Privacy Policy
Souped (“we,” “us,” “our”) is operated by Capicua Group Inc. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use souped.app and related services (the “Service”).
We believe privacy policies should be readable, not buried in legalese. If something is unclear, email us at privacy@souped.app and we will explain it in plain language.
1. Who We Are
| Company | Capicua Group Inc. (DBA Souped) |
| Service | souped.app |
| Role | Data Controller (for account and behavioral data) |
| Privacy Contact | privacy@souped.app |
| Mailing Address | 1133 Broadway, Suite 530, New York, NY 10010 |
For the purposes of the EU General Data Protection Regulation (GDPR), Capicua Group Inc. is the data controller for the personal data described in this policy.
2. What We Collect
Information You Provide
| Category | Examples | Why We Collect It |
|---|---|---|
| Account Data | Name, email address, company name | To create and manage your account |
| Payment Data | Billing address, subscription tier | To process payments (card details are handled entirely by Stripe — we never see or store your card number) |
| Communication Data | Support messages, feedback, survey responses | To respond to your requests and improve the Service |
Information We Collect Automatically
| Category | Examples | Why We Collect It |
|---|---|---|
| Usage Data | Pages visited, features used, session duration, clicks | To understand how the Service is used and where to improve it |
| Device & Technical Data | IP address, browser type, operating system, device type, screen size | To ensure the Service works correctly on your device |
| Cookie Data | Session identifiers, analytics cookies | To keep you logged in and measure aggregate usage (see Section 7) |
Behavioral & Decision Data
| Category | Examples | Why We Collect It |
|---|---|---|
| Decision-Making Activity | How you interact with Souped’s decision and planning tools | To power and improve Souped’s recommendations |
| Outcome Data | Results and outcomes you record | To measure the effectiveness of recommendations |
| Usage Patterns | Feature usage frequency, workflow patterns | To improve the accuracy of Souped’s AI |
This category is important and we want to be direct about it. We use aggregated, anonymized behavioral data to improve how Souped helps founders make better decisions. See Section 4 for details.
3. What We Do Not Collect for AI Training
We want to be equally clear about what we do not use:
- Your code and project files. We do not collect, analyze, store, or use your source code or project files to train any AI model.
- Your prompts to AI providers. When you use an AI provider through Souped (Claude, Codex, or others), your prompts are routed to your chosen provider. We do not store prompts for training purposes. Prompts may be temporarily processed in server memory to route requests and may appear in error or diagnostic logs, which are automatically purged within fourteen days.
- Your deployment credentials. API keys, tokens, and secrets you use through the Service are never collected for any purpose beyond providing the Service.
- Your proprietary content. Documents, designs, business plans, or other content you create or upload are yours. We do not use them to train models.
This applies to all tiers — Free, Pro, and Enterprise. There are no exceptions.
4. How We Use Your Data
Every use of your data maps to a specific purpose and legal basis.
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide and maintain the Service | Account Data, Usage Data, Device Data | Contractual necessity (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Payment Data | Contractual necessity (Art. 6(1)(b)) |
| Send transactional communications | Account Data (email) | Contractual necessity (Art. 6(1)(b)) |
| Respond to support requests | Communication Data, Account Data | Contractual necessity (Art. 6(1)(b)) |
| Improve the Service based on usage patterns | Usage Data, Device Data | Legitimate interest (Art. 6(1)(f)) |
| Improve AI recommendations using anonymized behavioral data | Behavioral & Decision Data (anonymized and aggregated) | Consent (Art. 6(1)(a)) — you may opt out at any time |
| Detect fraud and prevent abuse | Usage Data, Device Data, Account Data | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
How Behavioral Data Improves Souped
We use anonymized, aggregated behavioral data to improve the accuracy of Souped’s recommendations. This data is stripped of all personally identifiable information before it is used for any purpose beyond providing the Service to you directly. No individual user is identifiable in the resulting dataset.
You can opt out. If you do not want your behavioral data used for AI improvement, you can opt out in your account settings at any time. Opting out does not affect your access to any features.
