Privacy Policy

1. Introduction

SomaAxis ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our service (the "Service").

We are based in British Columbia, Canada, and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), provincial privacy laws, and other applicable privacy regulations.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you create an account, we collect your email address and password
• Profile Information: Optional name, profile picture, and other details you choose to provide
• Yoga Sequences: Custom routines, poses, and preferences you create in the Service
• Communication: Any messages you send us through contact forms, support channels, or email
• Payment Information: For Premium subscriptions, payment details are processed through Stripe (not stored by us directly)
• Feedback: Any reviews, suggestions, or feedback you provide about the Service

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type, IP address
• Usage Data: Pages visited, features used, practice duration, sequences accessed, timestamps
• Cookies & Tracking: Session cookies, authentication tokens, preference settings
• Log Data: Server logs including IP addresses, access times, error messages
• Location Data: General location based on IP address (not precise geolocation)

2.3 Third-Party Information

We may receive information about you from third-party services:

• Descope (Authentication): Email verification and account authentication data
• Stripe (Payments): Payment status and subscription information only (not credit card details)

3. How We Use Your Information

We use your personal information for the following purposes:

• Account Management: Creating, maintaining, and securing your account
• Service Delivery: Providing, maintaining, and improving the Service
• Personalization: Tailoring the experience to your preferences and saved routines
• Communication: Sending account updates, support responses, and service announcements
• Billing: Processing payments, managing subscriptions, sending invoices
• Legal Compliance: Meeting legal obligations and enforcing our Terms of Service
• Analytics: Understanding how users interact with the Service to improve features
• Security: Detecting, preventing, and addressing fraud, abuse, and security issues
• Marketing: Sending promotional emails and updates (only if you've opted in)

4. How We Share Your Information

We do not sell your personal information. We only share your information with third parties in the following circumstances:

4.1 Service Providers

We share limited information with trusted service providers who assist us in operating the Service:

• Descope: For authentication and account management
• Stripe: For payment processing
• Railway (Hosting): Infrastructure and database hosting
• Email Service (SendGrid/Resend): For sending emails on our behalf

These providers are contractually obligated to use your information only to provide services to us and maintain confidentiality.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the rights of others.

4.3 Business Transfers

If we are acquired, merge with another company, or sell our assets, your information may be transferred as part of that transaction. We will provide notice of any such change.

4.4 Public Content

If you choose to share your routines publicly on our Service, that content may be visible to other users.

5. Cookies and Tracking Technologies

Cookies: We use cookies to maintain your session, remember your preferences, and understand usage patterns. Cookies are small text files stored on your device.

• Session Cookies: Keep you logged in (deleted when browser closes)
• Preference Cookies: Remember your theme choice and settings
• Authentication Tokens: Secure your session

Browser Controls: You can disable cookies in your browser settings, but this may affect Service functionality.

Analytics: We may use analytics tools (such as Vercel Analytics) to collect anonymized usage data.

6. Data Retention

We retain your personal information as long as:

• Your account is active
• Required for our legal obligations
• Necessary for business purposes (fraud prevention, security)

Deleted Accounts: When you request account deletion, we delete your personal information within 30 days, except where required to retain for legal or business purposes. Your created routines may be retained in anonymized form.

Backup Data: Due to technical necessities, deleted data may remain in backups for up to 90 days before permanent deletion.

7. Your Privacy Rights (PIPEDA, Provincial Privacy Laws)

Under PIPEDA and provincial privacy legislation in Canada, you have the following rights:

7.1 Right to Access

You have the right to request a copy of all personal information we hold about you. We will provide this within 30 days.

7.2 Right to Correction

You can request that we correct any inaccurate or incomplete information we hold about you.

7.3 Right to Deletion

You can request deletion of your account and associated personal information. We will delete your data within 30 days, subject to legal retention requirements.

7.4 Right to Opt-Out

You can opt out of marketing communications at any time. You can manage this in your account settings or by clicking "unsubscribe" in emails.

7.5 Right to Data Portability

You can request your data in a portable format so you can transfer it to another service.

7.6 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 30 days.

8. Data Security

We implement industry-standard security measures to protect your personal information:

• SSL/TLS encryption for data in transit
• Hashed passwords (we never store plaintext passwords)
• Secure database hosting with access controls
• Regular security audits and monitoring
• Limited employee access to personal information
• Two-factor authentication support via Descope

No Guarantee: While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your information.

9. Children's Privacy

The Service is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we discover we have collected information from a child under 13, we will delete it immediately. Parents or guardians who believe a child has provided information to us should contact us immediately.

10. International Data Transfers

Your information is stored in Canada and processed by our service providers, which may include services in other countries. When your information is transferred internationally, we ensure it receives the same level of protection as in Canada through contractual agreements and Privacy Impact Assessments where required.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of external sites. We encourage you to review the privacy policies of any external sites before providing personal information.

12. Do Not Track

Some browsers include a "Do Not Track" feature. Currently, there is no industry standard for recognizing DNT signals. Our Service does not respond to DNT signals, but you can use browser controls to limit cookies and tracking.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on the Service and updating the "Effective Date" above. We will also notify you via email if changes significantly affect how we handle your personal information. Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

14. Our Privacy Commitment

We are committed to protecting your privacy and being transparent about our practices. If you have concerns about how we handle your information, or if you believe we have violated PIPEDA or your privacy rights, please contact us immediately.

15. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Email: [email protected]
Website: somaaxis.yoga
Privacy Officer Contact: [email protected]
Jurisdiction: British Columbia, Canada

Response Time: We will respond to all privacy inquiries within 30 days.

16. Complaint Resolution

If you have a privacy complaint or concern, please contact us. If we cannot resolve your complaint, you have the right to file a complaint with:

Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca
Phone: 1-800-282-1376