Privacy policy

Draft under legal review: the text may change.

This policy explains what personal data Soulkin processes, why, for how long and how you can exercise your rights. It covers the website soulkin.cc, the request form and the app.

Who is responsible

The data controller is Giordano Bruno, Via Torino 10, Settala (Italia). For any question about your data write to info@soulkin.cc.

In short

• We only process the data needed to run the circle.
• Your secret key stays on your device: we never receive it.
• Listings and profiles are visible to members only, not to the public.
• No advertising, no cookies, no selling of data.
• The servers and the database are in the European Union.

What data we process and why

Request to join

If you fill in the “Ask to join” form we process your name, contact (email or phone), area, what you can offer, when you are available, what you would need, the name of a member you know and the language of the page. We use them to assess the request and contact you, and only the committee of the circle sees them. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Account

When you join the circle we process the public key generated on your device, the name you choose, who invited you, the date you joined, any initial limit and any role on the committee. We use them to let you take part in the circle under the terms of use. Legal basis: performance of a contract (Art. 6(1)(b)).

Exchanges and balance

For each exchange we record the public keys of the two people, the amount, the date, both signatures and the share that goes to the common fund. Your balance and the total you have given are derived from these. We use them to keep the credit ledger and to let anyone verify it. Legal basis: performance of a contract and the legitimate interest of all members in a sound ledger (Art. 6(1)(b) and 6(1)(f)). Your balance and total given are visible to other members on your profile; the details of each exchange are seen only by the two people involved.

Listings

The title, description, area, contact, prices and end date of the listings you publish are visible to all members. You choose what to write: do not include anything you do not want other members to see. Legal basis: performance of a contract (Art. 6(1)(b)).

Invitations

We record who creates each invitation, when it expires and who uses it: that is how the circle knows who vouches for whom. Legal basis: performance of a contract (Art. 6(1)(b)).

Technical data and security

To run the website and protect it from abuse, the servers process the IP address and technical data of each request. Form submissions from the same connection are counted only in the server’s memory, for one hour, and are not stored. The server providers keep technical logs for a short period. Legal basis: legitimate interest in the security of the service (Art. 6(1)(f)).

Email

If you write to us, we use your address and message to reply.

What stays on your device

The app stores on your device the secret key, the language you chose, the latest data for offline use and payments waiting to be sent. They are strictly necessary for the service you ask for, so no consent is needed. We use no cookies, analytics or advertising.

Who receives the data

• Other members see your name, balance, total given, who invited you and your listings.
• The committee sees requests to join. Its members commit to confidentiality in writing.
• Providers who process data on our behalf, under a contract in line with Art. 28 GDPR: Fly.io, Inc. (United States) for the servers, which are located in the European Union; Aiven Oy (Finland) for the database, hosted in the European Union.
• Authorities, only when the law requires it.

We do not sell or pass on data to anyone.

Transfers outside the European Union

The data is stored in the European Union. Fly.io is a US company: if it accesses the data from the United States, for example for technical support, the transfer is covered by the safeguards of Articles 45 and 46 GDPR, such as the standard contractual clauses approved by the European Commission.

How long we keep data

• Requests to join: at most 6 months. If you receive an invitation, until it expires (14 days).
• Account, listings and invitations: as long as you stay in the circle.
• Exchanges: as long as the ledger exists, because each exchange is signed by two people and is needed to verify everyone’s balance. If you leave the circle we delete your name, listings and contacts: only the public key remains in the exchanges, and on its own it does not say who you are.
• Backups: deleted data also disappears from backups within 30 days.
• Email: as long as needed to reply.

Your rights

You can ask to access your data, to correct or erase it, to restrict its processing, to receive it in a machine-readable format and to object to processing based on legitimate interest (Articles 15–21 GDPR). Write to info@soulkin.cc: we reply within one month. Signed exchanges follow the rule described above, because erasing them entirely would change other members’ balances.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live, for example the Agencia Española de Protección de Datos in Spain (aepd.es).

Minimum age

Soulkin is only for people aged 18 or over. If we find data about a minor, we delete it.

Automated decisions

We do not take decisions based solely on automated processing. Your spending margin follows a rule that is the same for everyone: half of what you have given, plus any initial limit, up to 300 credits.

Security

Connections are encrypted, every request from the app is signed with your key and access to the data is limited to those who need it.

Changes

If we change this policy we update the date below; if the changes are important, we tell you in the app.

Last updated: 27 October 2026.