Privacy, in plain language.

HelloSoul is an AI companion app for adults, operated by Sansa Group AB (Sweden). This page explains what we process, why, who helps us, and how you stay in control. Last updated 5 October 2026.

Who is responsible

The controller of your personal data is Sansa Group AB, company registration number 559111-9507, Soldathemsgatan 20, 415 28 Göteborg, Sweden. Contact us at support@hellosoul.my.

Your data is not for sale

We do not sell your personal data or conversations or use them for advertising. We require AI providers not to use your content for model training. Our OpenRouter requests restrict processing to named providers, disallow data collection and request zero data retention. Those routing controls do not apply to every service: direct voice, search and hosting services have their own contracts, security logging and retention rules. Provider security or abuse-monitoring retention is separate from the conversation history stored by HelloSoul.

What we process

Your account (email and sign-in), the name, age and time zone you give us, your conversations and calls with your companion, the memories and notes described below, pictures your companion makes and the photos, videos and links you choose to share, your settings, purchases (through Apple), reports you send to support, and the push tokens of devices where you allow notifications. If you use the optional age check, we keep Apple’s answer (adult or not) and a device key that proves it came from your iPhone. Like any online service, our servers also see your IP address and device type when you connect. Your voice is transcribed for the reply; HelloSoul doesn’t keep audio recordings. Conversations, memories and media are kept while your account is active and removed when you delete them or your account; sign-in sessions last seven days.

Who helps us

We use carefully chosen companies for hosting, AI processing (conversation, voice, pictures and looking up current facts), notifications, calls and purchases: Apple, AssemblyAI, ByteDance, Cerebras, Cloudflare, Crusoe, Google, Groq, Meta, Mistral AI, OpenRouter, Parallel, Recraft, Together AI and TypeSafe. Each receives only what its task needs. Some names identify model developers; the company hosting a model can be a different recipient. For example, our DeepSeek conversation route uses Together AI and our Kimi fallback uses Crusoe through OpenRouter. A model's name does not mean its developer receives your data. Hosting and AI providers act on our instructions where they are processors; app stores also process purchases under their own privacy terms. We require appropriate data-processing terms for processor services.

Why processing is lawful

• Account administration and delivering purchased entitlements: performance of our agreement with you (GDPR Article 6(1)(b)).
• AI conversations and the content you choose to share: your separate consent (Article 6(1)(a)). Where you choose to disclose special-category information, such as health, religion, ethnicity, political views or sexual-life information, we also request explicit consent for that processing (Article 9(2)(a)).
• Optional memory, voice, pictures, notifications and quality scoring: your choices for each purpose, with separate explicit approval before saving a sensitive memory. Device microphone and notification permissions are additional controls.
• Service security, abuse prevention and handling support reports: our legitimate interests in keeping the service safe and resolving problems (Article 6(1)(f)), subject to your rights. We minimise the data used and do not use this basis to justify optional profiling or an unrestricted use of sensitive content.
• Records that a specific applicable law requires us to retain or disclose: compliance with that legal obligation (Article 6(1)(c)).

AI processing is your separate choice

Accepting the Terms or signing in does not enable AI processing. The app asks for a separate, unchecked permission at the end of setup, before your first live conversation. If you create a custom companion, it asks before AI generates their story. This explains the content sent to AI providers, including sensitive details you choose to disclose. You can decline and still access your account settings, export and deletion. AI conversations require this permission. Memory, voice, pictures and quality scoring have separate controls; the optional permissions are not preselected for a new account. We retain the disclosure version, grant time and latest permission choices with your account to demonstrate them. Pause AI or turn off an optional purpose in Settings → Privacy & permissions. Withdrawal stops future processing for that purpose and does not make earlier lawful processing unlawful. Do not share another person's sensitive information without an appropriate basis to do so.

Processing outside the EEA

Hosting and AI processing can take place outside the EEA, including in the United States. The actual recipient and processing location depend on the service and hosting route, rather than the model developer's nationality. Transfers require a separate GDPR safeguard: an applicable adequacy decision, including the EU–US Data Privacy Framework only for a participating recipient and covered service, or the European Commission's Standard Contractual Clauses with a transfer assessment and supplementary protections where necessary. Your AI permission is not a substitute for those safeguards. Contact support for the safeguards applicable to a particular service and a copy of the relevant clauses, subject to redaction of confidential information.

