This Privacy Policy (this “Policy”) explains how Soulcial Tech Limited (“Soulcial”, “we”, “us”, or “our”) collects, uses, stores, transfers, and shares personal data when you use the Soulcial mobile application, website, and related services (collectively, the “Service”).

We are committed to handling personal data in accordance with the laws of the Hong Kong Special Administrative Region, including the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and its Data Protection Principles.

By creating an account, accessing, or using the Service, you acknowledge that we may process your personal data as described in this Policy. If you do not agree to this Policy, please do not use the Service.

This Policy is provided in English and Traditional Chinese. If there is any inconsistency or ambiguity between the two versions, the English version shall prevail.

1. Who we are

Soulcial Tech Limited
Hong Kong Special Administrative Region

For privacy enquiries, complaints, or requests relating to personal data, please contact us at:

Email: support@soulcial.co
Social: @soulcial.dating

2. Scope and important notes

This Policy applies to personal data we process when you:

• register for or log in to the Service;
• create, complete, or use a profile;
• interact with other users, including matching, meetups, limited in-app chat (where enabled), and reporting;
• purchase tickets, add-ons, memberships, recurring plans, or other paid features, where offered;
• contact customer support or otherwise communicate with us; and/or
• complete identity verification (KYC), where required or offered.

When we ask you to provide personal data, some fields may be mandatory and others optional. We will generally indicate this at the point of collection. If you do not provide personal data that is required for a particular feature or process, we may be unable to create or maintain your account, provide the relevant feature, process a transaction, or complete safety or verification checks.

This Policy does not apply to third-party services that you use independently, such as Apple App Store, Google Play, payment networks, device operating systems, or social media platforms. Those services are governed by their own terms and privacy policies.

3. Personal data we collect

Depending on how you use the Service, we may collect the following categories of personal data:

3.1 Account and identifier information

• phone number, which may be your primary login identifier;
• email address, where provided, for backup login, contact, or account support purposes; and
• account identifiers and basic account metadata reasonably necessary to operate the Service.

3.2 Profile information you provide

• display name and profile details you choose to provide, such as gender, relationship intentions, languages, and profile preferences;
• date of birth, age range, or age eligibility information, including the outcome of age checks;
• profile biography, answers to prompts, and other profile content; and
• preferences relevant to meeting, such as meetup types, availability, and related selections.

3.3 Photos and media

• profile photos and other media you upload; and
• related metadata reasonably necessary to store, display, secure, review, and moderate those uploads.

3.4 Location data (with your permission or as needed for the feature)

If you grant location permission or use location-dependent features, we may collect:

• precise device location at the time you choose to share it with us, such as GPS coordinates; and/or
• approximate area information derived from your device location or other information you provide, such as district or broad area labels.

You can manage location permissions in your device settings. If you disable location, some features may not function properly.

3.5 Messaging, meetup, and interaction data

To operate the Service, we may collect:

• interaction signals, such as likes, skips, matches, replies, meetup option selections, and related actions;
• meetup-related details and status, such as proposal, confirmation, rescheduling, cancellation, attendance, or disputes, to the extent needed to schedule and manage meetups;
• limited in-app chat messages and timestamps, where such functionality is available; and
• safety-related interactions, such as reports, appeals, and enforcement outcomes.

3.6 Safety, trust, and moderation data

To help keep the Service and community safe, we may process:

• moderation or risk signals relating to profile content, conduct, or misuse of the Service;
• reports made by users and supporting materials submitted in connection with those reports, where applicable; and
• internal review outcomes, such as warnings, restrictions, suspensions, and related audit logs.

3.7 Payment, ticket, and subscription or membership information

If you use paid features, we may process and store information such as:

• purchase amounts, currency, product type, payment status, and timestamps;
• payment, order, ticket, customer, subscription, membership, or transaction reference identifiers; and
• ticket balances, order status, and usage records needed to provide the purchased feature.

We do not store full payment card numbers or CVV details. Payment card data is handled by the relevant payment provider.

3.8 Identity verification (KYC)

To enhance safety and reduce fraud, fake accounts, or abuse, we may require or offer identity verification. We may use third-party verification providers, such as Veriff or similar providers.

Such providers may process:

• images of identity documents;
• selfies, liveness checks, or video-based verification steps; and
• limited identifiers needed to link the verification result to your Soulcial account, such as your Soulcial user ID and, where applicable, your email address.

We may store limited verification data for eligibility, audit, safety, and account administration purposes, such as:

• verification status and timestamps;
• reference or session identifiers; and
• date-of-birth, age-band, or age-eligibility outcomes where provided to us.

Unless expressly stated otherwise in the Service, we do not store full raw identity document images or selfie media in our own database.

