We do not sell data
Not as raw records, not as a profile, not as an audience. There is no business model built on it and no contract preparing for one.
What happens, and what does not
Privacy policy
SOMA processes some of the most sensitive things a person has: what they eat, what they cannot tolerate, who they cook for. Four sentences first, then the detail.
This text is a draft and has not been reviewed by a lawyer. Before publication on a real domain it belongs in front of a law firm once.
Everything sits in Germany
Servers, database and backups are in German data centres. Even the services others buy in we run ourselves: weather, air and pollen on our own Open-Meteo instance, addresses on our own Nominatim. Where you are never leaves the house.
Encrypted, in transit and at rest
Connections run over TLS only. The database and the backups are stored encrypted. A lost disk is then a lost disk and not an incident.
Releases are itemised and revocable
A doctor or a coach sees nothing that was not explicitly released, piece by piece rather than in one go. Withdrawal takes effect at once and needs no reason.
Controller
The controller within the meaning of the GDPR is the company named in the imprint, represented by the person named there. A request under this policy goes to the same address.
What this website collects
This website sets no cookies, embeds no third-party servers and measures no usage. The fonts sit on our own server; there is no analytics tool and no ad network. What accrues is the access data every web server logs: shortened IP address, timestamp, requested path, browser string. The legal basis is our legitimate interest in secure operation, Article 6(1)(f) GDPR. The logs are deleted after seven days.
The waitlist
If you sign up, we store five things: the email address, the role you chose, the language of the page, the page you signed up on, and the time. Nothing else, and in particular no name, no IP address and no tracking pixel. The page is stored because it answers the one question we ask later: which door carries. The legal basis is your consent, Article 6(1)(a) GDPR. Every message carries an unsubscribe link, and unsubscribing deletes the entry rather than flagging it.
The app gets its own policy
Anyone using SOMA enters details about food, intolerances and conditions. Those are health data within the meaning of Article 9 GDPR and specially protected: they are processed only on explicit consent, only for the feature you entered them for, and they leave the household only where you release them individually. This policy describes the website. The app has its own, and you get to see it when the account is created, not afterwards.
Hosting and processing
Operations run with a provider whose data centres are in Germany, under a data processing agreement pursuant to Article 28 GDPR. Its name appears here as soon as the contract is signed. There are no other processors: no message delivery service, no form tool, no outsourced support.
Makers, retail and delivery services
We work with suppliers so that a product in the app can actually be obtained, and payment may flow for that. What a supplier gets to see is an evaluation with no personal reference, and only from five households upwards: how often a supply route was chosen. No names, no addresses, no shopping lists. Payment does not affect the ranking in the app, and that is not a promise but an architecture: the function that ranks never sees the supplier’s name.
How long we keep things
Access logs seven days. The waitlist entry until launch or until you unsubscribe, whichever comes first. Statutory retention periods are unaffected; they concern accounting records and not health data.
Your rights
You can ask for access, rectification, erasure, restriction of processing and a copy in a portable format. You can object to processing based on legitimate interests, and withdraw consent at any time; what happened until then stays lawful. An informal email is enough, and the answer comes within a month.
Complaints
Anyone who thinks we are getting something wrong can complain to a supervisory authority. Ours is the authority at the registered office in Berlin, but you may equally approach the one where you live.
- Controller
- SOMA Health UG (haftungsbeschränkt) i. G.Joachimsthaler Straße 34, 10719 Berlindatenschutz@soma.recipes
- Complaints
- Berliner Beauftragte für Datenschutz und Informationsfreiheit
What is still missing here
The name of the hosting provider, and whether we have to appoint a data protection officer. Both hang on decisions taken at incorporation. This text, too, is a draft and has not been reviewed by a lawyer.
Early access
We will say the word when it opens.
One message at launch, and after that only when there is genuinely something to see. Not a newsletter, no unsubscribe maze, no account needed.
One message at launch. Not a newsletter, no unsubscribe maze.