SoulDot is the data controller responsible for your personal data. Contact us at privacy@souldot.co for any privacy-related enquiries, access requests, or complaints.

2.1 Data You Provide Directly

• Account information: Full name, email address, mobile phone number, and password (stored as a one-way bcrypt hash).
• Conversation content: Messages you send to AI Counselors. This content may include sensitive personal data relating to your mental, emotional, and psychological health.
• Payment information: Billing details processed by our payment provider (we do not store card numbers).
• Survey responses: Intake survey answers used to recommend counselors.

2.2 Data Collected Automatically

• Usage data: Timestamps, session duration, feature interactions, and subscription status.
• Device and access data: IP address, browser type, and device identifiers collected via standard server logs.

2.3 Sensitive Personal Data

Conversation content may constitute sensitive personal data under the PDPA 2010 to the extent it relates to your physical or mental health. We process this data solely to provide the Service and implement enhanced security measures for its protection.

We process your data for the following purposes:

• To create and manage your account and authenticate access;
• To provide the AI Counselor service, including generating contextual responses and maintaining conversation continuity;
• To process subscription payments and manage billing;
• To send transactional communications (password resets, account notices);
• To generate compressed session summaries to improve counseling continuity within and between your sessions;
• To detect and respond to safety concerns (e.g., crisis signal detection);
• To comply with legal obligations and enforce our Terms of Service;
• To improve, secure, and maintain the platform.

We do not use your conversation content for advertising, profiling for commercial sale, or training AI models without your explicit separate consent.

Under the PDPA 2010, we process your personal data on the following grounds:

• Consent: You provide explicit consent at registration by accepting these Terms and Privacy Policy;
• Contractual necessity: Processing is necessary to provide the Service you have subscribed to;
• Legitimate interests: To secure the platform, prevent fraud, and ensure service continuity;
• Legal obligation: To comply with applicable Malaysian laws and regulatory requirements.

We do not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. We disclose your data only in the following circumstances:

• Service providers: To trusted third-party processors who assist in delivering the Service (see Section 6);
• Safety and legal compliance: Where we reasonably believe disclosure is necessary to prevent serious harm, comply with a legal obligation, or respond to lawful requests from Malaysian authorities;
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections;
• Consent: Where you have expressly authorised disclosure.

To deliver the Service, we engage carefully selected third-party service providers acting as data processors on our behalf. These providers are bound by confidentiality obligations and are permitted to use your data only for the specific purposes we authorise. The categories of providers we use include:

• AI processing: Providers that generate AI Counselor responses. Your conversation messages, which may include sensitive content, are transmitted to these providers solely to produce your session responses.
• Payment processing: Providers that handle subscription billing and payment transactions. We do not store your payment card details directly.
• Email delivery: Providers that send transactional emails such as password resets and account notices.
• Cloud infrastructure and database hosting: Providers that host our servers, database, and application infrastructure. All account and conversation data resides on their systems under our direction and control.

These providers may process your data in countries outside Malaysia. Where such international transfers occur, we take reasonable steps to ensure that the receiving party provides a comparable level of data protection. By using the Service, you consent to such transfers as necessary to deliver the Service to you.

We review our service providers periodically and update our arrangements as needed. We do not authorise any provider to sell or further disclose your data for their own commercial purposes.

We retain your personal data for as long as your account remains active and for a period of two (2) years following account closure, after which data is anonymised or securely deleted. Compressed session summaries are retained for the duration of your account to support counseling continuity. You may request earlier deletion of your account and data as set out in Section 8 below. Some data may be retained longer where required by applicable law or for the resolution of disputes.

Subject to the PDPA 2010, you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you;
• Right of correction: Request correction of inaccurate or incomplete data (many fields are editable directly in Settings);
• Right to withdraw consent: Withdraw consent at any time, which may require account closure;
• Right to account deletion: Request deletion of your account and associated personal data.

To exercise any of these rights, contact us at privacy@souldot.co. We will respond within 21 days as required under the PDPA 2010. We may require identity verification before processing your request.

We implement technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit;
• Bcrypt hashing for stored passwords (no plaintext passwords stored);
• JWT-based authentication with server-side token verification;
• Strict user-level data isolation: each user's conversation data is inaccessible to other users;
• Role-based access controls limiting internal staff access to personal data.

No method of transmission over the internet is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

Your conversation content is processed by our AI systems to generate supportive responses and to create compressed summaries ("session summaries") that allow continuity across sessions and between AI Counselors. These summaries remain associated with your account only. No other user can access your conversations or summaries. AI Counselors are explicitly instructed never to disclose one user's information to another.

SoulDot uses session-based authentication tokens stored in your browser's local storage. We do not use third-party advertising cookies or tracking pixels. Standard server access logs are maintained for security and performance monitoring. If you clear your local storage, you will be required to sign in again.

The Service is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will immediately terminate that account and delete the associated data. If you believe a minor has registered, please contact us at privacy@souldot.co.

Your personal data may be transferred to and processed in countries outside Malaysia where our service providers maintain servers. By using the Service, you consent to such transfers. We take reasonable steps to ensure that overseas recipients provide a standard of data protection comparable to the PDPA 2010.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice within the Service. Continued use of the Service after the effective date of changes constitutes your acceptance of the revised Policy.

If you have a complaint regarding our handling of your personal data, please contact us first at privacy@souldot.co. If your complaint is not resolved to your satisfaction, you may refer it to the Department of Personal Data Protection Malaysia (PDPD).

For all privacy enquiries, data access requests, or complaints:

Email: privacy@souldot.co
Legal: legal@souldot.co