Privacy Policy

PACHIFUNK OÜ, Tornimäe tn 5, Tallinn, Harju maakond, 10145, Estonia. VAT number EE102684858. For anything about your data, email tommy@pachifunk.com.

• Account details. Your email address. If you sign in with Google, we also receive the name and email on your Google account. If you sign in with Apple, we receive the email Apple shares with us, which can be a private relay address that forwards to you.
• Provider keys. The API keys you connect. They are encrypted with AES-256-GCM before they are stored and are never shown back to you or anyone else.
• Metrics. Using those keys, we read figures such as revenue, subscriptions, active users, error rates and AI spend. We store daily totals per app. We do not store your own customers’ names, emails or payment details.
• How you use SoulStack. Product events such as signing up, adding an app, connecting a source, asking a question or changing plan, linked to your account ID (never your email or name). If you accept analytics cookies on our website, also the pages you visit, what you click, and a recording of your session with every text field masked. In the iOS app, the screens you open, unless you turn usage analytics off in Settings.
• Where you came from. When you first visit our website, the site that sent you, the page you landed on and any campaign tags in the link. We keep this with your account to learn which channels bring people to SoulStack.
• Stack cards you share. If you turn on a stack card in Settings, anyone with its link can see your apps’ names and health and your profit margin, plus MRR if you add it. Turn it off and the link stops working.
• Questions you ask. The questions you ask the in-app assistant, and the figures it reads to answer them.
• Access tokens. If you create MCP tokens, we store only a one-way hash of each token.
• Connected AI apps. If you connect an AI app such as Claude or ChatGPT to SoulStack, we record which app you approved and when, so you can see and disconnect it in Settings.
• Billing. If you pay on our website, Stripe handles your card. We store your Stripe customer and subscription IDs and your plan, never your card details. If you subscribe in the iOS app, Apple handles the payment. Apple tells us the plan you bought, its status and renewal date, and the subscription’s ID, which we store. We never see your payment details.
• Your iPhone. If you allow notifications in the iOS app, we store the push token Apple gives your device, so we can send it alerts. The app keeps you signed in using your device’s Keychain.
• Technical data. Our hosting provider keeps short-lived server logs, such as IP address and browser type, for security and debugging. When something breaks, we record the error in our own database so we can fix it, and delete those records after 30 days.

• To run SoulStack for you: sync your providers, score your apps, raise alerts and answer your questions. This is necessary to perform our contract with you.
• To keep the service secure and prevent abuse, which is our legitimate interest.
• To bill you and keep accounting records, as the law requires.
• To send sign-in links, alert emails about your apps (you choose which in Settings, or turn them off), and essential account emails, such as a reminder before a free trial ends.
• To send a welcome email, a few tips in your first week, and a note if your paid plan ends. Every one has a link to stop them, and you can turn them off in Settings. This is our legitimate interest.
• To send alert notifications to your iPhone, if you allow them. You choose which in Settings, or turn them off.
• To understand how SoulStack is used and improve it. Product events and the iOS app’s usage analytics are our legitimate interest, and you can turn the app’s off in Settings. Website analytics cookies and session recordings only run with your consent.

We do not sell your data and we do not use it for advertising.

We use these service providers to run SoulStack. Each processes data only on our instructions.

• Supabase stores our database and handles sign-in. Your data is held in the EU (Ireland).
• Vercel hosts the app. It runs in the EU (Ireland) and serves pages through Vercel’s global network.
• Anthropic generates the assistant’s answers. Your question and the figures needed to answer it are sent to Anthropic. Under its commercial terms, Anthropic does not train its models on this data.
• Stripe processes payments on our website.
• Apple processes payments in the iOS app, delivers its notifications, and handles Sign in with Apple if you use it.
• Resend sends sign-in emails, alerts, account emails, the weekly brief and first-week tips from the EU.
• Google, if you choose to sign in with Google.
• PostHog provides our product analytics and session recordings, hosted in the EU (Germany).

If you connect an AI app to SoulStack through our MCP connector, that app receives the figures its questions ask for, read-only. You choose to connect it, and its own privacy policy then applies to that data. You can disconnect it at any time.

We may also disclose data if the law requires it.

Some providers, such as Vercel and Anthropic, process data in the United States. Where data leaves the European Economic Area, it is protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

We keep your data while your account is open. When you delete your account in Settings, we cancel any subscription made on our website and delete your account, apps, keys, metrics, alerts, tokens and devices straight away. A subscription bought in the iOS app is managed by Apple, so cancel it in your iPhone’s Settings. We delete a device’s push token when you sign out of the app, or when Apple tells us the app is no longer installed. Copies in backups are overwritten within 30 days. We keep billing records for as long as Estonian accounting law requires, currently seven years.

You can access, correct, export or delete your data, object to or restrict how we use it, and ask for a copy in a portable format. You can export everything as JSON and delete your account in Settings at any time. For anything else, email us.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.

We use cookies to keep you signed in. These are necessary and always on. On your first visit we also set one first-party cookie, ss_attr, that remembers the site that sent you, the page you landed on and any campaign tags, so we can count which channels bring sign-ups. It holds no ID, is never shared, and lasts 90 days. Declining analytics deletes it. With your consent, we also use PostHog analytics cookies on our website to see how it is used, and to record sessions with every text field masked. We ask before setting them, and nothing is tracked if you decline. We never use advertising cookies. The iOS app uses no cookies. It sends usage analytics (which screens you open, app opens and installs, tied to your account ID) to PostHog in the EU, and you can turn this off in Settings → Share usage analytics. It never tracks you across other apps or websites.

Keys are encrypted at rest, access tokens are stored only as hashes, every account’s data is isolated in the database, and all traffic is encrypted in transit. SoulStack only reads from your providers and never writes to them, and we ask for the narrowest key each one offers.

SoulStack is a business tool and is not meant for anyone under 16.

If we change this policy in a meaningful way, we will tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.