Last updated: 22 October 2026
Soola is a campus events and societies platform built for university students in Ireland. We take your privacy seriously. This policy explains what data we collect, how we use it, and your rights under GDPR.
Soola is operated by Soola Ltd, based in Ireland. If you have any questions about this policy or your data, contact us at privacy@soola.org.
When you create an account we collect your university student email address and the university you select. That is all you need to give us to use Soola.
If you choose to add them, we also collect:
As you use Soola we also collect:
We use your data only for the following purposes:
Soola is an independent app. It is not run by, or affiliated with, any university, students' union or society. The society pages, events and newsletters in Soola are set up and managed by the Soola team through our own admin portal. Societies do not have access to it.
Your data is only accessed by the Soola team, and by the service providers listed in §11, which process it on our behalf. We do not share it with any society, university or students' union.
To help keep the platform secure and accountable, we keep a log of actions the Soola team takes in our admin portal, such as adding, deactivating or reactivating a user's society subscription, creating, editing and publishing newsletters, editing events, managing deals and changing society settings. Each entry records who performed the action, what they did, and when. For actions about a specific user, it also identifies that user.
If the Soola team searches for a user by email and no matching account is found, we keep a scrambled (hashed) version of that email together with a partly hidden version (for example, j***@ucd.ie), so we can detect misuse of the search feature. We cannot read the full email address back out from these records.
This log can only be viewed by the Soola team. We use it to investigate misuse, fraud, or disputes, and to keep an accurate record of who is responsible for changes made through the admin portal.
When members of the Soola team use our admin portal, we use Sentry (Functional Software, Inc.) to spot errors and work out what caused them. Sentry acts as our processor, which means it handles this data only on our instructions. The data is stored in Sentry's EU data region (Germany).
When something goes wrong, or when a page loads, Sentry may receive:
We don't store your IP address, and we don't collect cookies, request headers, the contents of requests sent to our servers, or the parts of web addresses that come after a "?" (query strings).
Reporting a bug. If you use the "Report a bug" button, we receive whatever you choose to send, including a screenshot if you add one. Screenshots are not masked, so they show everything on your screen at that moment, which could include users' names or email addresses. Please check your screenshot before sending it.
Uptime checks. Sentry also regularly loads our public login page to check that the admin portal is working. These checks don't involve any personal data, and may be processed outside the EU.
How long we keep it. Sentry keeps this data for 90 days, then deletes it automatically.
The Soola app asks once, after you first sign in, whether you'd like to share usage analytics. If you allow it, the app sends records of how you use it to PostHog (PostHog Inc.), which acts as our processor under a data processing agreement that requires it to protect your data to the same standard as this policy, and stores the data in its EU region. These records are linked to a random account ID, never to your name, email or anything you type. We don't store your IP address or your location. We use this only to understand which parts of Soola are useful and to improve them; not for advertising, and we don't sell or share it. If you don't allow it, the app sends nothing to PostHog. You can turn it off at any time in Profile → Settings → Usage analytics, and sending stops straight away. Analytics records are kept for up to 12 months. To have your analytics records deleted, email privacy@soola.org and we'll delete them within 30 days. While the app is in testing, deleting your account doesn't yet remove analytics records automatically, so email us as well.
Newsletters in Soola are created by the Soola team in our admin portal, either by uploading a PDF or by writing them there. A newsletter can contain text and photos, and these may name or show people, including people who do not use Soola.
A newsletter can only be seen in the app once we publish it, and then only by users subscribed to that society in Soola. Before a photo is stored, we remove the location and camera information saved inside the file. The original uploaded file is deleted as soon as it has been processed, and any that are left over are cleared automatically within two days.
If a newsletter includes a photo of you, or mentions you, and you would like it removed, contact us at privacy@soola.org.
We rely on the following legal bases under Article 6 of the GDPR:
To ensure Soola remains a platform for verified university students only, we validate your email address against your selected university's approved domain(s) during sign up. For example, UCD students must register with a valid @ucdconnect.ie address. Some universities issue more than one valid student domain; emails that do not match any of the selected university's approved domains will not be accepted.
