Privacy Policy

1. Introduction

Welcome to SohaAI Studio ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at sohaai.studio and any related services (collectively, the "Service"). The Service is operated by SohaAI, which is the controller of your personal data for the purposes of UK and EU data protection law.

2. Information We Collect

We collect the following categories of information:

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture from Google's OAuth service.
• Usage Data: We collect information about how you interact with the Service, including the tools you use, content you generate, and settings you configure.
• User-Generated Content: Text prompts, images, videos, and audio files you create or upload while using the Service.
• Technical Data: IP address, browser type, operating system, and device identifiers collected automatically when you access the Service.
• Connected Social Accounts: If you choose to connect a social account (such as TikTok or YouTube), we receive and store your identity on that platform and the access tokens needed to publish on your behalf. See section 5.
• AI Assistant Apps: If you use SohaAI Studio from ChatGPT, Claude or another assistant, we receive the account link you approve and the prompts, settings and files that assistant sends us for you. See section 6.
• Payment Information: If you purchase a subscription, payment details are processed securely by our payment provider and are not stored on our servers.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process AI generation requests on your behalf
• Publish content you have scheduled to social accounts you connected
• Manage your credit balance and subscription plan
• Send administrative notifications (e.g., account updates, usage alerts)
• Improve and develop new features
• Comply with legal obligations

3a. Legal Basis for Processing

Under UK and EU data protection law (the UK GDPR, the Data Protection Act 2018 and the EU GDPR) we must have a lawful basis for each use of your personal data. We rely on:

• Performance of a contract — to provide the Service you signed up for under our Terms of Service: your account and sign-in, running the generations you ask for (on our site, through our API or through an AI assistant app you connected), storing your content, publishing what you schedule, and managing your credits and subscription.
• Legitimate interests — to keep the Service secure and working: request logs, rate limiting, preventing fraud and abuse, enforcing our Terms, fixing problems and improving features. We only rely on this where our interests are not overridden by your rights, and you can object to it (see Your Rights).
• Legal obligation — to keep payment and tax records and to respond to lawful requests from authorities.
• Consent — where we ask for it, such as marketing emails. You can withdraw consent at any time, for example with the unsubscribe link in any email, without affecting processing that took place before.

4. Google OAuth & Sign-In

We use Google OAuth 2.0 solely for authentication. When you sign in with Google, we receive your name, email address, and profile picture. We do not access your Google Drive, Gmail, or any other Google service beyond the basic profile information required for sign-in. We do not share your Google account data with third parties.

5. Connected Social Accounts

The Service can publish content you create to social platforms you choose to connect, including TikTok, YouTube, Instagram, Facebook, LinkedIn, and X. Connecting an account is always optional, and you can use every other part of the Service without doing so.

When you connect an account, that platform asks you to authorize the connection and then gives us a limited set of information, which we store:

• Your identity on that platform: the account identifier, display name or username, and profile picture, so we can show you which account a post will be published to.
• Access and refresh tokens: the credentials that let us publish on your behalf. These are stored in our database and are never shown to other users, shared with third parties, or used for any purpose other than the actions you ask for.
• The permissions you granted, so we can tell you when a connection is missing something a post needs.
• Your posting options: where a platform requires you to choose settings for each post — on TikTok, the audience, whether comments, duets and stitches are allowed, and whether the video promotes a brand — we store the choices you made alongside the post, and send them to the platform exactly as you set them.

We use this information only to publish the content you have asked us to publish, at the time you chose, to the account you connected. Specifically:

• We never post anything you did not create or upload in the Service and then explicitly schedule or publish.
• We do not read your feed, your followers, your messages, or any content on your account.
• We do not use your connected-account data for advertising, analytics, or profiling, and we never sell it.
• We do not share it with other users of the Service or with any third party.

You can disconnect any account at any time under Settings → Connections. Doing so immediately and permanently deletes the stored tokens and profile information for that account from our database. You can also revoke our access from within the platform's own settings, which has the same effect. Deleting your SohaAI Studio account removes all connected accounts along with it.

Once content leaves the Service it is governed by the receiving platform's own terms and privacy policy. For TikTok, see the TikTok Privacy Policy. Deleting a post inside SohaAI Studio does not remove it from a platform it has already been published to; you delete it there.

