Privacy policy

Last updated September 30, 2026

What SODA BODY collects, why, who helps us run it, and what you can ask us to do with your data.

Who we are

SODA BODY (sodabody.com) is run by BAUDIN STUDIO LTDA, Vitória da Conquista, Bahia, Brazil — the "controller" of your personal data under Brazil's LGPD (Lei 13.709/2018). Questions or requests: baudinstudio@gmail.com.

What we collect

Account (only if you create one): your email address, password (stored as a secure hash by our login provider — we never see it), username, display name and bio.
What you save or post: Soda Studio scenes and poses you save to your account, Community posts (images, captions, tools, references), likes, saves and reports.
Membership: your plan, its status and renewal date, and the Stripe customer and subscription IDs that link a payment to your account.
Payments are handled by Stripe. Your card details go straight to Stripe; we never receive or store them. Stripe shares with us the payment's amount, date, status and the email you used.
In your browser only: your drawings in progress, settings, favourite poses, practice progress, the pose set and autosaved scenes are kept in this browser's storage (localStorage / IndexedDB). They don't reach our servers unless you save them to your account or post them.
Photos for "Copy a pose from a photo" are analysed inside your browser and are never uploaded.
Technical logs: our hosting keeps short-lived server logs (such as IP address, browser and the page requested) to run and secure the site.

We don't use advertising, tracking or analytics cookies, and we don't sell or rent your data.

Why (legal bases)

To provide the service you asked for — your account, saving, the Community and your membership (performance of a contract).
To take payments, keep records and meet tax and legal duties (legal obligation).
To keep the site and the Community safe — moderation, abuse prevention, fixing problems (legitimate interest).
Anything else only with your consent, which you can withdraw at any time.

Who helps us run it

These providers process data on our behalf, some of them outside Brazil (mainly in the United States), with contractual safeguards:

Supabase — accounts, database and image storage.
Stripe — payments and subscriptions.
Vercel — hosting of the website.
Google (storage.googleapis.com) and jsDelivr — deliver the pose-detection model the first time you use "Copy a pose from a photo" (they see a normal web request, not your photo).
YouTube / Vimeo — only when you play a video embedded in a Community post.

What others can see

Community posts, your username, display name and bio are visible to other signed-in members (some official posts are public). Soda Studio scenes you choose to share with the community are visible to other members. Everything else in your account is private to you.

How long we keep it

While your account exists. When you delete a post, scene or your account, we delete it from our systems, except for what the law requires us to keep (for example payment records, kept for the legal period) and short-lived backups that expire on their own.

Your rights

Under the LGPD you can ask us to confirm we process your data, access it, correct it, anonymise or delete it, get a portable copy, know who we share it with, and withdraw consent. Email baudinstudio@gmail.com from your account's address and we'll answer within 15 days. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).

Children

Accounts and the Community are for people 13 and older; under 18, with a parent or guardian's permission.

Changes

If we change this policy we'll update the date above, and tell members by email or on the site when the change matters. See also the Terms of use and the Refund policy.