Last updated:
Effective date:
Version: 1.0
1. Who is responsible for your data
Jonathan Fristedt AB (organisation number 559271-8000), Samaritgränd 8, 118 53 Stockholm, Sweden (“Soma”, “we”) provides the Soma platform at soma.fyi.
Questions about this policy or your personal data: support@soma.fyi Soma has not appointed a data protection officer because it is not required to; the founder is responsible for data protection.
2. The two roles Soma has
Soma processes personal data in two different capacities, and your rights work slightly differently in each.
Soma as controller. When you visit soma.fyi, create an account, become a Workspace Owner or billing contact, contact us, or receive our communications, Soma decides why and how your data is processed. Sections 3 to 9 describe this.
Soma as processor. When an organisation (our “Customer”) uses Soma to run Sessions with its employees or members, or invites them into its Workspace, that organisation is the data controller. It decides to use Soma, whom to invite and which Sessions to run. Soma processes the resulting data on the Customer’s instructions under a Data Processing Agreement. If you are a Participant or an Authorised User in a Customer’s Workspace, your employer or organisation is responsible for informing you and for handling your rights requests, and its privacy notice applies. Section 10 describes what Soma does with this data so that you can understand it even though the Customer is the controller.
3. Data we collect as controller, why, and on what legal basis
3.1 Website visitors
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Server logs: IP address, browser type, pages requested, timestamps | To operate and secure the website | Legitimate interest (Art. 6(1)(f)): running a secure website | [14] days |
| Error and performance data collected by Sentry (see Section 6) if enabled | To detect and fix errors | Legitimate interest: keeping the Service working | [90] days |
Soma does not use marketing cookies, advertising trackers or third-party analytics on soma.fyi. Only cookies strictly necessary to run the site and keep you signed in are used.
3.2 Account holders (Workspace Owners and Authorised Users)
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Name, email address, authentication identifiers, profile settings | To create and secure your account and let you sign in (via Kinde) | Performance of a contract (Art. 6(1)(b)) with you or your organisation | Until the account is deleted, then [90] days |
| Workspace membership, role, region choice | To give you access to the right Workspace | Contract | As above |
| Usage metrics (Credits consumed, feature use) | To meter subscriptions and understand how the Service is used | Contract; legitimate interest in improving the Service | [24] months, then aggregated |
| Support correspondence | To help you | Contract; legitimate interest | [24] months after the case is closed |
| Security logs (sign-ins, admin actions) | To detect abuse and investigate incidents | Legitimate interest in security | [12] months |
Basic account profiles are stored in the European Union (Google Cloud eur3) regardless of the Workspace’s chosen region.
3.3 Billing contacts
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Company name, billing address, VAT number, contact name and email, subscription and payment history, last four digits of card | To sell and invoice subscriptions and comply with tax law | Contract; legal obligation (Art. 6(1)(c)) | 7 years after the end of the financial year, as required by the Swedish Accounting Act (bokföringslagen) |
Payments are handled by Polar Software Inc. as merchant of record. Polar collects your full payment details directly and is an independent controller for the purchase transaction; see polar.sh/legal/privacy-policy. Soma never receives full card numbers.
3.4 Marketing and communications
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Email address and name of Workspace Owners and people who sign up for updates | To send product news and service announcements | Legitimate interest for existing customers (with an unsubscribe link in every email); consent (Art. 6(1)(a)) for anyone else | Until you unsubscribe, or [24] months after your last interaction |
| Service messages (billing, security, changes to terms) | To run the Service | Contract | While you have an account |
You can unsubscribe from marketing at any time. Service messages cannot be opted out of while you have an account.
4. Who we share data with
Soma does not sell personal data. We share it only with:
- Sub-processors that host and run the Service (see Section 6).
- Polar Software Inc., as an independent merchant of record for payments.
- Professional advisers (accountants, lawyers) and authorities where the law requires it.
- A buyer or successor if Soma is reorganised, merged or sold, in which case we will inform you before your data becomes subject to a different privacy policy.
5. International transfers
Soma stores account and billing data in the European Union. Some of our providers are based in, or route processing through, the United States. Where personal data leaves the EEA we rely on:
- the EU–US Data Privacy Framework for providers certified under it (Google LLC is certified; check the Sub-processor List for others); and
- the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), with supplementary measures including pseudonymisation and encryption, for all other transfers.
You can ask us for a copy of the safeguards in place for a specific provider.
6. Sub-processors
Soma uses service providers for cloud hosting, AI infrastructure, authentication, background processing and error monitoring. They act only on our instructions, under data processing agreements consistent with this Policy, and AI providers may not use your data to train their models. Our current sub-processor list, including each provider’s purpose and location, is at soma.fyi/legal/subprocessors.
