Privacy Policy

1. Scope

This policy explains how SOMA Beverages Pvt. Ltd. ("SOMA", "we") handles personal data collected through getsoma.store, our Shopify-powered shop, our waitlist and contact forms, and customer support. It is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

2. What we collect

Order data: name, delivery address, phone number, email, and order history — collected when you buy from us, because we need it to fulfil your order.

Payment data: processed by our payment providers (e.g. Shopify Payments / Razorpay or the gateway shown at checkout). We never see or store your full card number, UPI PIN, or banking credentials.

Waitlist and contact data: your email address and anything you write to us via forms or email.

Technical data: standard server logs (IP address, user agent, pages requested) used for security and performance. Our public agent interfaces (/api/mcp, /api/nutrition) are anonymous and require no account.

Age confirmation: your response to our 18+ age gate is stored only in your own browser (localStorage key 'soma-age-verified') — it never reaches our servers.

3. What we do NOT collect

We do not run third-party advertising trackers on this website, we do not sell or rent your personal data to anyone, and we do not build advertising profiles from your purchases.

4. How we use your data

To fulfil and deliver orders, process refunds, and provide support; to run your subscription if you have one; to send you the emails you asked for (waitlist, launch updates, order notifications); to keep the service secure; and to meet legal obligations such as tax and food-safety record-keeping.

Marketing email is sent only if you opted in, and every marketing email includes an unsubscribe link that works immediately.

5. Who we share it with

Only the service providers needed to run SOMA: our e-commerce platform (Shopify), payment gateways, delivery partners (who receive your name, address, and phone number to deliver your order), email service providers, and our hosting infrastructure. Each processes data under contract and only for the purpose we engaged them for.

We disclose data to authorities only where required by law.

6. Cookies and local storage

getsoma.store uses no advertising cookies. We use essential local storage for the 18+ age gate and, on the shop, Shopify's essential cookies for cart and checkout functionality.

7. Retention

Order and invoice records are retained as long as Indian tax and food-safety law requires. Waitlist emails are kept until you unsubscribe. Server logs are rotated on a short cycle. When data is no longer needed, it is deleted or anonymised.

8. Your rights

Under the DPDP Act you may request access to the personal data we hold about you, correction of inaccurate data, erasure where we no longer need it, and withdrawal of consent for marketing at any time. You may also nominate a person to exercise these rights on your behalf.

To exercise any right, email getsoma.store@gmail.com with the subject "Privacy request". We respond within the timelines prescribed by law. If you are unsatisfied, you may complain to the Data Protection Board of India.

9. Children

Our site and products are intended for adults 18+. We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact us and we will delete it.

10. Security

The site is served over HTTPS with modern security headers. Payment flows are handled by PCI-DSS-compliant providers. Access to customer data is limited to the people who need it to serve you.

11. Changes

We will post updates to this policy on this page and, where changes are material, notify subscribers by email. Continued use of the site after an update constitutes acceptance of the revised policy.