation content.
• TikTok — measures consented page views, registration, checkout and verified subscription purchase value. It receives public plan metadata, but no conversation content, names, account details, or private route identifiers.

Each of them is bound by a data processing agreement that limits them to acting on our instructions.

Some of these providers are based in the United States, so some processing happens outside the EEA. Those transfers are covered by the safeguards in the same agreements.

[needs review: name the specific mechanism per provider — Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified. Both appear in these agreements and the policy should say which applies where. See docs/15 §1.2]

Your conversations and everything built from them stay until you delete them or close your account. Uploaded files are removed once they have been processed.

Backups are rotated after 30 days, so deleted data disappears from them within a month at the latest.

Invoices and accounting records are retained for 7 years, separately from your conversations.

[needs review: the starting event for those 7 years is still blank. Belgian accounting law normally runs the period from 1 January of the year following the close of the financial year, not from the invoice date — the two differ by up to a year, so the register and this page must state which applies. See docs/15 §1.3]

Deletion is available from within any chat and from your account settings. It removes every message, every uploaded file, the style profile, and the search index built from them. It cannot be undone and we keep no copy.

Deleting your account removes all of the above along with your sign-in details. Invoices are kept afterwards because tax law requires it; they record what was paid, not what was said.

You can request access to your data, correction, deletion, a portable copy, and restriction of processing, and you can object to processing. Write to support@telldearsoul.com and we will respond within one month.

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels.

[needs review: how we verify identity before acting on a request — necessary, but it must not become a barrier for a grieving user]

Conversations are isolated per account at the database level, uploaded files are held in private storage that is not publicly reachable, and message content is never written to application logs.

[needs review: breach notification commitments, and whether to state a target notification window]

This service is for people aged 18 and over. We do not knowingly collect data from anyone younger, and if we learn that we have, we delete it.

[needs review: nothing currently enforces this. Decide what to do at signup — an attested date of birth is weak, but claiming more verification than we perform is its own risk. See docs/15 §3]

[needs review: how changes are notified, and whether continued use constitutes acceptance]