3.9 Device, app, and technical information

We may collect limited technical information necessary to operate, secure, and improve the Service, such as:

• device model, operating system, app version, language settings, and other app or device configuration information relevant to functionality; and
• logs relating to security, abuse prevention, authentication, troubleshooting, and debugging.

3.10 Crash reports and diagnostics

To maintain the stability, security, and performance of the Service, we may collect crash reports and diagnostic data when the app crashes, fails, or encounters errors. This may include:

• the time of an error or crash, app state, and error or stack trace information;
• device and app details relevant to diagnosing the issue;
• limited usage signals or breadcrumbs leading up to the issue, such as which screen was opened; and
• identifiers needed to associate a report with your session or account where reasonably necessary for troubleshooting, security, or abuse investigations.

We aim to limit such diagnostics to what is reasonably necessary for reliability, security, and debugging. Crash reports are not intended to collect the content of your private communications. However, in limited situations, diagnostic logs may capture information submitted shortly before an error, such as text entered into a form. You should avoid submitting unnecessary sensitive personal data through the Service.

3.11 Customer support and communications

If you contact us, we may collect:

• your name, account identifiers, and contact details;
• the content of your enquiry, complaint, or request; and
• records of our communications with you and any materials you choose to send us.

4. How we use your personal data

We use personal data for purposes directly related to providing, operating, securing, supporting, and improving the Service, including the following:

4.1 To provide and operate the Service

• create, maintain, and administer accounts and profiles;
• provide matching, meetups, and related user features;
• enable limited in-app chat where applicable;
• display profile information to other users as part of the Service’s core functionality; and
• process account settings, permissions, and user preferences.

4.2 To maintain safety, trust, and platform integrity

• verify age or identity where required or offered;
• detect, prevent, and investigate fraud, spam, scams, harassment, prohibited content, or misuse of the Service;
• review content, reports, disputes, and appeals;
• enforce our Terms, community rules, and safety policies; and
• protect users, our personnel, and the Service.

4.3 To process payments and provide customer support

• process transactions and provide paid features;
• maintain billing, ticket, subscription, membership, and order records;
• handle payment issues, refunds, disputes, and related support matters; and
• respond to enquiries, requests, complaints, and operational communications.

4.4 To maintain, analyse, and improve the Service

• monitor reliability, service quality, and operational performance;
• troubleshoot, debug, and fix errors;
• analyse crash reports and diagnostic logs to improve stability, security, and performance; and
• develop, test, and improve existing or new features, including through aggregated or de-identified insights where practicable.

4.5 For legal, compliance, and risk management purposes

• comply with applicable laws, lawful requests, and regulatory requirements;
• maintain records for accounting, audit, insurance, legal, and risk-management purposes; and
• establish, exercise, or defend legal claims where necessary.

We will not use your personal data for a new purpose that is unrelated to the original purpose of collection or a directly related purpose unless permitted by law or we obtain any consent required under applicable law.

5. What other users may see

The Service is social by nature. Depending on your settings and how the Service operates at the time:

• other users may see profile information, preferences, prompts, and photos that you choose to display;
• we may show approximate area information, such as district or broad area, rather than your precise location;
• meetup counterparties may see information reasonably necessary to arrange or attend a meetup; and
• contact handles or similar contact information will only be shown where the relevant feature requires mutual action, mutual consent, or equivalent in-service conditions, where applicable.

Please consider carefully what you choose to share.

6. Direct marketing

We do not currently use your personal data for direct marketing, such as mass promotional email, SMS, or similar promotional outreach.

If we wish to do so in the future, we will comply with the PDPO and other applicable requirements before using your personal data for direct marketing, including by providing the required notice, obtaining any required consent or clear indication of no objection, and giving you a free and convenient opportunity to opt out. Silence or non-response will not be treated as consent where the law requires a positive indication.

7. How we share your personal data

We do not sell your personal data.

We may share personal data only to the extent reasonably necessary for the purposes described in this Policy, including with the following categories of recipients:

7.1 Infrastructure, hosting, and product operations

Service providers that host or support our databases, cloud storage, authentication systems, analytics, delivery systems, and other core infrastructure components, including providers such as Supabase and related infrastructure partners.

7.2 Payments and commerce

Payment processors, payment facilitators, app stores, or commerce partners that help us process purchases, subscriptions, memberships, tickets, refunds, and related transactions, including providers such as Stripe, Apple App Store, and Google Play where applicable.

7.3 Identity verification providers

Third-party KYC or identity verification providers, such as Veriff or similar providers, where identity verification is offered or required.

7.4 Push notifications and essential communications

Providers that help us send service-related notifications and operational communications, such as push notification vendors like OneSignal or similar providers. These providers may process device tokens, device identifiers, and user identifiers needed for delivery.

