Sollea Privacy Policy
Last updated: 28 September 2026
1. Who We Are and What This Policy Covers
This Privacy Policy explains how Sollea ("Sollea", "we", "us", "our") collects, uses, shares, and protects your personal data when you visit sollea.app or use the Sollea app. Sollea is a personal ritual and self-reflection app that generates guided scripts and voice-based practices. It is operated by Kerri Wells, trading as Sollea.
This policy applies to visitors, account holders, and subscribers, whether on a free trial or a paid plan. It does not cover the practices of third-party sites we link to, or of platforms you use to reach us, such as social media.
We are the data controller for the personal data described here. Contact details and how to raise a concern are in Section 13.
This policy is written to comply with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and the Data (Use and Access) Act 2025.
2. Data We Collect
We collect the following categories of personal data.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored as a secure hash), account preferences | You, when you sign up |
| Content you create | Onboarding answers, journal and reflection entries, generated scripts, saved practices | You, as you use the app |
| Voice data | Voice recordings you make within guided practices, where the feature is used | You, when you record |
| Payment data | Subscription plan, billing status, truncated card details, transaction history | Stripe, our payment processor |
| Technical data | IP address, device and browser type, operating system, app version, crash logs | Automatically, as you use the app |
| Usage and analytics data | Pages viewed, buttons clicked, onboarding steps completed, session duration | Automatically, via Google Analytics and Meta Pixel |
| Communications | Emails or messages you send us, support requests | You, when you contact us |
We do not collect special category data (such as health or biometric data) as a matter of course. Voice recordings are processed as audio content for the purpose you make them, not analysed for biometric identification.
3. How We Use Your Data, and Our Legal Basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Account data | Performance of a contract |
| Generate your scripts, reflections, and practices | Content you create, voice data | Performance of a contract |
| Process payments and manage your subscription | Payment data | Performance of a contract; legal obligation (accounting and tax records) |
| Provide customer support | Communications, account data | Performance of a contract; legitimate interests in resolving your query |
| Keep the app secure and prevent abuse | Technical data, account data | Legitimate interests in protecting the service and our users |
| Understand how the app is used and improve it | Usage and analytics data | Consent (see Section 5, Cookies and Tracking) |
| Send you service and account emails (e.g. receipts, password resets) | Account data | Performance of a contract |
| Send you marketing emails, where you have opted in | Account data | Consent |
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew it. Where we rely on legitimate interests, we have considered that our interest does not override your rights and freedoms, and you can object at any time, as set out in Section 9.
4. AI Processing and Voice Recordings
When you use Sollea, the answers you give during onboarding and the reflections you enter are processed by an AI language model to generate your personalised scripts and guided practices. This processing happens in real time, to produce the content you asked for.
Where the app offers voice-based practices, any voice recording you make is used only to power that feature, such as playing it back to you or guiding your practice. We do not analyse your voice recordings for biometric identification, and we do not use your personal journal entries, reflections, or voice recordings to train general-purpose AI models, ours or any third party's.
Your content may pass through the servers of our AI service provider in the course of generating your scripts. We only use providers who are contractually bound to process your data for that purpose and not to use it for their own model training. If this changes, we will update this policy and, where required, ask for your consent first.
5. Cookies and Tracking
We use cookies and similar technologies, including Google Analytics 4 and Meta Pixel, to understand how visitors use Sollea and to measure the performance of our marketing.
| Tool | What it does | Data shared |
|---|---|---|
| Google Analytics 4 | Measures page views, onboarding progress, and app usage | Usage data and identifiers shared with Google |
| Meta Pixel | Measures ad performance and helps us reach people likely to be interested in Sollea | Usage data and identifiers shared with Meta |
| Meta Conversions API | Confirms purchases and first subscription payments to Meta from our server, so each sale is counted once | Event name, value and currency, your browser and IP details and Meta's browser identifiers, only if you accepted cookies |
Strictly necessary cookies, needed to keep you logged in and the app working, are set automatically and do not require consent. Google Analytics and Meta Pixel are not strictly necessary, and under UK law we only load them once you have given your consent through our cookie banner. You can withdraw consent at any time through that banner or your browser settings, and doing so will not affect your ability to use the app.