A subscription in Soola is separate from membership of the society itself. Subscribing in Soola does not make you a member of the society, and joining a society does not subscribe you in Soola. Your Soola subscriptions are not shared with the society, your university or your students' union.
Your data is stored securely using Supabase, hosted on servers in the EU (eu-west-1). Our backend servers run on Google Cloud in europe-west2 (London, UK). We use industry standard security practices including encrypted connections and access controls. Only authorised personnel can access user data and only where necessary.
Our hosting provider, Supabase, keeps short-term technical logs to keep the service secure and running. These may include your user ID, email address and IP address. Supabase deletes them automatically after 7 days.
We retain your data for as long as your account is active. If you delete your account, your data, including your name, email and society subscriptions, is deleted immediately from our live systems, other than the admin activity log described below. Copies in our encrypted database backups are removed automatically within 7 days, when those backups expire. We do not automatically re-verify your continued eligibility after sign-up. For example, we do not check whether you have since graduated. Your data is retained on the same terms as any other account until you choose to delete it.
Entries in the admin activity log (§3b) are kept for 24 months, after which they are deleted automatically. Entries about actions that affected you (for example, the Soola team changing your society subscription) keep only the fact that an action happened and when, with your details removed, once your account is deleted; they are also kept until the end of their retention period. To request erasure of your account and personal data, delete your account in the app, or contact us at privacy@soola.org.
Usage analytics records (§3d) are kept for up to 12 months. While the app is in testing, deleting your account doesn't yet remove them automatically; email privacy@soola.org and we'll delete them within 30 days.
Society newsletters, and the photos in them, are kept until we delete them. When we delete a newsletter, it and its photos are removed from our live systems immediately.
As a user based in Ireland or the EU you have the following rights:
To exercise any of these rights contact us at privacy@soola.org. We will respond within 30 days.
The Soola mobile app does not use cookies. If you allow usage analytics, the app stores a random identifier on your phone for that purpose only. If you visit our website, standard analytics cookies may be used to understand traffic. You can opt out at any time.
Soola uses the following third party services which may process your data:
Newsletter content is processed by Anthropic for two purposes only: to convert a newsletter into the version users read in the app, and to extract its event details for display in the app. This covers a PDF we upload, including any photos inside that PDF, and the text of a newsletter written in the admin portal. It is processed under Anthropic's standard commercial API terms. We do not currently have a dedicated zero-retention or model-training exclusion agreement in place. If a newsletter includes another person's details or image (for example, a committee member's name, contact email or photo), that information may also be processed as part of this.
Most of the third-party services listed in §11 are US companies, even in cases where the data itself is stored within the EU. Company nationality and data storage location are separate things. Supabase is the exception: the entity behind our primary database, Supabase Pte. Ltd., is incorporated in Singapore, not the US, though its data region remains the EU (Ireland). Where any of this involves an international transfer of your data, we rely on appropriate safeguards recognised under GDPR:
Contact us at privacy@soola.org for more information about the specific safeguard used for a given provider.
Soola personalises the events and societies shown to you based on your university, interests, and activity in the app. This only affects what content is displayed. It does not make any automated decision that affects your account status, your eligibility to use Soola, or your access to the app. We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.
We also use AI to convert society newsletters into the version shown in the app and to suggest their event details (§11). A member of the Soola team reviews the result and can correct it before anything is published. This processing is about the newsletter's content; it does not make any decision about you.
Soola is intended for third level university students. Users must be at least 16 years of age in accordance with GDPR digital consent requirements in Ireland. If you are under 16 you must have consent from a parent or guardian to use this app. If you believe someone under the age of 16 has created an account without consent please contact us and we will remove it immediately.
We may update this privacy policy from time to time. When we do we will update the date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.
For any privacy related questions, data requests or complaints contact us at privacy@soola.org.
If you are not satisfied with our response you have the right to lodge a complaint with the Data Protection Commission Ireland at dataprotection.ie.