7. How long we keep data
Retention periods for each category are set out in the tables above. In general:
- Account and workspace data are kept while the account exists and deleted within 90 days after the account or Workspace is deleted.
- Billing records are kept for 7 years under the Swedish Accounting Act.
- Content processed on behalf of Customers is handled as described in Section 10.
- We may keep data longer if required by law, to resolve a dispute, or to enforce our agreements, and we may keep data indefinitely once it has been anonymised so that it can no longer identify anyone.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data in certain circumstances;
- restrict processing in certain circumstances;
- data portability: receive data you provided to us under a contract or consent in a structured, machine-readable format;
- object to processing based on legitimate interest, and at any time to direct marketing;
- withdraw consent where processing is based on consent, without affecting processing before withdrawal;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. Soma does not make such decisions.
To exercise these rights, email support@soma.fyi. We will respond within one month and may ask you to verify your identity. If you are a Participant or user in a Customer’s Workspace, please contact that organisation first; we will assist it in responding.
You have the right to lodge a complaint with a supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se. You may also complain to the authority in the EU country where you live or work.
9. Security
Soma protects personal data with measures appropriate to its sensitivity, including: encryption in transit (TLS) and at rest; per-Workspace encryption keys with the ability to destroy keys so that data becomes unreadable (“crypto-shredding”); automated detection and pseudonymisation of names and other identifiers in Session content before analysis; storage of identity-linking records in a separate database from application data, with access restricted by cloud IAM conditions; role-based access controls; and audit logging. No system is perfectly secure, and we will notify affected Customers and, where required, individuals and IMY without undue delay if a breach occurs.
10. How Soma processes data on behalf of Customers (Participants and Authorised Users)
This section is for people who use Soma because their organisation has invited them. Your organisation is the controller; this section explains what happens so that the process is transparent.
10.1 What is processed. When you take part in a Session or use the Soma chat, we process what you type or say in that interaction, your name and email (to identify your account and your place in the organisation), your role and group memberships as set by your organisation, and the analysis that Soma generates. Sessions ask about how you experience your work, your organisation and your own development. Your answers may touch on sensitive matters. You choose what to share.
10.2 You are interacting with an AI. Sessions and conversations are run by an AI system, not by a human. The Service tells you this at the start of every interaction. Soma’s AI does not diagnose, rate your performance, or make decisions about you.
10.3 Pseudonymisation before analysis. Before your Session content is analysed by the AI, Soma automatically detects and replaces names, email addresses and other direct identifiers with pseudonymous tokens. The key that links tokens back to you is stored separately, in a database with restricted access, in your organisation’s chosen region.
10.4 Anonymisation of reports. Workforce Session reports delivered to your organisation are synthesised across Participants and anonymised. By design, Soma’s chat and reporting layer does not have access to who said what and cannot reverse the anonymisation. Your organisation sees themes and patterns, not your individual transcript.
10.5 Where your data is stored. Your organisation chose either the European Union or North America as its Workspace region when it set up Soma. All Session content and reports for that Workspace are stored in that region. AI inference may take place in the United States as described in Sections 5 and 6, on pseudonymised content.
10.6 How long data is kept. Your organisation controls the Workspace and can delete it. When a Workspace is deleted or the Customer’s subscription ends, Soma destroys the keys that link Session content and reports to identifiable people and to the organisation, within 30 days. What remains is anonymised interaction data that Soma may keep for research into how organisations and people develop and improve the Service. It can no longer be traced to you or your organisation.
10.7 Automated decision-making. Soma does not make automated decisions about you that have legal or similarly significant effects. Your organisation has agreed in its contract with Soma not to use Soma’s output as the sole basis for decisions about hiring, dismissal, promotion, pay, performance rating or discipline.
10.8 Your rights. Your rights under Section 8 apply, but you should direct requests to your organisation, which is responsible for answering them. Soma will support your organisation in responding. If you believe your organisation is not handling your request properly, you may contact us or IMY.
11. Children
The Service is for organisations and their adult members. We do not knowingly process data of anyone under 18. If you believe a minor has been given access, contact us and we will remove the account.
12. Changes to this policy
We will post any changes on this page with a new effective date and, for material changes, notify account holders by email or in the Service. Previous versions are available on request.
Contact Us
Questions, concerns, or rights requests: support@soma.fyi. Our address: Jonathan Fristedt AB, Samaritgränd 8, 118 53 Stockholm, Sweden.