Privacy Policy
Last updated September 19, 2026
This explains what Sooma (sooma.dev) collects, why, and who else sees it. Questions or requests: hello@sooma.dev.
What we collect
Account details. Your name, email address and workspace name, given at signup. API keys are stored only as a hash; we cannot read them back.
Runs. For every call: the tool, the input you sent, the output the provider returned, the time, and what it cost. This is what powers your usage page, GET /v1/runs/:id and our billing.
Payments. Card top-ups are handled by Stripe. We never see or store your card number; we keep the amount, the date and Stripe's payment reference.
Session cookie. One httpOnly cookie keeps you signed in to the dashboard. We do not use advertising or cross-site tracking cookies.
How we use it
To run the service: execute your calls, keep your balance correct, show you your history, prevent abuse, and debug failures. We use your email for account and billing messages, and occasionally to tell you about significant product changes; you can opt out of anything that is not essential by replying to it. We do not sell your data and we do not use your inputs or outputs to train models.
Who else sees it
The provider behind each tool. When you run a tool, the input you send is forwarded to that provider (for example Hunter, Apify, fal.ai or TikHub) so it can answer. Providers see the request as coming from Sooma, not from you, but the content of the input is yours, so do not send anything you would not send to that provider directly.
Our infrastructure. Vercel hosts the application, Supabase hosts the database and file storage (United States), and Stripe processes payments. Each acts on our instructions.
We disclose data beyond that only if the law requires it or to protect Sooma and its users from fraud and abuse.
Retention
Run inputs and outputs are kept while your workspace exists so you can retrieve them, and may be purged after 30 days. Files produced by runs are reachable for 7 days. Ledger and payment records are kept as long as tax and accounting rules require. Delete your workspace by writing to us and we remove the account details and run history within 30 days.
Your rights
Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it, and we will do so within 30 days. If you are in the EU, UK or California you have these rights by law, along with the right to complain to your regulator.
Data about other people
Some tools return information about third parties, such as business contact details. For that data you are the one deciding why and how it is used, and you are responsible for handling it lawfully. If you are a person whose data appeared in a result and you want to raise it, write to us and we will point you to the provider that holds it.
Changes
If this policy changes in a way that matters, we will email the address on your workspace before the change takes effect.