Privacy Policy

YSK Limited is the data user of personal data processed in connection with SoulMD Hub (the “Service”), including the website and the iOS and Android applications. This Policy is issued under the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region (“PDPO”) and the laws of Hong Kong. If you do not accept this Policy, you must not use the Service.

This Policy applies to registered users, guests, and any person who submits data to the Service. It does not apply to third-party websites, wallets, application stores, or model providers except to the extent we transfer data to them as described below. Those parties have their own practices, for which the Company accepts no responsibility.

Personal data are collected solely for operating, securing, billing, supporting, and moderating the Service, and for complying with applicable law. The Company does not sell personal data and does not use personal data for third-party advertising.

Certain data are necessary to provide an account, paid access, or guest quota control. If you refuse to provide such data, the Company may refuse registration, refuse a request, limit or terminate access, or decline support, without liability. Other data are voluntary. Submission of any data constitutes your consent to this Policy to the extent consent is required.

If you create an account, the Company stores your username, email address, and a hashed password. The Company also stores AI personas (“Souls”) you upload, chat messages, images you attach to chats, likes and bookmarks, records of upgrades, encrypted BYOK keys if you choose to save them, and mobile login sessions.

Guests may use limited chat without an account. The Company counts hashed Internet protocol addresses for daily guest limits and does not store the raw address for that purpose. In-application purchases are verified with Apple or Google; those stores retain their own receipts and device identifiers. Website payments may be processed by PayPal or NEAR. The Company does not represent that the foregoing list is exhaustive where logging, security, or legal process requires additional technical data.

You must not submit identity documents, health records, payment-card secrets, government identifiers, passwords of other services, trade secrets of third parties, or any other special or highly sensitive information. The Service is not designed as a repository for such information. If you submit it notwithstanding this prohibition, you do so entirely at your own risk. The Company shall have no duty to identify, segregate, encrypt beyond ordinary operations, or delete such material except as required by law, and shall have no liability for any disclosure, loss, or misuse arising from your breach of this clause.

The Company may use personal data to authenticate you, deliver chat and marketplace functions, enforce quotas and paid tiers, prevent abuse, handle support, and meet legal or regulatory demands. The Company may disclose personal data to employees and contractors under confidentiality obligations, to language-model providers that generate replies (or to your own BYOK endpoint if you enable it), to Apple, Google, PayPal, or NEAR as needed to complete a payment or restore access, to professional advisers, and to a purchaser of the Company’s business.

The Company may also disclose data where it reasonably believes disclosure is required by law, court order, law-enforcement request, or is necessary to protect the Company, the Service, or other users. The Company does not undertake to notify you of any such disclosure where notification is unlawful or impracticable.

Servers, model providers, application stores, and payment processors may process data outside Hong Kong. You expressly consent to such transfers. The Company does not warrant that the laws of any foreign jurisdiction provide protection equivalent to the PDPO. To the maximum extent permitted by law, you accept that risk as a condition of using the Service.

Souls you mark public are visible to any person, including guests. A public chat URL may be opened by any person who possesses the link. By marking content public or sharing a link, you (not the Company) make that content public. The Company is not responsible for copying, indexing, or further disclosure by third parties, nor for any consequence of your decision to publish.

Private chats are intended for the account that created them. No system is perfectly secure. The Company does not warrant that private content cannot be accessed through error, attack, legal process, or your own sharing.

You may request account deletion through website Settings or the application “Me” tab. After password confirmation the Company will, in the ordinary course, delete your login credentials, email, mobile sessions, saved BYOK keys, private chats, private Souls, likes, and the Company’s copy of payment rows. The Company does not warrant a particular deletion time except as required by law, and may retain copies in backups for a limited period or where retention is necessary for security, dispute, accounting, or legal obligation.

Public Souls remain on the Service as anonymous community content (the user attribution is removed). On-chain NFT or wallet records cannot be erased from the relevant blockchain. Apple, Google, PayPal, NEAR, and model providers keep their own records. The Company has no power to delete those records and no liability for their continued existence.

The Service is offered only to persons aged 17 years or above. The Company does not knowingly collect personal data from persons under 17. If you believe a person under 17 has an account, write to [email protected]. The Company may delete the account without notice. Except where the PDPO or other mandatory law requires otherwise, the Company owes no additional duty to minors and accepts no liability arising from under-age use that it did not knowingly permit.

Subject to the PDPO, you may request access to or correction of your personal data by writing to [email protected]. The Company may require proof of identity, charge a fee permitted by law, refuse a request that is unfounded, excessive, or not required to be honoured, and respond within the statutory period. WhatsApp and the general address are not the channel for data-access requests.

The Company may amend this Policy at any time. The date at the top is the effective date. Continued use of the Service after that date constitutes acceptance. If you do not accept an amendment, your sole remedy is to stop using the Service and delete your account. This Policy is governed by the laws of the Hong Kong Special Administrative Region.