6. ChatGPT, Claude & Other AI Assistant Apps

You can use SohaAI Studio from inside an AI assistant — for example the SohaAI Studio app in ChatGPT (provided by OpenAI) or the SohaAI Studio connector in Claude (provided by Anthropic). These assistants reach us through our Model Context Protocol (MCP) server at sohaai.studio/mcp. In this role OpenAI or Anthropic is the host of the integration: you talk to their assistant, and it decides when to call SohaAI Studio on your behalf. When you connect one, we receive:

• The account link: you sign in to SohaAI Studio and approve the app on our own sign-in screen (OAuth). We record which app you approved, when, and the access and refresh tokens we issued to it. Generations it runs are billed to your credits.
• What the assistant sends with each request: the prompt it writes for you, the settings it chooses (model, length, aspect ratio and similar), and any images, videos or audio files you share in the conversation and ask it to use, sent to us as files or links.
• Technical data about each request, such as the time, the app making it and the IP address it comes from. We use the IP address only to route and rate-limit the request; our application logs do not store it (see Data Retention).

We do not receive your conversation with the assistant, your chat history, or your OpenAI or Anthropic account details — only what the assistant sends us when it calls a SohaAI Studio tool. We send back the result: links to the files we generated and the status of the job, which the assistant can show you in the conversation. What you and the assistant do with that result inside ChatGPT or Claude is governed by OpenAI's or Anthropic's own privacy policy.

How tokens are stored: we keep only a one-way cryptographic hash (SHA-256) of each access and refresh token, never the token itself, so a copy of our database cannot be used to act as you. Access tokens expire after 30 days and refresh tokens after 180 days.

Disconnecting: go to Settings → AI Assistants & MCP → Connected apps and choose Revoke. This one page lists every assistant you have connected — ChatGPT, Claude or any other. The app's tokens stop working immediately and it can no longer reach your account. You can also remove the app from within ChatGPT or Claude (in their apps or connectors settings), which stops the assistant from using it; revoking in SohaAI Studio also cancels the tokens on our side. Prompts, files and results from these requests are kept like any other generation in your account (see Data Retention) and can be deleted by you at any time.

7. Third-Party AI Services

To power AI generation features, your prompts and uploaded content may be transmitted to third-party AI providers including OpenAI, Google Gemini, Runway, Fal.ai, and ElevenLabs. These providers process your data under their own privacy policies. We do not sell your prompts or generated content to any third party. OpenAI and Anthropic can also be the host of an assistant app you use SohaAI Studio from; that separate role is described in section 6.

8. Data Storage & Security

Your data is stored in secure cloud infrastructure: our application and database are hosted with Railway, and generated and uploaded files (images, videos, audio) are stored in Cloudflare R2 object storage with access controls. We implement industry-standard security measures including HTTPS encryption, database encryption at rest, and access logging. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8a. International Transfers

Several of the providers we rely on — for hosting, file storage, payments and AI processing (see sections 7 and 10) — are based in, or process data in, the United States and other countries outside the UK and the European Economic Area. When your personal data is transferred outside the UK or EEA, we make sure it is protected by one of the safeguards UK and EU data protection law recognises: an adequacy decision or UK adequacy regulations for the destination (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified), or the Standard Contractual Clauses approved by the European Commission together with the UK International Data Transfer Addendum, as included in that provider's data processing terms. You can ask us for more information about these safeguards at contact@sohaai.studio.

9. Data Retention

We retain your account information for as long as your account is active. Generated content is stored in your account and can be deleted by you at any time. Access tokens for connected social accounts are kept only while that account is connected, and are deleted as soon as you disconnect it. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, payment records we must keep for tax and accounting purposes).

Request logs: to keep the Service secure and fix problems, we log requests to our website, API and MCP server, including requests from AI assistant apps. These logs record the time, your account, the page or tool called, the result and, for failed requests, the app or browser making it. They do not store your IP address and are deleted automatically after 30 days. Our hosting provider's network logs, which can include IP addresses, are kept for no more than 30 days. Hashed tokens for a connected assistant app are kept until they expire or you revoke them.

10. Sharing of Information

We do not sell your personal information. We may share information with:

• Service Providers: Third-party vendors who assist with hosting, payments, and AI processing, bound by confidentiality agreements.
• Legal Requirements: When required by law, court order, or government authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to you.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to or restrict certain processing
• Data portability (receive a copy of your data)
• Withdraw consent at any time

To exercise any of these rights, contact us at contact@sohaai.studio.

If you are unhappy with how we handle your personal data, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you live in the European Economic Area, you can also complain to the data protection authority in your country.

12. Cookies

We use session cookies solely to keep you logged in during your visit. We do not use third-party advertising cookies or tracking pixels. You may disable cookies in your browser settings, though this will prevent you from signing in.

13. Children's Privacy

The Service is not intended for individuals under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: