Privacy Policy

1. Scope

This policy explains how SOMA Beverages Pvt. Ltd. ("SOMA", "we") handles personal data collected through getsoma.store, our Shopify-powered shop, our waitlist and contact forms, and customer support. It is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

2. What we collect

Order data: name, delivery address, phone number, email, and order history — collected when you buy from us, because we need it to fulfil your order.

Payment data: processed by our payment providers (e.g. Shopify Payments / Razorpay or the gateway shown at checkout). We never see or store your full card number, UPI PIN, or banking credentials.

Waitlist and contact data: your email address and anything you write to us via forms or email.

Technical data: standard server logs (IP address, user agent, pages requested) used for security and performance. Our public agent interfaces (/api/mcp, /api/nutrition) are anonymous and require no account.

Age confirmation: your response to our 18+ age gate is stored only in your own browser (localStorage key 'soma-age-verified') — it never reaches our servers.

3. What we do NOT collect

We do not run third-party advertising trackers on this website, we do not sell or rent your personal data to anyone, and we do not build advertising profiles from your purchases.

4. How we use your data

To fulfil and deliver orders, process refunds, and provide support; to run your subscription if you have one; to send you the emails you asked for (waitlist, launch updates, order notifications); to keep the service secure; and to meet legal obligations such as tax and food-safety record-keeping.

Marketing email is sent only if you opted in, and every marketing email includes an unsubscribe link that works immediately.

5. Who we share it with

Only the service providers needed to run SOMA: our e-commerce platform (Shopify), payment gateways, delivery partners (who receive your name, address, and phone number to deliver your order), our customer-relationship and messaging platform (Brevo, which stores the name, email, and phone number you give us at signup so we can reach you by email, SMS, or WhatsApp), and our hosting infrastructure. Each processes data under contract and only for the purpose we engaged them for.

You can opt out of marketing messages at any time — every email carries an unsubscribe link, and replying STOP on SMS or WhatsApp (or just telling us) removes you from those channels.

We disclose data to authorities only where required by law.

6. Cookies and local storage

getsoma.store uses Google Analytics to understand aggregate traffic — which pages are read and how visitors reach the shop. This sets Google's first-party measurement cookies (_ga and _ga_*). Your browser also stores two things locally on your own device: the 18+ age-gate confirmation and your cart contents; neither is transmitted to us.

shop.getsoma.store runs on Shopify, which sets first-party cookies: essential ones for cart, checkout, and localization, plus Shopify's own analytics cookies (such as _shopify_y and _shopify_s) that give us aggregate store statistics like visits and conversion. We do not use third-party advertising cookies on either site.

7. Retention

Order and invoice records are retained as long as Indian tax and food-safety law requires. Waitlist emails are kept until you unsubscribe. Server logs are rotated on a short cycle. When data is no longer needed, it is deleted or anonymised.

8. Your rights

Under the DPDP Act you may request access to the personal data we hold about you, correction of inaccurate data, erasure where we no longer need it, and withdrawal of consent for marketing at any time. You may also nominate a person to exercise these rights on your behalf.

To exercise any right, email hello@getsoma.store with the subject "Privacy request". We respond within the timelines prescribed by law. If you are unsatisfied, you may complain to the Data Protection Board of India.

9. Children

Our site and products are intended for adults 18+. We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact us and we will delete it.

10. Security

The site is served over HTTPS with modern security headers. Payment flows are handled by PCI-DSS-compliant providers. Access to customer data is limited to the people who need it to serve you.

11. Changes

We will post updates to this policy on this page and, where changes are material, notify subscribers by email. Continued use of the site after an update constitutes acceptance of the revised policy.