6. Data Retention
We retain your data for specific periods based on its category:
| Category | Retention Period | What Happens After |
|---|---|---|
| Account Data | Duration of your account + thirty days after deletion | Permanently deleted |
| Payment Records | Seven years after transaction | Deleted (retained for tax and legal compliance) |
| Usage Data | Twenty-four months (rolling) | Anonymized and aggregated; raw data deleted |
| Behavioral & Decision Data | Duration of your account (raw data) | Raw data deleted thirty days after account closure. Anonymized, aggregated derivative data is retained — it is no longer personal data. |
| Communication Data | Twenty-four months | Deleted |
| Device & Technical Data | Twenty-four months (rolling) | Deleted |
| Backup Copies | Up to ninety days after primary data deletion | Permanently deleted |
7. Cookies
We use a minimal set of cookies:
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Keep you logged in, maintain session state, ensure security | No (essential for Service operation) |
| Analytics | Measure usage patterns, heatmaps, and session recordings (Google Analytics, Hotjar, RB2B) | Yes (opt-in via cookie banner) |
We use analytics cookies from Google Analytics, Hotjar, and RB2B to understand how the Service is used and to improve the experience. These cookies are only set with your consent via our cookie banner.
We do not use advertising cookies or third-party ad network cookies for the purpose of serving ads.
You can manage your cookie preferences at any time through the cookie settings link in the footer of souped.app.
8. Your Rights
For All Users
Regardless of where you are located, you can:
- Access your personal data by requesting a copy
- Correct inaccurate personal data
- Delete your account and personal data (via account settings or by emailing privacy@souped.app)
- Export your data in a machine-readable format
- Opt out of behavioral data collection for AI improvement (via account settings)
Additional Rights for EEA/UK Residents (GDPR)
If you are in the European Economic Area or United Kingdom, you also have the right to:
- Restrict processing of your personal data
- Object to processing based on legitimate interest
- Data portability — receive your data in a structured, commonly used format
- Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
- Lodge a complaint with your local data protection authority
For cross-border data transfers from the EEA/UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.
Additional Rights for US Residents
If you are a resident of California, Colorado, Connecticut, Virginia, or other states with comprehensive privacy laws, you have the right to:
- Know what personal information we collect and how we use it
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information (we do not sell or share your data, but the right exists)
- Non-discrimination for exercising your privacy rights
We honor Global Privacy Control (GPC) signals automatically. We do not sell or share personal information as defined by the California Consumer Privacy Act (CCPA/CPRA). For more information, visit souped.app/do-not-sell.
How to Exercise Your Rights
- Self-service: Account settings at souped.app provide deletion, export, and opt-out controls.
- Email: privacy@souped.app
- Response time: We will respond within thirty days (GDPR) or forty-five days (CCPA). If we need additional time, we will notify you.
We will never require you to send physical mail to exercise your privacy rights.
9. International Data Transfers
Souped is operated by Capicua Group Inc. in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.
For users in the EEA, UK, or Switzerland:
- We use Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller to Processor) for data transfers to the United States.
- Where applicable, we rely on the EU-US Data Privacy Framework and its UK and Swiss extensions.
A list of our current subprocessors and their locations is available at souped.app/subprocessors.
10. Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit (TLS 1.2 or higher)
- Encryption at rest for stored data
- Access controls limiting data access to authorized personnel
- Regular security assessments
- Incident response procedures
No system is 100 percent secure. If we become aware of a security breach that affects your personal data, we will notify you and any applicable regulatory authority in accordance with applicable law (within seventy-two hours for GDPR-covered incidents).
11. Children
Souped is designed for business professionals. The Service is not directed to anyone under eighteen years of age. We do not knowingly collect personal information from anyone under eighteen. If we learn that we have collected personal data from someone under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at privacy@souped.app.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes:
- We will send you an email notification at least thirty days before the changes take effect.
- We will update the “Last Updated” date at the top of this page.
- We will describe the changes in the notification.
If you disagree with the changes, you may delete your account before they take effect.
13. Contact Us
If you have questions about this Privacy Policy or our data practices:
| privacy@souped.app | |
| Mailing Address | Capicua Group Inc., 1133 Broadway, Suite 530, New York, NY 10010 |
| For GDPR inquiries | privacy@souped.app (subject line: “GDPR Request”) |
| For CCPA inquiries | privacy@souped.app (subject line: “CCPA Request”) |
This Privacy Policy is provided in English. If translated into other languages, the English version controls in the event of a conflict.