Last updated: September 22, 2026

Privacy Policy

Soyo is an invitation-only hangout platform. We collect only what we need to seat you in the right experiences, we do not sell your data, and we say plainly below where AI is involved. This policy applies to users in Canada and the United States.

1. Who We Are

Soyo is a local community hangout platform operated by 1598025 B.C. LTD., a corporation registered in British Columbia, Canada. References to “Soyo,” “we,” “us,” or “our” in this policy mean both the platform and its operating company.

For all privacy questions, contact team@joinsoyo.com.

2. Information We Collect

We collect three categories of information:

You give us directly

  • Name, email, and password (or Google/Apple sign-in identifier)
  • Your taste profile: interests and activities you say yes or no to, preferred times of week, preferred cities, group-size preferences, comfortable languages, and how you like to show up in a group
  • Activity requests: when you use the Activity Explorer, the days you are free, a time of day, the kinds of experience you want, and any note you type. Each request is kept as its own record and used to create activities and to understand what you reach for over time.
  • Sex/gender and relationship status — optional, used only to compose balanced, comfortable groups (see Section 3)
  • Vibe photos — optional pictures that show your life, shown to your confirmed tablemates and read by an AI model to understand your interests (Section 4)
  • Phone number and date of birth — collected before your first confirmed seat, used for safety, accountability, and confirming the 18+ requirement; never shown to other users
  • A safety self-declaration regarding criminal history, made by every member when they join (see Terms §32) — kept confidential, used only for platform-safety decisions
  • Host details if you host: community name, bio, photos, and social links. Venue details if you are a local business: photos, address, room details
  • Messages you send — group chats, direct messages, and host threads — and any photos you post in them

Created automatically

  • Invitations sent to you, your replies (accept / pass / waitlist), and friend-invitation links you create or claim
  • Attendance and reliability records (confirmed seats, check-ins, no-shows) — these affect which invitations you receive
  • Post-hangout feedback you give and receive (ratings and reasons) — private to Soyo, never published
  • In-app notifications and activity timestamps
  • Device + browser metadata sent automatically by your client (IP address, user agent, approximate location based on IP)
  • Cookies and local-storage tokens for authentication and UI preferences

From third-party services

  • Stripe — payment status, holds, and Stripe Connect account state. Card details never touch our servers.
  • Google / Apple Sign-In — name, email, and avatar when you choose those sign-in options.

3. Categories of Personal Information We Collect (CCPA)

For California residents, the following table categorizes our data collection per the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). We collect categories A, B, D, F, G, and K below; we do not collect biometric identifiers or precise geolocation data.

  • (A) Identifiers — name, email, phone, date of birth, IP address, account ID
  • (B) Customer records — payment-related metadata via Stripe (no card details on our servers)
  • (D) Commercial information — invitations, confirmed seats, purchase and booking history
  • (F) Internet activity — pages viewed within Soyo, in-app actions
  • (G) Geolocation — preferred cities and neighbourhoods (self-selected, city-level only — never device GPS)
  • (H) Audio/visual — photos you upload (avatar, vibe photos, photos posted in chats)
  • (K) Inferences — interests and preferences derived from your taste answers, vibe photos, activity requests, and activity, used to decide which invitations to send you and which activities to create

Sensitive personal information: with your consent, we collect sex/gender and relationship status, and (for hosts) a criminal-history self-declaration. These are used solely to compose comfortable, balanced groups and to keep the platform safe. Sex is visible only to your confirmed tablemates on your first-name card; relationship status and the safety declaration are never shown to other users. We never sell or use sensitive information for advertising, and you can decline or remove it at any time. We do not collect biometric identifiers (our photo analysis reads interests and settings, not faces or identity) and we do not collect precise geolocation.

4. How We Use Your Information

  • Run the core product: create accounts, compose hangouts, deliver invitations, confirm seats, run group chats, send notifications.
  • Process payments, holds, and payouts via Stripe.
  • Detect and prevent fraud, spam, chargebacks, no-show abuse, and platform abuse.
  • Improve the product through aggregated, non-identifying usage statistics.
  • Send transactional emails and push notifications about your invitations and confirmed hangouts.
  • Comply with legal obligations and enforce our Terms.

Automated matching (AI)

Soyo's core feature is automated: software — including AI models — builds a private taste profile from your answers, preferences, availability, reliability record, and post-hangout feedback, and uses it to decide which invitations to send you and how to compose groups. This selection is automated processing of your personal information. It determines which invitations you receive; it never produces legal effects, pricing differences, or penalties. You can ask us to explain a matching outcome, correct the underlying data, or have a human review it by emailing team@joinsoyo.com.

