Privacy Policy

Who We Are

My Soul Purpose Ltd (“we”, “us”, “our”) operates the My Soul Purpose platform at mysoulpurpose.co.uk. We are the data controller responsible for your personal data.

Registered address: My Soul Purpose Ltd, registered address available upon written request to dpo@mysoulpurpose.co.uk. We are in the process of establishing a formal registered office address which will be published here once confirmed.

ICO Registration Number: ZC099847
Data Protection Officer: dpo@mysoulpurpose.co.uk

Special Category Data — Please Read This First

We process this sensitive data only with your explicit consent, given separately at the point of assessment. We use it solely to generate your personalised results and to power the tools within your dashboard. We will never use it for advertising, commercial profiling, or any purpose beyond delivering your personal My Soul Purpose experience.

You may withdraw your explicit consent at any time. See Your Rights below.

What Data We Collect

Account data

Your name and email address when you create an account.

Assessment data

The answers you provide during the Soul Mirror assessment, including information about your life experiences, values, passions, and personal history. This data is used to generate your soul type results, purpose statement, soul report, and 90-day plan.

Dashboard data

Mood entries you record, journal entries you write, Mirror Check responses, Reframe tool entries, and progress data within your 90-day plan.

Payment data

Subscription and billing information processed securely by Stripe. We do not store your full card details. Stripe retains transaction records for legal and tax compliance purposes.

Usage data

Anonymous data about pages visited and session duration, collected via Vercel Analytics. This data is aggregated and cannot be used to identify you.

Communications data

Emails we send you including your results, daily plan emails, account notifications, and any marketing communications you have opted into, processed via Resend.

Communication preferences

Your selected preferences for how and whether you wish to receive communications from us, including daily plan emails, platform notifications, and marketing messages.

How We Use Your Data

We use your personal data solely to provide and improve the My Soul Purpose service:

• To generate your soul type results, purpose statement, soul report, and 90-day plan based on your assessment answers.
• To personalise your dashboard including daily affirmations, journal prompts, and tool recommendations.
• To send your daily Soul Purpose Alignment email if you have opted in to receive it.
• To send you service emails including account notifications and subscription management communications.
• To send marketing communications only where you have given explicit consent.
• To maintain the security of your account and the platform.
• To improve the platform based on anonymised usage patterns.

Your data is never sold to third parties. We do not use your personal data for advertising.

AI Processing

Some features within the My Soul Purpose platform use artificial intelligence to generate personalised content. This includes elements of your soul type results, affirmations, and guidance content within certain platform tools including The Reframe.

To provide these features, certain inputs — such as your soul type, selected options within tools, and mood data — are transmitted to Anthropic's API, which powers the AI generation. Anthropic acts as a data processor on our behalf under a Data Processing Agreement.

Anthropic is based in the United States. This transfer is made under Standard Contractual Clauses approved under UK data protection law, which provide appropriate safeguards for the protection of your data. Under our agreement with Anthropic, your data is not used to train their AI models.

We do not transmit your full journal entries or free-text assessment answers to Anthropic without your explicit knowledge. Where any free-text input is used to generate AI responses within a tool, this is clearly indicated at the point of use.

International Data Transfers

Some of our third-party service providers process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place:

• Anthropic (United States) — Standard Contractual Clauses (SCCs).
• Stripe (United States) — adequacy decision and Standard Contractual Clauses.

All Standard Contractual Clauses used are the ICO-approved versions applicable under UK data protection law.

Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

Explicit consent (Article 6(1)(a) and Article 9(2)(a))

You give your explicit consent when you complete the Soul Mirror assessment and create an account. This is the legal basis for processing your assessment answers, journal entries, mood data, and any other sensitive personal information you share with us. You may withdraw this consent at any time.

Contract (Article 6(1)(b))

Processing necessary to provide the service you have subscribed to, including delivering your results, maintaining your dashboard, and processing your subscription.

