SoulSpace Privacy Policy

Last updated: September 16, 2026

Thank you for trusting and using SoulSpace. In the sections below we speak in the first person and disclose, item by item, every arrangement we make regarding personal information: what we gather, why we gather it, with whom it is shared, how it is safeguarded, and how you may retrieve, correct or withdraw it. The application is published under the developer name City in the Clouds and is operated by KIONA MARIE CAMPBELL. Before you register an account, sign in, or continue using the application in any manner, please read this Policy in full; should you be unable to accept any part of it, you should discontinue use immediately.

(1) Scope of this Policy and our core commitments

This Policy governs the SoulSpace mobile client and its supporting web services (together, the "Application", "we", "us" or "our"). Personal information is processed by us in accordance with the principles of lawfulness, fairness, necessity, transparency and security, and only where it is directly connected to a specific function.

This Policy does not extend to services operated independently by third parties. Where you are directed from the Application to a third-party page or a third-party function, the handling of your information by that party is governed by its own privacy policy, and we recommend reviewing that document before use.

(2) The information we gather from you

Information is gathered only to the extent required to deliver the corresponding function; nothing beyond that scope will be requested. The categories involved are the following four:

1. Account and profile information. At registration and while completing your profile, the email address, nickname, avatar, gender, date of birth and region you submit voluntarily are received by us, together with any other profile content you add or edit. Without this category, an account cannot be created and other users cannot identify you.
2. Device and identifier information. So that abnormal devices can be recognised, operating faults located and different handset models supported, we record device identifiers such as device manufacturer, IMEI/MEID, MAC address and Android ID, along with the operating system version and system language environment.
3. Usage and interaction information. While the Application is in use, crash logs and performance telemetry, push tokens, message delivery status, report and appeal records, and account sign-in and operational behaviour data are recorded by us. This category allows us to reconstruct the circumstances of an incident and to preserve order on the platform.
4. Payment and transaction information. When you purchase membership benefits, payment is completed through the official Google Play Billing channel. Only essential receipts — order number, transaction status and purchased item — are received by us; your card number, payment password and payment verification codes are neither accessed nor retained by us.

(3) Why this information is used

The information we gather is employed for the five purposes below and is not applied to any purpose not stated in this Policy:

1. Function delivery. To keep registration, sign-in, profile display, chat and matching operating normally.
2. Service improvement. To locate performance bottlenecks from usage and crash data and to refine the product experience and content recommendations.
3. Security protection. To detect fraud, spam, malicious registration and account theft, and to maintain account security and platform order.
4. Customer support. To respond to your enquiries, complaints and appeals, and to process fault reports and abuse tickets.
5. Legal compliance. To perform obligations imposed by applicable laws, regulations and regulatory requirements, and to cooperate with investigations conducted in accordance with law.

(4) Third parties with whom information is shared

Your personal information is never sold, rented or otherwise traded by us. To support application functions, third-party SDKs and services are integrated, such as Adjust (attribution analytics), Sentry (crash monitoring) and Firebase Cloud Messaging (push notifications); advertising services, data analytics tools and cloud storage partners may also be used by us. Each such third-party SDK / service processes information only within the scope its function requires and remains bound by its own privacy policy. Apart from the following circumstances, no personal information is provided by us to any outside party:

1. Your separate consent or express authorisation has been obtained;
2. Minimum necessary information is supplied to a contracted partner so that payment, push or statistical functions can be completed, with equivalent confidentiality obligations imposed on that partner;
3. Disclosure is compelled by laws, regulations, judicial authorities or regulatory authorities;
4. Disclosure is necessary to protect users' personal safety, platform security or substantial public interest;
5. Information is transferred together with the relevant business in a merger, acquisition, reorganisation or asset transfer, and the recipient must continue to apply protection standards no lower than those set out in this Policy.

(5) How information is stored and safeguarded

Industry-standard security measures are adopted by us to protect your personal information, specifically:

• Transmission security: TLS/SSL encryption is enabled across the entire link so that data cannot be intercepted or altered in transit;
• Storage security: sensitive fields are encrypted at rest with AES-256, with keys managed separately from business data;
• Access control: role-based access management (RBAC) is enforced so that the internal data-access scope of personnel is limited by the least-privilege principle;
• Audit mechanism: data access logs are retained and reviewed periodically, and abnormal access triggers an immediate alert.

On this foundation, a security assessment and penetration test are organised at least once a year, personal information protection training is delivered to all staff, and an emergency response process for data security incidents has been established so that any anomaly can be quickly located, contained and reported.

As to retention, your personal information is kept only for the reasonable period required to achieve the service purpose. Once that period expires, or where continued retention is no longer required by law, the relevant data will be deleted, anonymised or de-identified by us.

(6) The five information rights you may exercise

Full control over your personal information is reserved for you. Through the in-app settings entry or the support mailbox, the following rights may be exercised in accordance with law:

1. Access. To review and confirm the account profile and related records we hold about you.
2. Correction. To rectify, supplement or update inaccurate personal information.
3. Deletion. To require deletion of your personal information, or to request account closure through the account deletion portal ; after closure the relevant data is handled by us in line with this Policy and applicable law.
4. Withdrawal of consent. To revoke at any time a consent previously given for a specific processing activity, without affecting processing already completed before the withdrawal.
5. Obtaining a copy. To require that a structured copy of your personal information be provided to you.

Beyond these five rights, you may also raise enquiries, objections and complaints regarding our processing activities. A reply will be given within a reasonable period after your identity has been verified.

(7) How this Policy is updated

Where product functions, service models, laws, regulations or regulatory requirements change, this Policy is revised accordingly, the updated version is published in an in-app announcement or on the official website, and the date at the top of the document is refreshed. Should a change affect your material rights, advance notice will be given by pop-up prompt, in-app notification or other prominent means, and your consent will be sought again where necessary.

(8) A service intended for adults

The Application is made available only to adults aged 18 or above, is not offered to minors, and personal information of minors is not actively gathered by us. If information relating to a minor is obtained because of an incorrect age entry, fraudulent registration or another unforeseen cause, then once this is confirmed the relevant information will be deleted and the corresponding account restricted from further use of the Application. For further details on child safety, please consult the SoulSpace Child Safety Standards .

(9) How to reach us

If you have questions, comments or complaints about this Policy, our processing of personal information, or the exercise of your rights, please contact us through the following channels: