Privacy Policy

PACHIFUNK OÜ, Tornimäe tn 5, Tallinn, Harju maakond, 10145, Estonia. VAT number EE102684858. For anything about your data, email tommy@pachifunk.com.

• Account details. Your email address. If you sign in with Google, we also receive the name and email on your Google account. If you sign in with Apple, we receive the email Apple shares with us, which can be a private relay address that forwards to you.
• Provider keys. The API keys you connect. They are encrypted with AES-256-GCM before they are stored and are never shown back to you or anyone else.
• Metrics. Using those keys, we read figures such as revenue, subscriptions, active users, error rates and AI spend. We store daily totals per app. We do not store your own customers’ names, emails or payment details.
• Questions you ask. The questions you ask the in-app assistant, and the figures it reads to answer them.
• Access tokens. If you create MCP tokens, we store only a one-way hash of each token.
• Billing. If you pay on our website, Stripe handles your card. We store your Stripe customer and subscription IDs and your plan, never your card details. If you subscribe in the iOS app, Apple handles the payment. Apple tells us the plan you bought, its status and renewal date, and the subscription’s ID, which we store. We never see your payment details.
• Your iPhone. If you allow notifications in the iOS app, we store the push token Apple gives your device, so we can send it alerts. The app keeps you signed in using your device’s Keychain.
• Technical data. Our hosting provider keeps short-lived server logs, such as IP address and browser type, for security and debugging. When something breaks, we record the error in our own database so we can fix it, and delete those records after 30 days.

• To run SoulStack for you: sync your providers, score your apps, raise alerts and answer your questions. This is necessary to perform our contract with you.
• To keep the service secure and prevent abuse, which is our legitimate interest.
• To bill you and keep accounting records, as the law requires.
• To send sign-in links, alert emails about your apps (you choose which in Settings, or turn them off), and essential account emails. We do not send marketing email.
• To send alert notifications to your iPhone, if you allow them. You choose which in Settings, or turn them off.

We do not sell your data and we do not use it for advertising.

We use these service providers to run SoulStack. Each processes data only on our instructions.

• Supabase stores our database and handles sign-in. Your data is held in the EU (Ireland).
• Vercel hosts the app. Its servers run in the United States.
• Anthropic generates the assistant’s answers. Your question and the figures needed to answer it are sent to Anthropic. Under its commercial terms, Anthropic does not train its models on this data.
• Stripe processes payments on our website.
• Apple processes payments in the iOS app, delivers its notifications, and handles Sign in with Apple if you use it.
• Resend sends sign-in and alert emails from the EU.
• Google, if you choose to sign in with Google.

We may also disclose data if the law requires it.

Some providers, such as Vercel and Anthropic, process data in the United States. Where data leaves the European Economic Area, it is protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

We keep your data while your account is open. When you delete your account in Settings, we cancel any subscription made on our website and delete your account, apps, keys, metrics, alerts, tokens and devices straight away. A subscription bought in the iOS app is managed by Apple, so cancel it in your iPhone’s Settings. We delete a device’s push token when you sign out of the app, or when Apple tells us the app is no longer installed. Copies in backups are overwritten within 30 days. We keep billing records for as long as Estonian accounting law requires, currently seven years.

You can access, correct, export or delete your data, object to or restrict how we use it, and ask for a copy in a portable format. You can export everything as JSON and delete your account in Settings at any time. For anything else, email us.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.

We use only the cookies needed to keep you signed in. We do not use analytics, advertising or tracking cookies. The iOS app uses no cookies and does not track you.

Keys are encrypted at rest, access tokens are stored only as hashes, every account’s data is isolated in the database, and all traffic is encrypted in transit. SoulStack only reads from your providers and never writes to them, and we ask for the narrowest key each one offers.

SoulStack is a business tool and is not meant for anyone under 16.

If we change this policy in a meaningful way, we will tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.