Legitimate interests (Article 6(1)(f))

We process limited usage data to improve the platform, ensure security, and prevent fraud. We have conducted a Legitimate Interests Assessment confirming these interests are not overridden by your rights and freedoms.

Legal obligation (Article 6(1)(c))

Where we are required to retain data by law, including financial records for tax and accounting purposes.

Automated Processing

Your soul type results are generated by an automated algorithm based on your assessment answers. This automated processing does not produce any legal or similarly significant effects on you. It is a reflective personal development tool.

No automated decisions are made about you that affect your access to services, your rights, or any external outcome. You have the right to request human review of your results at any time by contacting dpo@mysoulpurpose.co.uk.

Data Storage and Security

Your data is stored on Supabase servers located within the European Union. All data is encrypted at rest and in transit using HTTPS encryption. We apply row-level security policies to ensure your data is accessible only to you and to authorised platform functions.

We conduct regular security reviews and take all reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure.

In the event of a data breach likely to result in a risk to your rights or freedoms, we will notify you without undue delay and will report to the ICO within 72 hours as required by law.

Data Retention

Account data

Retained for the duration of your active account, plus 90 days following account closure or deletion request, then permanently deleted.

Assessment data, soul type results, journal entries, and mood data

Retained for the duration of your active account. You may delete individual entries at any time from within your dashboard. All data is permanently deleted within 30 days of account closure or a deletion request.

Payment and transaction records

Retained for 7 years from the date of transaction in compliance with HMRC requirements. Only transaction records are retained — not full card details.

Anonymised usage analytics

Retained in aggregate anonymised form for up to 24 months. This data cannot be used to identify you.

Emails and communications

Retained for the duration of your account, then deleted within 30 days of account closure.

Your Rights

Under UK data protection law, you have the following rights. To exercise any of them, contact dpo@mysoulpurpose.co.uk. We will respond within 30 days. We will never charge you for exercising your rights.

• Right of access — request a copy of all personal data we hold about you.
• Right to rectification — request correction of any inaccurate personal data.
• Right to erasure — request deletion of your personal data within 30 days, except where we are legally required to retain it.
• Right to portability — receive your personal data in a structured, machine-readable format.
• Right to restriction — request that we limit how we process your data while a complaint or correction is being resolved.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw your consent for sensitive data processing at any time by contacting us or deleting your account. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent for assessment data processing, we will no longer be able to provide your personalised platform experience.
• Rights in relation to automated processing — request human review of any automated processing.

Cookies

Please see our full Cookie Policy for details of every cookie we use and how to manage your preferences. In summary:

• Strictly necessary cookies — essential for authentication and platform function. No consent required.
• Analytics cookies — Vercel Analytics. Consent requested via cookie banner on first visit.
• No advertising cookies, tracking cookies, or cookies that share data with third parties for commercial purposes.

Third-Party Processors

All third-party providers have Data Processing Agreements in place:

• Stripe — payment processing. stripe.com/gb/privacy
• Supabase — database hosting and authentication, EU servers. supabase.com/privacy
• Vercel — website hosting and analytics. vercel.com/legal/privacy-policy
• Anthropic — AI content generation. US-based, SCCs in place. anthropic.com/privacy
• Resend — transactional and daily email delivery. resend.com/legal/privacy-policy

Children

My Soul Purpose is intended for users aged 18 and over. We do not knowingly collect or process personal data from anyone under the age of 18. If we become aware that we have collected data from a person under 18, we will delete it immediately.

If you are under 18 and are going through a difficult time, please reach out for support. Childline is free, confidential, and available 24 hours a day: call 0800 1111 or visit childline.org.uk.

Changes to This Policy

We may update this policy to reflect changes in the law or our data practices. We will notify you of any material changes by email and by displaying a notice on the platform. The date at the top of this policy reflects when it was last updated.

Complaints

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113 | Website: ico.org.uk

We would welcome the opportunity to resolve any concern directly. Please contact us first at dpo@mysoulpurpose.co.uk.