Privacy Policy

1. Who We Are

This Privacy Policy applies to Soft to Scale LLC ("we", "us", "our"), a Wyoming limited liability company located at 30 N Gould St Ste R, Sheridan, WY 82801, United States. Soft to Scale LLC is the Data Controller for personal data processed through our Flutter mobile apps, SaaS web products, and websites (collectively, the "Services").

For any privacy question or request, contact us at [email protected].

2. What Data We Collect

2.1 Information you provide

• Account data: email address, display name, password (hashed), profile preferences.
• Billing data: name, billing address, tax ID (where applicable). Full card numbers are processed by Paddle and never stored on our servers.
• Communications: content of emails, support tickets, feedback, survey responses.
• User-generated content: items, notes, images, and other data you add inside our apps.

2.2 Information collected automatically

• Device data: device model, operating system, language, time zone, app version, crash logs.
• Usage data: pages/screens viewed, feature usage, session duration, clicks, in-app events.
• Log data: IP address, approximate location (derived from IP), access timestamps, referrer URL.
• Cookies & similar technologies (on our websites) — see section 7.

2.3 Information from third parties

• Sign-in providers (e.g., Apple, Google): basic profile info you authorize us to access.
• Payment processors (Paddle, Apple, Google): transaction status, country, and the last four digits of payment method.

3. How We Use Your Data (Legal Basis under GDPR)

Purpose	Legal Basis (GDPR Art. 6)
Provide, operate, and maintain the Services	Contract performance
Process payments, manage subscriptions, prevent fraud	Contract / Legal obligation
Authenticate you, secure accounts, detect abuse	Legitimate interest
Send service emails (password resets, receipts, updates)	Contract performance
Send marketing emails & push notifications	Consent (opt-in; withdraw anytime)
Analytics & product improvement (anonymized/aggregated)	Legitimate interest
Comply with legal, tax, and accounting obligations	Legal obligation

4. Third-Party Service Providers (Sub-Processors)

We share limited personal data with carefully selected service providers that help us operate the Services. Each provider is contractually bound to protect your data and use it only for the purposes we specify.

Provider	Purpose	Data Location
Paddle (paddle.com)	Payments, invoicing, tax compliance (Merchant of Record)	EU / US
Supabase (supabase.com)	Database & authentication hosting	EU / US
RevenueCat (revenuecat.com)	In-app subscription management (iOS/Android)	US
OpenAI (openai.com)	AI/LLM features (prompts sent to API are not used to train models)	US
Firebase (Google LLC)	Push notifications, crash reporting, analytics	US / EU
Apple & Google	App Store / Play Store transactions and distribution	US / EU

International transfers: where personal data is transferred outside your region (e.g., from the EU/UK to the US), we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by applicable law.

5. Your Rights

5.1 Rights under the GDPR (EU / UK / EEA residents)

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: ask us to limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority.

5.2 Rights under the CCPA / CPRA (California residents)

• The right to know what personal information is collected and how it is used.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information — we do not sell personal information and do not share it for cross-context behavioral advertising.
• The right to non-discrimination for exercising your privacy rights.

5.3 How to exercise your rights

Email [email protected] with the subject line "Data Request". We will verify your identity and respond within 30 days (or as required by applicable law). Most requests are free; for manifestly unfounded or excessive requests, we may charge a reasonable fee or decline to act.

6. Data Retention

• Account data — kept while your account is active. Deleted within 30 days after you request account deletion, subject to legal hold obligations.
• Billing records — retained for up to 7 years to comply with tax, accounting, and audit obligations.
• Support communications — retained for up to 3 years after closure of the last ticket.
• Analytics & logs — typically retained for 12 to 24 months in aggregated/pseudonymized form.

7. Cookies & Similar Technologies (Website)

On our websites we use the following categories:

• Strictly necessary — required for the site to function (session, CSRF). Cannot be disabled.
• Preferences — remember your settings (theme, language).
• Analytics — understand how the site is used (aggregated).
• Marketing — only set with your consent; used to measure ad effectiveness.

You can control non-essential cookies in the cookie banner (where shown) or through your browser settings.

8. Children's Privacy (COPPA)

Our Services are not intended for children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact [email protected] and we will delete such information promptly.

9. Apple App Store & Google Play Privacy

For information about the data categories each of our apps collects — as required by Apple's App Privacy labels and Google Play's Data Safety form — refer to the listing for each app in the respective store. The disclosures in this Policy apply to all our Services and are consistent with those labels.

10. Security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, access controls, regular backups, and vendor due-diligence. However, no method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Some of our Services use AI/LLMs to assist with features you invoke — these are controlled by you and do not replace human judgment.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the current version. We will notify you of material changes by email or in-app notification prior to the changes taking effect.

13. Contact & Data Protection

For privacy enquiries, data requests, or complaints:
Soft to Scale LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States
Email: [email protected]