SOMA

Privacy notice

Last updated: October 2026 · Version 1.1

This notice explains what personal data we collect through thesoma.app, why we collect it, and the rights you hold over it. It is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and is written to be read, not to be survived.

1. Responsible Entity & Scope

Global Ultra, LLC, which operates the SOMA brand ("SOMA", "we", "us", or "the Firm"), with commercial desks in Mexico City, Madrid and Ibiza, is responsible for the legitimate, controlled, and informed processing of your personal data. You can reach our Data Protection & Compliance Officer directly at admin@thesoma.app or via direct WhatsApp desk at +52 56 3955 7580.

This Privacy Notice governs all data collected across our web platforms (thesoma.app, including client briefs and ambassador representations), direct concierge channels, and private communication systems.

2. Personal Data We Collect

We adhere to strict data minimization principles. We only collect information that you expressly and voluntarily provide across our interaction streams:

• Private Client Briefs: Full name, contact email, WhatsApp or telephone number, destination preferences, booking itineraries (private aviation, yacht charters, off market stays, bespoke buyouts), estimated magnitude, urgency, mood and privacy requirements, and referral context.
• Ambassador Network Applications: Full name, verified contact channels (WhatsApp, phone, email), primary residential/operating hub, social verification handles (Instagram/LinkedIn), target client demographics, commercial priorities, acquisition channels, and 30 day source mapping notes.
• Partner & Allied Operator Inquiries: Organization name, commercial profile (air, sea, stays, venues, luxury brands), operating markets, frequency, and contact credentials.
• Your Client Profile: What you, or someone acting on your behalf, tell us in your requests and conversations so we can serve you better: birthdays and anniversaries, the people you travel or celebrate with (such as a partner, children or an assistant), tastes and things you prefer to avoid, dietary needs and allergies, favourite destinations, hotels, restaurants and brands, and items you are interested in acquiring. Section 4 explains how this profile works and how you control it.
• SOMA App Accounts: The email address you sign in with (by one-time code, never a password), the device token needed to send you notifications if you allow them, and the messages you write to the team inside the app.
• Seller Attribution: If you reach SOMA through a personal link shared by one of our independent sellers (thesoma.app/r/…), we record which seller introduced you so the introduction is credited to them.
• Technical & Sourcing Metadata: Campaign attribution parameters (UTM tags), referrer origin, timestamps, and encrypted server logs.

Sensitive Data Policy: SOMA does not solicit sensitive personal data (such as political affiliations, religious beliefs, sexual orientation, biometric data, or health records) and our systems are instructed never to record it. The single exception is dietary needs and food allergies that you choose to tell us, for you or for the people travelling with you, which we keep only so that no one at your table is put at risk; we ask for your express consent before keeping them, and you can delete them at any time. Any other medical or security requirement needed for confirmed flights or private vessel manifests is requested exclusively through private, encrypted channels with your explicit consent and is not added to your profile. We never record bank or card details, identity documents or passwords in your profile.

3. Purpose of Data Processing

Your data is collected strictly for the following Primary Purposes, necessary to fulfill your relationship with SOMA:

• Reviewing, qualifying, and preparing defensible, highly curated proposals for private travel, aviation, charters, and exclusive access.
• Evaluating ambassador representation candidacies and managing confidential CRM territory allocation.
• Coordinating with certified charter operators, private aviation managers, villa directors, and discreet ground hospitality providers to execute confirmed bookings.
• Remembering your preferences and the important dates of the people close to you, so that each request starts from what we already know about you (Section 4).
• Keeping you informed, by email, inside the SOMA app and, if you allow it, through notifications on your phone, each time your request moves forward: received, proposal ready, confirmed, ready to pay, and paid.
• Writing to you personally, for example on an important date, through the channel you use most with us (WhatsApp, email, Instagram or the SOMA app). Messages that offer new services are secondary purposes and you can opt out of them as described below.
• Crediting the independent seller who introduced you, when you arrived through their link.
• Maintaining institutional records, invoicing, and adhering to applicable legal and tax compliance obligations.

Secondary Purposes: Occasionally notifying you of off market openings, private seasonal calendar circuits (summer/winter), or private networking gatherings relevant to your profile. You may opt out of secondary purposes at any time by emailing admin@thesoma.app with the subject "Opt out Secondary Communications".

4. Your Client Profile & Personalisation

To be the first call our clients make, we remember what matters to you. Each client has a private profile that grows with every request and conversation you have with SOMA.