AI photo reading

If you add vibe photos, an AI vision model (provided by Anthropic, a US-based processor) analyzes them to infer lifestyle interests — “hiking, coffee, live music” — that improve your matches. The model does not identify faces and we do not build biometric templates. Photos of venues uploaded by local businesses are analyzed the same way to describe rooms. Adding photos is optional, and deleting a photo removes it from future analysis.

Notifications, quiet hours & CASL

Push notifications are limited to your own activity — an invitation, a confirmed group, a reminder, a message. By default we send nothing to your lock screen between 10pm and 8am in your timezone except genuinely urgent items. You can silence notification families in Settings → Alerts. Any marketing email we ever send will comply with Canada's Anti-Spam Legislation (CASL): sent only with your consent, identifying us, and with a working unsubscribe that we honour within 10 days. Transactional messages (receipts, confirmations, security notices) are not marketing and are sent as needed.

We do not sell your personal data. We do not share personal information for cross-context behavioural advertising. We do not run third-party advertising on Soyo.

5. Who Sees What

  • Your confirmed tablemates: your first name, sex, and vibe photos (on the room's minimal card), plus anything you post in that group chat. Never your full name, contact details, or profile.
  • Your host: for their own hangout, your name, email, phone number and the sex you gave, plus seat status and attendance — what it takes to run the room and reach you about it.
  • Public (hosts only): if you host, your community name, bio, photos, and past hangout titles appear on your host page. Guests are never listed publicly.
  • Connections only: direct messages between connected users.
  • Only Soyo: your taste profile, matching data, post-hangout feedback (given and received), reliability record, and safety reports.
  • You only: phone number, date of birth, email address, payment status, relationship status (if set).

Invitation-only means invitation-only: hangouts are not public listings, and people who are not confirmed guests cannot see them, their locations, or who is attending.

6. Service Providers We Use

We rely on a small number of third parties to operate the platform under contracts that limit them to processing data on our behalf:

  • Supabase — database, authentication, file storage. Hosted in the United States.
  • Stripe — payment processing, payment holds, and Stripe Connect for host payouts. Hosted in the United States and other regions.
  • Anthropic — AI processing for matching, activity creation, and photo reading (Section 4): receives taste-profile text, the text of your activity requests, and, if you add them, your vibe photos. Hosted in the United States. Not permitted to train its models on your data under our usage terms.
  • Vercel — web hosting and edge content delivery. Hosted in the United States and edge regions globally.
  • Expo / Apple / Google — mobile app delivery and push notifications.
  • Google Maps / Places — looking up business addresses and map links for venues (business data, not your personal data).
  • Resend — transactional email delivery. Hosted in the United States.

These providers process data on our behalf and are not permitted to use it for their own purposes. They have their own privacy policies, which we encourage you to review.

7. International Data Transfers

Soyo is operated from Canada, but our infrastructure providers (Supabase, Stripe, Vercel, Anthropic, Resend) primarily host and process data in the United States. By using Soyo, you understand and consent to your personal information being transferred to and processed in the United States and other countries that may have data-protection laws different from your home jurisdiction.

We use providers that maintain industry-standard safeguards (encryption in transit, access controls, audited compliance certifications). For Quebec residents, this disclosure is made in accordance with Section 17 of Quebec's Act respecting the protection of personal information in the private sector (Law 25).

8. Cookies & Local Storage

Soyo uses cookies and browser local storage for two purposes only: keeping you signed in and remembering UI preferences (e.g. last visited messages tab, theme). We do not use third-party advertising cookies, cross-site tracking pixels, or analytics cookies that identify individual users.

We honour the Global Privacy Control (GPC) browser signal where applicable. Because we do not sell or share personal information for advertising, no opt-out action is necessary.

9. Your Rights

You can, at any time:

  • View and edit your profile, taste answers, and vibe photos from your account settings — the taste conversation can be retaken anytime.
  • Leave a seat or waitlist from the invitation or your journal in the app.
  • Delete your account from Account Settings → Delete Account in the app, or via joinsoyo.com/delete-account. Deletion has a 30-day grace period during which it can be reversed by emailing us. Deleting your account also deletes your taste profile and matching data.
  • Export your data by emailing us; we will provide a machine-readable copy of your personal data within 30 days (or 45 days where law allows extension).
  • Object to processing, request correction of inaccurate data, or restrict certain uses.
  • Withdraw consent at any time for processing based on consent (does not affect lawfulness of prior processing).

