Effective date: 21 June 2026
Soira (“Soira”, “we”, “us”, “our”) is a resource hub and private diary for parents and caregivers of autistic and neurodivergent children. We know the information you keep here is sensitive — it concerns your family and your child. This policy explains what we collect, why, how we protect it, who we share it with, the choices you have, and how the rules differ depending on where you live. It applies to the Soira website and mobile app (the “Service”).
Soira is the controller of the personal information processed through the Service. Soira is operated from Johor Bahru, Malaysia. For any privacy request or question — or to reach the person responsible for data protection — contact us at hello@soira.ai.
We use your information solely to provide and protect the Service: to operate your account, store and display your diary and child profiles back to you and the Care Circle members you authorise, generate AI responses when you use Lumi, process subscriptions, send transactional emails (verification, password reset, invitations, and important service notices), and detect and prevent abuse.
Depending on your location, the lawful bases we rely on are: the performance of our agreement with you (operating your account and the features you use); your consent (which you give for sensitive child information and for using Lumi, and which you can withdraw at any time); our legitimate interests in keeping the Service secure and working; and compliance with legal obligations.
We do not sell your personal data, we do not share it with advertisers, and we do not use your diary content or your child's information to train AI models.
Lumi is an AI guide powered by Google's Gemini models. When you chat with Lumi, your messages are sent to Google to generate a reply. If you open Lumi while a specific child is selected, we also send a small, bounded context to help ground the suggestions: a few profile facts (such as approximate age, gender, and diagnosis status) and a short digest of that child's diary entries from roughly the last 30 days. We never send the child's name to the AI provider.
We use Google's paid AI service. Under Google's terms for that service, Google does not use your prompts or the AI's responses to train its models; data may be processed transiently and retained for a limited period only for security, abuse prevention, and legal compliance. Before your first chat, Lumi shows a consent notice explaining that it is an AI guide and not a clinician. AI responses are generated automatically and can be inaccurate or incomplete; Lumi does not make any decision that produces a legal or similarly significant effect about you or your child.
Sensitive fields — child names and notes, diary entry content, and Lumi message content — are encrypted at rest using AES-256-GCM, so they are not readable directly in the database. Traffic is served over HTTPS (TLS). Access is rate-limited, and security-relevant actions are recorded in an audit log.
Soira is intended for use by parents and caregivers who are adults, not by children, and it is not directed to children. The information about a child in Soira is provided by the adult who owns the account. Information about a child's health and development can be a special category of data under laws such as the GDPR; we process it on the basis of your explicit consent and the controls you set. Please only record information you are entitled to share, and use the Care Circle controls to limit who can see it. If you believe a child's data has been added without authority, contact us at hello@soira.ai and we will act promptly.
When you invite someone to a child's Care Circle, they can see that child's information and diary at the permission level you set (for example, viewer or editor). You control these invitations and can change a member's permissions or remove them at any time.
We use a small number of trusted providers (processors) to run Soira. They process data only on our instructions and under their own security and data-protection obligations:
Soira is operated from Malaysia and hosted in Singapore, and some of our providers process data in other countries (including the United States and the European Union). Where we transfer personal data across borders, we rely on appropriate safeguards — such as the providers' standard contractual clauses and data-processing agreements — to protect your information consistent with this policy and applicable law.
We keep your information for as long as your account is active. You can delete your account and all associated data at any time from Settings. When you delete your account it enters a 30-day grace period during which signing back in cancels the deletion; after the grace period the data is permanently and irreversibly removed. In addition:
Depending on where you live, you may have the right to access, correct, export (data portability), or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time without affecting processing already carried out. You can delete your account directly in Settings, and you can download a machine-readable export of your data from your account. For any other request, email us at hello@soira.ai and we will respond within the time required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.
Wherever you are, we aim to apply a single high standard of protection. Some specific notes:
If a personal-data breach occurs that is likely to affect you, we will notify the relevant data-protection authority and, where required, affected users without undue delay and in line with applicable law.
We may update this policy as Soira evolves. When we make material changes, we will update the effective date above and, where appropriate, notify you.
For any privacy question or request, contact us at hello@soira.ai.