• How it is built: From what you write to us or tell us, from what our team adds after speaking with you, and from what you correct yourself. Our systems use automated tools, including artificial intelligence models, to read your requests and conversations and note only facts that were stated explicitly. Nothing is guessed, bought from third parties, or gathered from social media or public sources.
• What it is for: Anticipating birthdays and anniversaries, remembering how you like things done, avoiding what you dislike or cannot eat, and suggesting ideas that fit you, shown in the app under "For you". These suggestions are ideas only: nothing is booked, charged or confirmed until you ask for it and a person from our team replies. No decision with legal or similarly significant effects on you is ever made automatically.
• Family members and children: We record people close to you only from what you share with us, and you confirm you are entitled to share it. For children we keep the minimum useful to plan for them: first name, age or date of birth, and relevant preferences or allergies. We never contact minors, never build profiles of them beyond this, and never share their information except where strictly necessary to deliver a service you requested (for example, an allergy communicated to a restaurant).
• Acquisitions: If you tell us you are interested in acquiring a car, artwork, property, watch or other asset, we keep that interest so we can source and present options. SOMA provides sourcing and access only; we do not provide financial or investment advice.
• You are in control: In the SOMA app, under Account → Your profile, you can see what we know about you, correct it, add to it, or delete any item. Anything you delete is not learned again from past or future conversations. Internal working notes of our team are not shown in the app, but you may request them under Section 7. You may also ask us to stop personalising your service entirely by writing to admin@thesoma.app; we will delete your profile and stop building it, while keeping the records of your requests that we must retain by law.
• Who sees it: Only SOMA's administrators and operations staff. Team members who only answer messages, and the independent sellers in our network, cannot see your profile. A seller who introduced you sees only the name and status of the requests credited to them, never your conversations, preferences or family information.

5. Discretion, Sharing & Transfers

Discretion is the founding principle of SOMA. We do not sell, rent, monetize, or trade your personal data to third parties or advertising brokers under any circumstance.

Transfers of personal data are strictly limited to:

• Execution Partners: Verified aircraft operators, yacht captains, villa hosts, and discreet logistics providers strictly as necessary to execute reservations confirmed by you.
• Infrastructure Providers: Encrypted hosting and serverless architecture (Netlify Inc., USA), and direct communications infrastructure. All providers operate under strict confidentiality agreements adhering to international data security frameworks.
• Communication and Notification Providers: Email delivery (Google LLC and Resend, Inc., USA), WhatsApp and Instagram messaging (Meta Platforms, Inc., USA), and phone notifications for the SOMA app (Google Firebase Cloud Messaging and Apple Push Notification service, USA), used only to deliver the messages and notices described in this notice.
• Artificial Intelligence Processing: To read requests, keep your profile and prepare suggestions, the relevant text is processed by language-model providers accessed through OpenRouter, Inc. (USA). These providers process the text to return a result and may operate servers outside Mexico; we send only what each task needs and never payment or identity data.
• Payment Processing: Payments are handled by Stripe, Inc. (USA). SOMA never receives or stores your full card details.

6. Retention & Confidentiality Standards

Briefs and inquiries that do not materialize into confirmed engagements are retained for a maximum of 24 months to recognize returning clients and preserve continuity of service. Records relating to executed commercial engagements are archived in encrypted storage for statutory periods required by commercial, civil, and tax laws, after which they are irreversibly destroyed or anonymized. Your client profile is kept while you remain an active client and is deleted 24 months after your last interaction with SOMA, or earlier if you ask us to.

7. Your ARCO & Privacy Rights (GDPR & LFPDPPP)

Whether you are located in Mexico, the European Union, the United Kingdom, or the Americas, you possess full sovereignty over your personal data. You have the right to:

• Access: Request confirmation of what personal data we hold about you and how it is processed.
• Rectification: Request correction of inaccurate, outdated, or incomplete data.
• Cancellation / Erasure: Request the deletion of your data from our active databases.
• Opposition: Object to processing for specific purposes or revoke previously granted consent.

To exercise any of these rights, submit a written request to admin@thesoma.app indicating your full name, the specific right you wish to exercise, and a valid identification for verification. We process and respond to all requests within 15 to 20 business days. Many of these rights can also be exercised immediately and without a written request in the SOMA app, under Account → Your profile.

8. Cookies & Tracking Technologies

Our website utilizes zero invasive third party tracking cookies, behavioral ad pixels, or surveillance scripts. We only process session parameters necessary to maintain secure browsing and attribution tags to understand how you arrived at our site.

9. Security Architecture

All data submitted to SOMA is transmitted via TLS 1.3 encryption (HTTPS) with strict HTTP Strict Transport Security (HSTS). Internal access is restricted on a least privilege basis exclusively to authorized executive and operations personnel.

10. Modifications to this Notice

We may update this Privacy Notice periodically to reflect operational, legal, or regulatory enhancements. Any updates will be published immediately on this page with the corresponding version and revision date.