We do not discriminate against users who exercise privacy rights. You may designate an authorized agent to make a request on your behalf — agent must provide proof of authorization and your identity.

To exercise any right above, email team@joinsoyo.com with the subject line “Privacy Request.”

10. Region-Specific Rights

California Residents (CCPA / CPRA)

You have the right to know, delete, correct, and opt out of sale or sharing of your personal information. As stated above, Soyo does not sell or share personal information for cross-context behavioural advertising, so no separate “Do Not Sell or Share” mechanism is needed; you may still submit a request to confirm this. You can designate an authorized agent and have the right to non-discrimination for exercising your rights.

Virginia, Colorado, Connecticut, Utah, and other US states

Residents of states with comprehensive privacy laws (VCDPA, CPA, CTDPA, UCPA, plus Iowa, Indiana, Tennessee, Texas, Oregon, Florida, Delaware, and others as enacted) have rights similar to California: access, deletion, correction, portability, and opt-out of targeted advertising / sale where applicable. We honour these rights for any qualifying request.

Canadian Residents (PIPEDA, BC PIPA, Alberta PIPA)

Your rights to access, correction, and withdrawal of consent under federal PIPEDA and provincial laws are honoured globally across our user base. You have the right to file a complaint with the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Quebec Residents (Law 25)

Quebec residents have additional rights under Law 25: data portability, right to be forgotten, automated decision-making disclosure, and the right to object to certain processing. As disclosed in Section 4, Soyo uses automated processing — including AI — to decide which invitations you receive; you may ask what information was used, have it corrected, and have a person review an outcome. This processing does not produce legal or similarly significant effects. Our designated person in charge of personal information is reachable at team@joinsoyo.com. A French-language version of this policy is available on request.

11. How Long We Keep Data

  • Account profile, taste profile, and vibe photos: until you delete the account (or remove the individual item).
  • Invitations, seats, messages, and group chats: kept while the account is active so shared history stays intact for the people in it. Group chats close to new messages one week after the hangout.
  • Post-hangout feedback and reliability records: kept while the account is active, private to Soyo.
  • Payment records (transaction logs, holds, payouts): retained for 7 years to meet Canadian and US tax + accounting requirements.
  • Payment-event records (refunds, disputes, failed payouts) and activity requests: retained for 7 years alongside the payment records they relate to.
  • Backups: rolling 30-day window of encrypted Supabase backups.
  • Server logs (IP, request metadata): up to 90 days for security and abuse prevention.

12. Security

We use industry-standard practices to protect your data: TLS in transit, encrypted backups at rest, row-level security on the database, and column-level restrictions on sensitive fields like phone numbers. Authentication and password storage is delegated to Supabase Auth (bcrypt). Payment data is delegated to Stripe (PCI-DSS Level 1).

No system is perfect. If you discover a security issue, please email team@joinsoyo.com with the subject line “Security Report” so we can address it promptly.

13. Data Breach Notification

In the event of a data breach involving your personal information that creates a real risk of significant harm, we will:

  • Notify the Privacy Commissioner of Canada (and applicable provincial commissioners) without undue delay, as required by PIPEDA and provincial law.
  • Notify affected users by email within 72 hours of confirming the scope of the breach, where feasible.
  • Comply with breach-notification requirements of US state laws applicable to affected residents (e.g. CCPA, NY SHIELD Act, state attorneys general thresholds).
  • Maintain an internal record of breaches as required by PIPEDA Section 10.3.

14. Children's Privacy (COPPA)

Soyo is intended for adults aged 18 and older. We do not knowingly collect data from anyone under 18. We do not knowingly collect personal information from children under 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA).

Where a host welcomes children at a hangout, a parent or legal guardian may bring their child on the guardian’s own spot. The guardian tells us the child’s age so the host can prepare; we keep that age with the booking and show it to the host. We do not collect the child’s name, contact details or any account for them.

If you believe a minor has created an account, please email team@joinsoyo.com. We will remove the account and associated data promptly upon verification.

15. Changes to This Policy

We may update this Privacy Policy as Soyo evolves. Material changes will be announced in-app or by email at least 30 days before they take effect, where feasible. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of Soyo after the effective date constitutes acceptance of the revised policy.

16. Contact

For privacy questions, data export requests, or to exercise any rights described above, contact:

1598025 B.C. LTD. (operating as Soyo)
Metro Vancouver, British Columbia, Canada
📧 team@joinsoyo.com

You may also file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the privacy regulator in your jurisdiction.

Back to Soyo