7.5 Content moderation, translation, and safety tooling

Providers that help us detect prohibited content, enforce platform safety rules, moderate profile text or submitted content, or provide translation features, including providers such as OpenAI for moderation and DeepL for translation where such features are enabled.

7.6 SMS and email delivery providers

Providers used to send one-time passwords, verification codes, login notices, account notices, receipts, or other essential communications, including providers used through our authentication or communications stack, such as Twilio via Supabase where applicable.

7.7 Professional advisers and authorities

Our lawyers, accountants, auditors, insurers, banks, and other professional advisers where reasonably necessary, and courts, regulators, law enforcement agencies, government authorities, or other third parties where disclosure is required or permitted by law.

7.8 Error monitoring and diagnostics providers

Third-party providers that help us monitor crashes, bugs, incidents, and service reliability. These providers act on our behalf and are expected to process diagnostic data only for the purposes described in this Policy.

7.9 Corporate transactions and business reorganisation

In connection with an actual or proposed merger, acquisition, financing, investment, asset sale, restructuring, or transfer of all or part of our business, personal data may be disclosed to counterparties, professional advisers, and transaction participants, subject to appropriate confidentiality and lawful handling requirements.

Where we engage service providers or data processors, we take reasonably practicable steps, including contractual or operational safeguards where appropriate, to require them to protect personal data in a manner consistent with this Policy and applicable law.

8. Cross-border transfers

Our service providers and partners may store or process personal data on servers or systems located outside Hong Kong.

By using the Service, you understand that your personal data may be transferred to, stored in, or processed in jurisdictions outside Hong Kong where our providers or systems operate.

Where appropriate, we seek to adopt reasonably practicable safeguards, such as using reputable providers and contractual or organisational measures, having regard to the nature of the data and the circumstances of the transfer.

9. Data retention

We do not keep personal data longer than is necessary for the purposes for which it was collected or for directly related purposes, unless longer retention is required or permitted by law.

In deciding how long to retain personal data, we may consider factors such as the nature and sensitivity of the data, the purpose for which it is held, legal and regulatory requirements, accounting and audit obligations, safety and fraud-prevention needs, dispute handling, and whether deletion, anonymisation, or de-identification is reasonably practicable.

In general:

• Account and profile data: retained while your account is active and, where reasonably necessary, for a limited period thereafter for account recovery, dispute handling, safety review, fraud prevention, or compliance purposes.
• Safety and trust records: retained as reasonably necessary to maintain safety, prevent repeated harm, investigate misuse, and handle disputes or enforcement issues.
• Payment, ticket, membership, and accounting records: retained as necessary for accounting, audit, tax, legal, and operational compliance.
• Verification results and audit references: retained as reasonably necessary for eligibility, safety, fraud prevention, audit, and compliance purposes.
• Logs, crash reports, and technical records: retained for a limited period reasonably necessary for security, abuse prevention, troubleshooting, diagnostics, and service improvement, and then deleted, aggregated, anonymised, or de-identified where practicable.

If you request account deletion, we will take reasonable steps to delete, anonymise, or de-identify personal data, subject to legal obligations, security needs, fraud prevention, dispute handling, backup limitations, and other legitimate business purposes.

10. Data security

We take reasonably practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. Such measures may include, where appropriate:

• access controls, permissions management, and authentication safeguards;
• encryption in transit and other technical security measures;
• least-privilege access for personnel and service providers;
• monitoring, logging, and incident-response processes; and
• contractual and operational controls for relevant vendors and processors.

No method of transmission over the internet or electronic storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

11. Your rights under the PDPO

Subject to the PDPO and any applicable exemptions, you may have the right to:

• request access to personal data we hold about you; and/or
• request correction of personal data that is inaccurate, incomplete, or misleading.

To make a request, please contact support@soulcial.co and provide sufficient information for us to verify your identity, authority, and the scope of your request.

We may charge a reasonable fee for complying with a data access request, limited to the direct cost of compliance, where permitted by law.

Where the PDPO permits us to refuse or limit a request, we may do so and will give reasons where required.

If you are not satisfied with our handling of your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”).

12. Children and under-18 users

Soulcial is intended only for persons aged 18 or above.

We do not knowingly collect personal data from persons under 18 for use of the Service. If we become aware that an under-18 person is using the Service, we may suspend or terminate the relevant account and take appropriate steps in relation to associated personal data, subject to legal obligations and operational requirements.

13. Updates to this Policy

We may update this Policy from time to time.

If we make material changes, we will take reasonable steps to notify you, for example through the app, the website, or other appropriate means, and we will indicate the updated effective date.

Your continued use of the Service after the updated Policy takes effect constitutes acceptance of the updated Policy. If you do not agree to the updated Policy, you should stop using the Service.

14. Contact us

For privacy enquiries, complaints, or requests relating to personal data:

Email: support@soulcial.co
Social: @soulcial.dating