Google Analytics 4 does not currently qualify for the UK's limited cookie-consent exemption for analytics, because usage data is shared with Google, a third party. Meta Pixel is not covered by that exemption at all. Both therefore require your prior consent before they run.
6. Who We Share Your Data With
We share personal data with the following service providers, each acting under a data processing agreement and only for the purposes below. We do not sell your personal data.
| Provider | Role | Data shared |
|---|---|---|
| Supabase | Authentication and database hosting | Account data, content you create, technical data |
| Stripe | Payment processing | Payment data |
| Resend | Transactional email delivery | Email address, name |
| Google (Analytics) | Usage analytics | Usage and technical data |
| Meta | Advertising measurement | Usage and technical data |
| Lovable | Application development and hosting platform | Account data, content you create, technical data |
We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, property, or safety of Sollea, our users, or others. If Sollea is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.
7. International Data Transfers
Some of our service providers, including Supabase, Stripe, Resend, Google, Meta, and Lovable, may process or store personal data outside the UK, including in the United States. Where this happens, we rely on legally recognised safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, an adequacy decision covering the destination country, or the provider's certification under a recognised data protection framework such as the UK-US Data Bridge or the EU-US Data Privacy Framework. You can ask us for details of the specific safeguard used for any provider by contacting us using the details in Section 13.
8. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Account data and content you create | While your account is active, plus up to 90 days after closure to allow for recovery, then deleted |
| Voice recordings | Until you delete them or close your account, whichever is sooner |
| Payment records | 6 years, to meet HMRC accounting and tax requirements |
| Technical and security logs | Up to 12 months |
| Usage and analytics data | Up to 14 months in Google Analytics, per Google's default retention setting |
| Support communications | Up to 24 months after the query is resolved |
If you close your account, we delete or anonymise your personal data within the periods above, except where we are required to keep it for longer to meet a legal obligation, such as tax law, or to resolve a dispute.
9. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Ask us to erase your data, subject to certain exceptions
- Restrict how we use your data in certain circumstances
- Receive your data in a portable format, or ask us to send it to another provider
- Object to processing based on legitimate interests, including profiling
- Withdraw consent at any time, where we rely on consent, without affecting processing carried out before you withdrew it
- Avoid decisions based solely on automated processing that have a legal or similarly significant effect on you. Sollea does not currently make any such decisions about you
To exercise any of these rights, contact us using the details in Section 13. We will respond within one month. There is no charge, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
10. Children's Privacy
Sollea is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us using the details in Section 13 and we will delete it.
11. How We Protect Your Data
We use industry-standard safeguards to protect your personal data, including encryption of data in transit and at rest, access controls that limit who can view your data, and secure authentication through Supabase. Payment details are handled directly by Stripe and are never stored on our own servers. Staff and contractors who can access personal data are bound by confidentiality obligations.
No method of transmission or storage is completely secure. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and notify you without undue delay where the breach is likely to result in a high risk to you.
12. Changes to This Policy
We may update this policy from time to time, to reflect changes in our practices or the law. We will post the updated version here with a new "last updated" date. If a change is material, such as a new use of your data, we will tell you by email or an in-app notice before it takes effect, and ask for your consent again where the law requires it.
13. Contact Us and Complaints
If you have a question, want to exercise a right described in Section 9, or want to raise a concern, contact us at:
Sollea
Email: hellosollea@gmail.com
Postal address: Lytchett House, 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, Dorset, BH16 6FA, United Kingdom
If you are not satisfied with how we have handled your data or your request, you have the right to complain to the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
We would appreciate the chance to address your concern before you contact the ICO, but you are not required to come to us first.