Privacy Policy of the SoulSteps platform

Effective Date: 02.07.2026; Last Updated: 02.07.2026

1. General Provisions

1.1. This Privacy Policy (the "Policy") describes what personal data is collected by Kateryna SoulSteps, Stüssistrasse 105, 8057 Zürich, Switzerland (the "Operator," "we") in connection with the operation of the SoulSteps platform (the "Platform"), how it is used, stored, shared with third parties, and protected.

1.2. By using the Platform, the user agrees to the processing of their personal data as described in this Policy. If the user does not agree with the Policy, they must stop using the Platform.

1.3. This Policy applies to all users of the Platform — both Clients and Specialists.

2. What Data We Collect

2.1. Data provided directly by the user:

first name, last name, display name;
email address, phone number;
profile photo;
date of birth (upon Client registration, if required to personalize services, such as preparing a natal chart);
information about professional experience, certificates, and a description of practice (for Specialists);
content of messages exchanged between Client and Specialist through the Platform's chat;
reviews and ratings;
data voluntarily provided in messages or a pre-session questionnaire (e.g., the topic of the client's request).

2.2. Payment-related data:

We do not store bank card details. Payments are processed through our payment provider, Stripe, which collects and stores card data in accordance with its own privacy policy and the PCI DSS standard. The Operator only has access to: the fact of payment, the amount, the date, the transaction status, and the last 4 digits of the card (for payment verification purposes).

2.3. Data collected automatically:

IP address, browser type and version, device, operating system;
cookies and similar technologies (see Section 8);
data on pages visited, time spent on the site, and referral source;
city/region-level geolocation (based on IP address), where applicable.

2.4. Special categories of data. Given the nature of the Platform (esoteric practices), a Client may voluntarily disclose information about their health, religious beliefs, or worldview during messaging or a session. We do not deliberately request such data and do not use it for automated decision-making; its processing is limited to the purpose of providing the requested service.

3. Purposes of Data Processing

We process personal data in order to:

create and maintain a user account;
enable the booking, payment, and delivery of sessions between Client and Specialist;
collect and allocate the Platform's commission, and maintain financial and tax records;
review Specialist applications before a profile is published;
facilitate communication between the user and the Platform (notifications, support);
prevent fraud and violations of these Terms of Service;
improve the site's operation and analyze Platform usage;
comply with legal requirements (tax reporting, requests from government authorities).

4. Legal Basis for Processing

Depending on applicable law (such as the GDPR), data is processed on the following legal grounds:

performance of the contract (Terms of Service) with the user;
the user's consent (e.g., for marketing emails or optional cookies);
the Operator's legitimate interests (security, fraud prevention, service improvement);
compliance with legal requirements (accounting and tax reporting).

5. Disclosure of Data to Third Parties

5.1. We do not sell personal data to third parties.

5.2. Data may be shared with the following categories of recipients:

Stripe (USA/EU) — for processing payments and payouts to Specialists. Privacy policy: stripe.com/privacy;
Sharetribe (Finland, EU) — the technology provider on which the Platform operates (hosting, storage of account, listing, and message data). Privacy policy: sharetribe.com/privacy-policy;
SendGrid (Twilio) (USA) — for sending transactional email notifications (registration confirmation, booking notifications). Privacy policy: twilio.com/legal/privacy;
Google Analytics (USA) — for analyzing site usage and improving its performance. Data is collected in anonymized form. Privacy policy: policies.google.com/privacy;
government authorities — upon official request, as required by law.

5.3. Clients and Specialists can see a limited set of each other's data (name, profile photo, message content) necessary to conduct a session.

6. International Data Transfers

The Platform is registered in Switzerland and operates in accordance with the Swiss Federal Act on Data Protection (nDSG/revDSG). Since the Platform's users may include residents of EU/EEA countries, the Operator also takes into account GDPR requirements with respect to the processing of their personal data.

Our providers Sharetribe (Finland, EU), Stripe, and SendGrid/Twilio (USA) may process data on servers located in the EU and the USA. Transfers of data to the USA are carried out on the basis of Standard Contractual Clauses (SCCs) or other mechanisms provided for under applicable law, in accordance with the privacy policies of the respective providers.

7. Data Retention Periods

7.1. Account data is retained for as long as the account exists, and is deleted or anonymized within 90 days after account deletion, except for data that must be retained longer under tax or accounting law requirements (typically 5 years for financial records).

7.2. Correspondence related to a completed session may be retained longer for the purpose of resolving disputes regarding service quality or refunds.

8. Cookies

8.1. The Platform uses cookies and similar technologies to:

ensure the site functions properly (essential cookies);
remember user preferences;
analyze site usage;
(where applicable) display relevant content.

8.2. Upon a user's first visit to the site, a banner is displayed allowing them to accept or restrict optional cookies. Cookies can also be managed through browser settings.

9. User Rights

With respect to their personal data, users have the right to:

request access to their data and a copy of it;
request correction of inaccurate data;
request deletion of their data ("right to be forgotten"), except where retention is legally required;
restrict or object to processing in certain cases;
request data portability in a machine-readable format;
withdraw consent to processing (where processing is based on consent) without affecting the lawfulness of processing carried out before withdrawal;
lodge a complaint with the data protection supervisory authority in their country.

To exercise these rights, please contact us using the details provided in Section 12.

Users in Switzerland may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch. Users in EU/EEA countries may contact their country's data protection supervisory authority.

10. Data Security

10.1. The Operator takes reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction (encryption of data in transit, restricted employee access, use of certified providers such as Stripe for payments).

10.2. No system can guarantee absolute data security; in the event of a data breach that could cause harm to users, the Operator will notify affected users and the relevant authorities as required by applicable law.

11. Data of Minors

The Platform is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If we become aware that such data has been collected, it will be deleted.

12. Contact

For questions regarding the processing of personal data and to exercise the rights described in Section 9, please contact:

Email: soulsteps.office@gmail.com
Address: Stüssistrasse 105, 8057 Zürich, Switzerland

13. Changes to This Policy

The Operator reserves the right to update this Policy. The current version is always available on the Platform, along with the date of its last update. Users will be notified separately of any material changes (for example, by email).