Skip to content

Privacy Policy

Last updated: 31 August 2026

This service is operated by Aionlabs Private Limited, India (“we”). Contact for anything in this policy: support@soma.ninja.

What we collect and why

  1. Account & sign-in — Google sign-in (we receive your name, e-mail and avatar from Google) or an e-mail magic-link (delivered by Resend; we store your e-mail). Used to provide your account.
  2. Learning & usage data — decks, reviews, progress, points, feature usage. Used to run the service and your learning history.
  3. Payments — processed by Polar, our merchant of record: Polar is the seller, handles checkout, payment data, invoices and applicable taxes; we receive order/subscription status and never see card numbers.
  4. Hosting & infrastructure — Vercel (web hosting and the cookieless analytics below; short-lived server logs incl. IP address, for security and operations), Neon (PostgreSQL database hosting; infrastructure on AWS, US), Google Cloud Storage (audio/media delivery).
  5. Transactional e-mail — sign-in links and service notices, via Resend. No marketing e-mail without your separate consent.
  6. Usage analytics — Vercel Analytics: cookieless, aggregated page/usage metrics with no personal profiles; no advertising or cross-site tracking.
  7. Product analytics — PostHog (EU-hosted, eu.posthog.com): cookieless usage events — pages viewed, feature clicks, and aggregated interaction data (heatmaps) — to understand how the app is used and improve it. No session recording. No advertising or cross-site tracking. Basis: our legitimate interest in improving the service; you can object at any time via support@soma.ninja.
  8. Cookies — only what sign-in and session security strictly require; no advertising or analytics cookies.

AI-generated content

Songs and videos on this service are generated using AI; published media carry machine-readable C2PA provenance, and their AI origin is disclosed through visible labels or accompanying captions and platform AI labels (EU AI Act Art. 50).

Where data is processed

Our processors run in the US, the EU and Singapore (Vercel, Google Cloud, Polar, PostHog (EU), Resend); we are established in India. For users in the EU/EEA, transfers rely on EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework where applicable.

Retention

Account and learning data: life of the account, deleted within 30 days of account deletion. Server logs: up to 30 days. Payment/tax records are retained by Polar as merchant of record per applicable law.

Your rights

You can access, correct, export or delete your data — e-mail support@soma.ninja. We aim to respond within 1 day, and in any case within 30 days as required by law. EU/EEA users have the GDPR rights (Art. 15–21: access, rectification, erasure, restriction, portability, objection) and may complain to their local supervisory authority.

No profiling with legal effect; no sale of personal data.

Changes

We’ll post updates here with the date.