Privacy Policy

1.Information We Collect

2.Purpose of Collection

We collect personal information to:

• Provide and operate the Service
• Process payments and deliveries
• Process healer session settlements and remit healer payouts
• Process in-app purchases and manage subscription entitlements, including verifying purchases and determining access to subscription features
• Manage accounts and customer support
• Improve service quality and security
• Understand the regional and language distribution of our users to prioritize service improvements
• Diagnose app stability, including the collection and analysis of crash and error reports
• Record and resolve payment disputes, including chargeback identifiers, dispute status, evidence submissions, and final outcomes provided by payment service providers
• Respond to and resolve refund requests for in-app purchases, including, where applicable, sharing consumption information with the relevant app marketplace (such as Apple) to help inform its refund decision
• Comply with legal obligations

3.Data Retention and Account Deletion

• For as long as your account remains active.
• Users may delete their account at any time directly in the app or on the web via Settings → Delete Account.
• Users may also request account deletion at https://goingtosona.com/account-deletion or by contacting goingtosona@gmail.com.
• If you signed in with Apple, deleting your account removes your sona account and data. Apple’s Sign in with Apple record is managed by Apple, so to remove sona from your Apple ID as well, open Settings → Apple ID → Sign in with Apple on your device and remove sona.
• Upon account deletion, personal data shall be permanently destroyed without undue delay, and in any event within thirty (30) days, except for the minimum data that applicable laws require us to retain.
• Data subject to a statutory retention obligation — such as electronic commerce transaction records and payment, refund, and dispute records maintained through payment service providers — shall be retained for the period required by the applicable law.
• To prevent duplicate redemption of one-time free benefits (such as the one-time free trial of sona Pro), an irreversible cryptographic hash of account identifiers (email address and social sign-in identifiers) is retained after account deletion. The original values are not stored, cannot be reconstructed from the hash, and the hash is used solely to determine whether a benefit has already been redeemed.
• Messages and other content you have shared directly with another user form part of that user’s own record of the conversation and therefore remain visible to them after you delete your account; your account is shown to them as a deleted user. Where you are the only remaining participant, the conversation is deleted with your account.

4.Data Sharing

We may share personal data with:

• Payment processors, including Stripe and Stripe Connect, for payment processing, seller account onboarding, identity verification, and settlement
• Payout remittance providers, including PayPal, for the purpose of remitting healer session payouts and handling payout errors and disputes. The data shared comprises the healer's payout account email address and country, together with payout transaction data (payout amount, currency, and payout identifiers). Such data is retained for as long as necessary to process the payout and thereafter as required by the provider's legal and regulatory retention obligations. Registering payout information is voluntary; however, without it, healer payouts cannot be remitted. Remittance providers operate internationally, and payout data may be received by the provider entity serving the healer's region (see Section 5)
• App market operators and in-app purchase infrastructure, including Apple App Store and Google Play (in-app payment processing) and RevenueCat (in-app purchase validation and subscription status management). Where you request a refund for an in-app purchase, we may, through RevenueCat, provide the app marketplace (such as Apple) with consumption information — such as the extent to which the purchase was consumed, your in-app purchase and refund history, and the length of your app usage — together with our recommended resolution, to help inform the marketplace's refund decision
• Delivery and logistics partners
• Cloud service providers, including Google Firebase (application backend, storage, authentication, and push notification delivery), Google Firebase Analytics (aggregate usage statistics and event data), and Google Firebase Crashlytics (crash and error diagnostic reports, including device model and operating system version)
• Authorities when required by law

We do not sell your personal information to third parties. We do not use analytics data for targeted advertising. For residents of California, this includes no “sale” or “sharing” of personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

5.International Data Transfers

sona operates globally. Your data may be transferred and stored outside your country of residence — including in the United States and other countries where our service providers operate — in compliance with applicable laws, including GDPR and other international regulations. Such international transfers are carried out on the basis of Standard Contractual Clauses and the Data Processing Addendum provided by our cloud service providers (including Google Firebase), together with other appropriate safeguards required under applicable law. Where healer payouts are remitted through international payment providers such as PayPal, payout information is transferred to the provider entity serving the relevant region, and the specific receiving entity and country will be disclosed before the first payout is remitted.

6.User Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Request correction or deletion
• Restrict or object to processing
• Withdraw consent

Requests can be made via email.

7.Security Measures

We implement reasonable technical and organizational safeguards, including:

• Encryption
• Access controls
• Secure servers

8.Children's Privacy

The Service is not directed to children under 13, or under 16 in the European Economic Area and other jurisdictions where a higher age threshold applies under applicable law. sona does not knowingly collect personal data from such children. If a parent or legal guardian becomes aware that their child has provided us with personal data, they may contact us using the details in Section 10, and we will promptly delete such data.

9.Policy Changes

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform.

10.Contact

For privacy-related inquiries:

• Email: goingtosona@gmail.com