Privacy policy
Effective date: August 12, 2026. This Privacy Policy explains what personal data SopBull (www.sopbull.com) collects, why we collect it, and how we handle it when you use the Service.
1. Who this covers
This policy applies to the public website and logged-in product features (case wall, credit wallet, unlocks, validate idea, account dashboard). The Payload admin / ops tools used by our staff are separate internal systems.
2. Data we collect
Account data: email address, password hash (if you use email sign-in), and basic profile fields provided by Better Auth. If you sign in with Google, we receive the account identifiers Google shares for that login (typically email and name).
Usage and product data: credit balance and transactions; case unlocks; validate-idea jobs (the idea text you submit, status, scores, and generated results); order records tied to credit-pack purchases; and limited case engagement events (for example view or click on a case slug) used to rank or improve the case wall.
Technical data: IP address, browser type, and similar request metadata that our hosting and security layers normally log. We use session cookies required to keep you logged in.
We do not ask for your full payment card number. Card and invoice details are collected by Creem at checkout.
3. Why we use the data
We use this data to create and secure your account, deliver cases and credits, run validate idea, process and reconcile orders, prevent abuse, provide customer support, and keep basic product statistics (for example which cases get attention). We do not sell your personal data.
4. Validate idea and model providers
Idea text and related prompts are sent to a third-party language-model API so we can generate a validation report. That provider processes the text to return a result. Do not submit secrets, passwords, or information you are not allowed to share. Validation inputs and outputs are stored on your account for you to revisit; they are not posted to the public case wall unless you later ask us to publish and we agree.
5. Payments (Creem)
Creem acts as Merchant of Record. When you buy credits, Creem processes payment under its own privacy policy. We store order identifiers, product/pack references, credit amounts, and status so we can add credits and handle support. Refunds and payment disputes may require sharing necessary order and account email details with Creem or payment networks.
6. Cookies and similar tech
We use essential cookies for authentication and session continuity. We do not currently run a separate advertising cookie stack on the product. If we add optional analytics cookies later, we will update this policy and, where required, ask for consent.
7. Sharing
We share data only as needed to run the Service: hosting and database providers; Better Auth-related infrastructure on our servers; Creem for payments; the configured model provider for validate idea; and professional advisors or authorities when the law requires it. We do not sell mailing lists or validation ideas to third parties for their marketing.
8. Retention
We keep account, credit, unlock, order, and validation records while your account is active and for a reasonable period afterward so we can handle support, accounting, chargebacks, and legal duties. Server logs are kept for a shorter operational window. You can ask us to delete your account; we will remove or anonymize personal data we control, except records we must keep (for example paid invoices or fraud prevention) for as long as the law requires.
9. Security
We use standard protections such as encrypted transport (HTTPS), hashed passwords, and access controls on staff tools. No online service is perfectly secure. If you suspect unauthorized access, contact [email protected].
10. Your choices and rights
You can update account email/password through the product where those controls exist, stop using the Service, and email [email protected] to request access, correction, or deletion of personal data we hold. Depending on where you live (for example the EEA, UK, or similar regimes), you may also have rights to object, restrict processing, or lodge a complaint with a local regulator. We will respond within a reasonable time.
11. Children
The Service is not directed at children under 16 (or the higher age required in your country). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
12. International processing
We and our processors may handle data in countries other than yours, including where our hosting, Creem, or the model provider operate. Where required, we rely on appropriate transfer safeguards used by those providers.
13. Changes
We may update this Privacy Policy when the product or the law changes. We will change the effective date above and post the new version on this page. Continued use after an update means you acknowledge the revised policy for later use.
14. Contact
Privacy questions or data requests: [email protected]. Website: www.sopbull.com.