SOIRAS Privacy Policy
Effective from 23 November 2026. Version 1.0.
1. In brief
- We do not see, store or send anywhere your conversations, answers or choices in the app. The app has no user accounts.
- We process only what is needed for a purchase, delivery, a gift and — if you wish — our newsletter.
- We do not sell your data or use it for advertising or tracking. The website uses no cookies; we count visits only in aggregate form, without cookies.
2. Who is the controller
SIA "Herkules PSI", registration No. 40203526210, Brīvības iela 92/94–1, Riga, LV-1001, Latvia; email info@soiras.com. For any questions about your data, write to this address.
3. What data we process, why and on what basis
On a phone, the table scrolls sideways.
| When | What data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You buy a digital pack | email, order (product, amount, date), access code, consent ticks (terms, being an adult, digital delivery) | to complete the purchase, send the code, resend it if lost, inform you of important matters about access, prove the transaction and consent | performance of a contract (6(1)(b)); legal obligation (6(1)(c)); legitimate interests in proving the transaction (6(1)(f)) |
| You order a box | + first name, surname, phone number, chosen Omniva parcel locker | delivery, notifications about the parcel | performance of a contract (6(1)(b)) |
| You buy a gift | recipient's name and email, your name, message, delivery time; the fact and date the gift was opened | to send the gift, to let you know it has been opened | for you — performance of a contract (6(1)(b)); for the recipient — legitimate interests in delivering the gift (6(1)(f)) |
| You activate a code in the app; the app checks the code's validity when online | code checksum (hash), number of activations (up to 2 devices), code status (valid/blocked), time of each device's last check; if you free up devices — a link is sent to the email linked to the code | to check that the code is valid, not blocked and not used on more devices; to let you change device | performance of a contract (6(1)(b)) |
| You sign up for news | email, language, time of sign-up, the page where you signed up | to send news about SOIRAS (launch, new decks, important announcements); to prove that consent was given | consent (6(1)(a)) — can be withdrawn at any time; for proof — legitimate interests (6(1)(f)) |
| You write to us (by email or WhatsApp), call us or withdraw from a contract | name, email or phone number, order number, content of your message | to reply, to process a withdrawal or complaint | performance of a contract, legal obligation (6(1)(b), (c)) |
| You visit the website | technical data (IP address, browser, time) processed by our hosting service to display and protect the website; aggregated visit statistics — country, page visited, type of device and browser, the website you came from | operation and security of the website; understanding where and in which languages people are interested in SOIRAS, to plan languages and advertising | legitimate interests (6(1)(f)) |
We do not process: your answers to the cards, which cards you draw, how long you play or with whom. Your card and online banking details are seen only by the payment institution, not by us. Visit statistics do not identify you as a person and are not linked to purchases or email addresses; we do not collect statistics in the app.
4. Adults only
SOIRAS is intended for adults only (see section 4 of the Terms of Use and Sale). We do not knowingly collect data from minors. If we learn that data has been received from a minor, we delete it.
5. Who else sees the data (processors and other controllers)
We share data only with the service providers without whom we cannot provide the service, and only to the extent necessary:
- Paysera LT, UAB (Lithuania) — payment processing. When providing payment services, Paysera processes your data as the payer as a controller (including for preventing fraud and money laundering) — see Paysera's privacy policy. If you pay by card, your personal and transaction data may also be passed to the card payment acquirer (Acquirer) that Paysera works with; it processes them as an independent controller — to execute the payment, prevent fraud and meet legal requirements;
- Cloudflare, Inc. — hosting and security of the website and app, visit statistics without cookies (Cloudflare Web Analytics), temporary storage of newsletter sign-ups;
- Zoho (EU data centre) — email (Zoho Mail), newsletters (Zoho Campaigns), purchase emails;
- Omniva — delivery of the box (name, phone number, parcel locker);
- WhatsApp Ireland Limited — if you contact us on WhatsApp: WhatsApp processes your phone number and messages as a controller under its own terms and privacy policy. If you prefer not to, write to info@soiras.com;
- accountant — order and payment documents.
On our side, only the responsible persons of SIA "Herkules PSI" (the authors of the project) have access to the data. We provide data to public authorities only where required by law.
6. Transfers outside the EU
Cloudflare, Inc. may also process technical data in the USA or elsewhere outside the European Economic Area. In that case the data is protected by the EU–US Data Privacy Framework or the EU standard contractual clauses. If you pay by card, the card payment acquirer and the card schemes (for example, Visa, Mastercard) process the data under their own terms, and it may also be transferred outside the EEA. If you write to us on WhatsApp, WhatsApp and its parent company Meta may also process data in the USA. Our other service providers process data in the EU. You can request information about the safeguards at info@soiras.com.
7. How long we keep data
On a phone, the table scrolls sideways.
| Data | Period |
|---|---|
| Orders, payments, buyer's email, delivery details and consent ticks | up to 10 years after purchase — to meet accounting requirements and to be able to prove the transaction in case of a dispute (the general limitation period for obligations under the Latvian Civil Law is 10 years) |
| Code checksum and number of activations | for as long as access (the app) is running |
| Gift recipient's name and email, message | 13 months from purchase |
| Newsletter list | until you unsubscribe (link in every email) |
| Newsletter sign-up record (email, time, language, page) — as proof of consent | in our archive for up to 10 years after you unsubscribe |
| Correspondence with us, withdrawals, complaints | 2 years after the last contact or until a dispute is resolved; withdrawals and complaints relating to an order — together with the order |
| Aggregated visit statistics | according to Cloudflare's terms; they contain no data by which you can be identified |
| Hosting technical data | briefly, according to the service provider's terms |
When the period ends, we delete the data or make it anonymous.
8. Your rights
You have the right to:
- access your data and receive a copy;
- correct inaccurate data;
- ask us to delete your data (if we are no longer obliged to keep it);
- restrict or object to processing (in particular, processing based on legitimate interests);
- receive your data in a portable format;
- withdraw your consent to the newsletter at any time — this does not affect processing before withdrawal.
Write to info@soiras.com; we will reply within one month. To protect your data, we may ask you to write from the email address you used to buy.
If you believe your data has been processed incorrectly, you can lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv) or with the supervisory authority in your EU country.
9. Cookies, device storage and statistics
- The website soiras.com uses no cookies and stores nothing on your device.
- We count visits with Cloudflare Web Analytics, which uses no cookies, does not track you on other websites and shows us only aggregated figures (for example, how many visits came from each country, which pages were viewed, on what types of device and from which websites people arrived). This is why no cookie consent is required.
- The app stores on your device only what it needs to work: your chosen language and your activated access codes, so that the decks open without entering them again. The codes themselves stay on your device; when checking their validity (Terms, 3.3), the app sends us only their checksums (hash) — no information about games, answers or choices. Your browser also keeps the app's files in its cache so that it opens faster — they contain no personal data. You can delete all of this in your browser settings (site data). We do not collect statistics in the app.
- On the payment page, Paysera may use its own cookies (for security and fraud prevention) — see Paysera's privacy policy.
10. Security
We use an encrypted connection (HTTPS); on our server we store access codes only as a checksum, not the code itself; only the responsible persons of SIA "Herkules PSI" have access to the data.
11. For gift recipients
If someone has bought SOIRAS for you as a gift, your name and email were given to us by the buyer. We use them only to send you the gift and to let the buyer know it has been opened, and we delete them 13 months after the purchase. You have all the rights listed in section 8.
12. Changes
If we change this policy, the new version will be available on this page with a new date. We will announce any significant changes on the website.