Privacy Policy

This website is run by Soul Science Limited (RC 9661083), No. 11 Dideolu Court, Ogba, Lagos State, Nigeria. In this policy, “we”, “us” and “our” mean Soul Science Limited, and “you” means anyone who visits the website or writes to us through it.

We are the controller of the personal data described here. Put simply, we decide why and how it’s used, and we answer for it under the Nigeria Data Protection Act 2023 and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR).

This policy covers this website only. Our app DreamTrak has its own Privacy Policy, which applies when you use it.

When you write to us

The contact form asks for:

• the topic you choose (Partnerships, Research, Press or Hello);
• your name;
• your email address, so we can reply;
• the name of your organisation, if you choose to give it;
• your country; and
• your message.

Your message can hold whatever you choose to tell us. Please leave out sensitive details, such as about your health or beliefs, unless you want us to know them. If you include them, we use them only to answer you.

To guess your country, the form asks our hosting provider, Cloudflare, which country your connection comes from, and pre-selects it for you to change if it’s wrong. When you send a message, that country (for example “Ghana”, not your address) is added to the email we receive, beside the one you chose.

The form also has a hidden field that people never see. Messages that fill it in, which are almost always sent by spam bots, are discarded without being sent to us. The form notes how long it was open before you sent it, and it asks you to change a message with more than two links, a shortened link, or a throwaway email address. None of this is kept.

To keep automated spam out, the form also uses Cloudflare Turnstile. Once you start filling in the form, it loads a small script from Cloudflare that checks your browser for signs of automation, usually without asking you to do anything. For this, Cloudflare reads your IP address, your browser’s user agent and details of its secure connection, as its Turnstile Privacy Addendum explains.

When you visit

Like any website, ours receives your device’s IP address and standard details about each request, such as your browser type, the page asked for and the time, so that it can send the page to you. Our hosting provider may keep these in short-term technical logs.

When you send a message, our server also notes your IP address (for newer IPv6 addresses, only its network part) to limit how often messages can be sent: five every ten minutes. That note is held only in the memory of the server that handled your message and is never written to a file or database. It counts for ten minutes, and is cleared after that the next time the form is used, or when the server restarts.

What we don’t collect

• We don’t ask you to create an account.
• We don’t use cookies, analytics, advertising or tracking tools.
• We don’t load fonts, scripts or anything else from other companies as you browse. The one exception is Cloudflare’s Turnstile check, which loads only once you start filling in the contact form.

Reading and answering your message

Our legitimate interest in replying to messages people choose to send us. Where you’re asking about working with us, taking the steps you’ve asked for before an agreement.

Keeping the form safe

Our legitimate interest in a secure, working website. This is what the hidden field, the sending limit, the checks on links and email addresses, and Cloudflare Turnstile are for.

Meeting legal duties

A legal obligation, if one ever applies, such as a lawful request from an authority.

We don’t add you to a mailing list, use your details for marketing, sell them, or make automated decisions about you. If we ever want to send you something you didn’t ask for, we’ll ask you first.

• Resend (Plus Five Five, Inc., United States) turns each message from the form into an email to our inbox, with your address set as the reply address so that our answer goes straight to you.
• Our email provider hosts the inbox where your message arrives and where our conversation with you is kept.
• Cloudflare (Cloudflare, Inc., United States) hosts the website and runs the code that handles the form. It also tells us which country a visitor’s connection comes from, and provides Turnstile, the check that keeps automated spam out of the form.

These providers handle your data to provide their service to us. Resend and Cloudflare do so under data processing agreements that form part of their terms. Cloudflare also uses Turnstile’s signals to improve its bot detection, for which it is responsible itself, as its Turnstile Privacy Addendum explains.

We may also share information if the law requires it, to protect someone’s safety or our legal rights, or with a new owner if Soul Science Limited’s business changes hands, in which case this policy keeps applying to it. If we change any of the providers above, we’ll update this page.

Resend processes data mainly in the United States. Cloudflare serves the website from data centres around the world, usually one near you, and our email provider may process data in other countries too. Wherever it goes, it’s handled as this policy describes.

For transfers out of Nigeria, we rely on the grounds the Nigeria Data Protection Act 2023 allows, including our providers’ contractual commitments to protect the data. Where EU or UK law applies, Resend’s data processing agreement includes the European Commission’s Standard Contractual Clauses and the UK Addendum to them. You can ask us for details.

Your message and our replies

In our inbox for up to two years after our last exchange, then deleted, unless it leads to an agreement or the law requires us to keep it longer.

Resend’s copy

Resend keeps each email and its delivery record for up to 30 days on its standard plans, so delivery problems can be traced.

The sending-limit note

Ten minutes in server memory, as described above.

Technical logs

For the short periods our hosting provider, Cloudflare, sets.

Turnstile’s signals

For as long as Cloudflare’s Turnstile Privacy Addendum and privacy policy describe.

You can ask us to delete your message sooner at any time.

The form sends your message over an encrypted connection, and our server passes it on to Resend over an encrypted connection too. The inbox address and the keys that send email are kept in private server settings, never in the website’s pages. Access to the inbox is limited to the people who answer enquiries.

No system is perfectly secure. If a breach puts your personal data at risk, we’ll tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the law requires, and we’ll tell you directly where it’s likely to put your rights at high risk.

Under the Nigeria Data Protection Act 2023, and the GDPR where it applies to you, you can ask us to:

• tell you whether we hold personal data about you, and give you a copy;
• correct anything that’s wrong;
• delete it;
• restrict how we use it while a concern is looked into;
• stop using it, if you object to our use of it based on our legitimate interests; and
• give it to you, or to someone you choose, in a common, portable format.

How to ask

Send us a message through the contact form, choosing “Hello”, or write to us at our registered address. Please use the email address you wrote to us from, so we can find your messages and confirm the request is yours. We’ll reply within 30 days.

If you’re unhappy

Please tell us first, and we’ll try to put it right. You can also complain to the Nigeria Data Protection Commission or, if you’re in the EU or the UK, to the data protection authority where you live, which in the UK is the Information Commissioner’s Office.

We don’t set cookies, and we don’t use analytics, advertising pixels or social media plugins. Our own pages don’t save anything in your browser as you use them.

The one exception is a design tool our team uses to adjust the page’s visuals. It appears only if “?tune” is added to the web address, and it then saves its own slider settings in your browser’s local storage. Those settings stay on your device, hold nothing about you, and are never sent to us.

When you use the contact form, Cloudflare’s Turnstile check runs in your browser to tell people from automated programs. Cloudflare treats the signals it reads as strictly necessary for that, and explains how it handles them in its Turnstile Privacy Addendum and cookie policy.

If we ever add cookies or analytics that aren’t strictly necessary, we’ll update this page and ask for your consent first.

We don’t knowingly collect personal data from children. Under the Nigeria Data Protection Act, a child is anyone under 18, and their data needs a parent’s or guardian’s consent. If you believe a child has sent us a message without it, let us know and we’ll delete it.

We’ll update this policy when our website, our providers or the law change. The effective date at the top shows when the current version began. If a change means we want to use your data in a new way, we’ll ask you first where the law requires it.

Company

Soul Science Limited

Registration

RC 9661083, Corporate Affairs Commission, Nigeria

Registered address

No. 11 Dideolu Court, Ogba, Lagos State, Nigeria

Write to us

Through the contact form on our home page

Regulator

The Nigeria Data Protection Commission, or the data protection authority where you live