Memory and notes

With memory on, your companion remembers clear everyday things you share, such as a sister’s name or an exam on Friday. The app is designed to ask for your OK before saving sensitive, unclear or conflicting memories. AI classification can make mistakes; you can inspect and remove saved memories at any time. Approving a sensitive memory explicitly permits its storage and use in future conversations and nightly notes. Before that approval, a message you choose to send is still processed for a reply and, with memory enabled, to suggest memories. The separate AI permission covers that initial processing. Each night your companion can build private notes and event follow-ups from current saved memories, rather than raw conversation text, and keep notes about her authored life so she stays consistent. You can inspect, correct or delete memories, clear the conversation, or turn memory off, which also deletes her notes.

Pictures

Your companion can make pictures in the conversation and send you one from her day now and then when you enable pictures. Choose whether to enable them, and how often, in Settings. Photos you share are used only when you choose to share them, through the system photo picker or with your camera permission. We never read your whole photo library.

Notifications and calls

If you allow notifications, your companion can send short notes and pictures, and call you at the rhythm you choose; calls use the iPhone call screen and stay out of your Recents. Notifications show your companion’s name, photo and message unless Home privacy is on. Nothing arrives during your quiet hours. Turn on Home privacy for neutral notification previews. You can change or stop all of this in Settings.

Helping us improve (optional)

If you turn on “Help improve HelloSoul”, a few of your companion’s replies and the corresponding messages you sent are submitted to an AI provider for quality scoring, up to once a night. This can include sensitive details you chose to share; the control asks for your explicit permission for this separate purpose. HelloSoul stores only numerical scores, their date and model, without your account ID or message text. The provider still processes the submitted text under its applicable terms. It is off unless you turn it on.

Your choices

Memory, voice, pictures, notifications and quality scoring each have their own controls under Settings → Privacy & permissions. The microphone is used only during a call you start or answer, and when you use talk-to-type. We don’t request your contacts or location; for questions like the weather, the home town you told us may be included in the web look-up.

Export and deletion

Use Settings → Take your story with you to export your data. Deleting your account revokes access immediately and removes your conversations, memories, notes and media from active storage. Media deletion is queued and retried if the hosting service is temporarily unavailable. Cloudflare's managed database recovery history can retain earlier copies for up to 30 days. This is separate from the provider processing and security records described above. Recovery copies are not used for ordinary conversations. If data is restored for recovery, deletion requests must be reapplied before the service resumes.

How long information is kept

• Conversations, profile, saved memories, media, age-check results, current purchase entitlements and permission records: while your account is active, unless you delete the relevant content sooner. Turning memory off stops memory use and deletes nightly notes; saved memories can be deleted separately.
• Sign-in sessions: seven days. Sign-in codes and links: five minutes. Expired credentials are removed in scheduled cleanup; authentication rate-limit records are removed after one day.
• In-app support reports: while the case is open, then 90 days after resolution or its latest case activity. Account deletion removes the in-app reports sooner. Email correspondence is separate and retained only while needed to resolve the request or establish, exercise or defend a related legal claim.
• Account-linked AI cost records: the account link is removed after 90 days, or sooner on account deletion. Numerical cost records without that link remain for accounting and service planning. Purchase-notification records are removed after 90 days; current entitlements remain with the account.
• Completed media-deletion job records: 30 days after completion. Unfinished jobs remain until deletion succeeds. A minimal revocation/deleted-account marker can remain to prevent stale credentials or delayed jobs from restoring a deleted account; it contains no conversation history.
• Built-in Cloudflare Workers request logs: up to seven days. Provider abuse, security and billing records follow the applicable service and account retention schedule, which can differ from zero-retention AI requests. Ask support for the schedule applicable to a particular request or service.

We retain information required for an applicable legal obligation only for that obligation's required period. Recovery history and third-party records are separate from deletion of HelloSoul's active account data.

Adults only

HelloSoul is for people aged 18 and over. We don’t knowingly process data from anyone younger and close accounts that appear to belong to a minor.

Automated safety checks review replies and pictures before you see them and may withhold content. If Apple’s age check reports that you are under 18, access to AI conversations is automatically closed; sign-out and account deletion remain available. A statement that an account belongs to a minor flags it for support review. If you believe a safety or age decision is wrong, contact support to request a review.

Contact

Questions or requests about your data: support@hellosoul.my.

Subject to the conditions and exceptions in data protection law, you can ask to access, correct or erase your personal data, receive a portable copy, restrict processing or object to it. Where processing relies on your consent, you can withdraw it without affecting the lawfulness of earlier processing. You can also complain to Sweden’s supervisory authority, the Swedish Authority for Privacy Protection (IMY), or your local data protection authority.