Last updated on September 15, 2026
This Privacy Policy explains how Somi AI Inc., doing business as Somi ("we", "us", "our"), collects, uses, and shares information about you in connection with the websites, applications, and related services we operate (together, the "Services"). The Services include https://somi.co (our marketing site), https://login.somi.co, https://app.somi.co, tenant sites hosted at addresses such as {ulid}.app.somi.co, and custom domains that a tenant points at the Services.
In this Privacy Policy, "you" and "your" refer to you as a user of the Services. If you operate a tenant site, "you" also includes your organization. "Personal information" means information that identifies, relates to, or could reasonably be linked to you or your household.
Please read this Privacy Policy in full. Your use of any of the Services constitutes agreement to the collection, use, and sharing of your information as set out here. If you do not understand or accept this Privacy Policy, do not use or access the Services.
Somi AI Inc. is a Delaware corporation doing business as Somi. We operate the Services from the United States. Questions about this Privacy Policy or our privacy practices may be sent to our privacy contact at privacy@somi.co. Our Privacy Officer / Data Protection contact is Gabriel Stanier, Chief Executive Officer.
Postal address:
Somi AI Inc.
455 Market St Ste 1940 PMB 428524
San Francisco, CA 94105
United States
Telephone: +1 (628) 218-7818
We may revise this Privacy Policy from time to time. When we do, we will change the date at the top of this page. If we make material changes to how we use or share the information we collect, we will take reasonable steps to notify you, such as by emailing the address you most recently provided or by posting a notice on the Services, and we will take any further steps required by applicable law. If you do not accept an update, you should stop using and accessing the Services.
When you use or access the Services, we collect certain categories of information about you from several sources. We do not collect keystroke logs, cursor position, or precise geolocation. We do not use promotional advertising pixels or a third-party ad tag manager.
Some parts of the Services require you to provide information about yourself. You may decline to provide it, but that may prevent you from using those parts of the Services. Information you submit through the Services includes the following.
We do not collect a home or mailing address as a routine account field. An address may appear only if you or a tenant checkout flow provide it (for example, billing information handled by our payment processor).
If you sign in with Google, we receive your Google account profile information and email address. We request only the Google OAuth scopes openid, email, and profile. We do not request Google Workspace user content. Google sign-in is used to authenticate you. Separately, a workspace administrator may map Google Workspace directory groups to Somi roles. That directory mapping is not access to a user's Google user content.
You may revoke Google's authorization for Somi through your Google account settings. Revoking sign-in access does not by itself delete your Somi account or content already stored in the Services. To request deletion of your Somi account or stored information, email privacy@somi.co as described under "Your rights" below.
If you sign in with a magic link, we collect the email address you enter and send a one-time sign-in message from noreply@somi.co through our email vendor. We retain magic-link records until they expire.
We automatically collect certain technical and security information when you use the Services, including:
If you use features that record destinations the Services visit on your behalf, we may retain related browser-history records as described under "How long we keep information."
We collect audio and a transcript only if you use voice features and choose to record. When you do, we store the recording and related voice telemetry, including a transcript, as described under "How long we keep information."
If you or a tenant use paid features, we collect billing identifiers and Stripe customer or connected-account metadata needed to process payment, including payment status and any platform application fee. Card numbers and other full payment-card data are collected and stored by Stripe, not by Somi. We do not store full card numbers.
If you operate a tenant site on the Services, we process personal information about your customers that is collected on that site in order to provide hosting and Stripe Connect booking and payment features. That may include the customer's email address or phone number as collected on the tenant site, booking details, payment status, and application-fee information.
For that customer booking data, you (the tenant) are the controller and Somi is a processor acting on your instructions to provide the Services. Somi is a controller of platform account records and fee records that we create to operate, bill, and secure the platform.
If you are a customer of a tenant site, the tenant's own notices also apply to how that tenant uses your information. Contact the tenant about requests that concern their customer records. You may also contact privacy@somi.co and we will route the request as appropriate.
We use the information described in this Privacy Policy to:
We do not sell your information. We do not share personal information for cross-context behavioral advertising. We do not disclose personal information to registered data brokers or to third parties that resell it.
To provide AI features, we send the content reasonably necessary for the request (for example, a prompt, relevant files, or a voice transcript) to third-party model providers so they can return a result. Those providers currently include OpenAI, Google, and xAI, reached through Cloudflare's AI Gateway. Voice transcription may use Whisper. Embeddings may use Cloudflare Workers AI.
Somi does not train or fine-tune its own models on your information. Because we do not train or fine-tune Somi models, we do not offer a Somi training opt-out.
The Services are not a professional advisor. You should not rely on them for decisions that require financial, legal, medical, or other professional advice or judgment.
We use cookies that are needed to operate the Services. That includes essential and session cookies, such as the somi_session cookie set on .somi.co. We may also use first-party or Cloudflare analytics cookies or similar technologies to understand site performance. We do not use promotional advertising pixels, and we do not use cookies to provide offers or promotions.
Most browsers accept cookies by default. You may be able to block or delete cookies through your browser. Doing so may cause some of the Services, including sign-in and general functionality, to work incorrectly.
Your browser may let you send a Global Privacy Control (GPC), Do Not Track (DNT), or similar signal expressing a choice about collection or processing of your information. Our website is not currently designed to respond to those signals.
We may share your information with the following categories of recipients.
Affiliates and other members of our corporate group, if any. We do not have material affiliate sharing today.
Vendors that help us provide the Services, including:
We require vendors to process personal information to provide services to us, not to sell it.
Tenant-directed disclosures. If you operate a tenant site, information about your customers may be disclosed as needed to that tenant, to that tenant's Stripe connected account, and to the customer in connection with their booking or payment.
Legal, security, and professional advisors. We may share information with auditors, law firms, and other professional advisors, and we may share information to cooperate with law enforcement or regulatory inquiries, detect and prevent fraud or illegal activity, exercise or defend legal claims, and protect the safety and security of our business and personnel.
Business transfers. We may share information in connection with or in anticipation of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.
We do not provide personal information to third-party business partners for those partners' own independent commercial purposes, except in deidentified or aggregated form as described under "Deidentified information," or where you direct us to disclose it, or where the law requires it.
We keep personal information only as long as reasonably needed for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Current retention windows we enforce include:
You may request deletion of an account or of personal information by emailing privacy@somi.co. Full automated account-termination erasure is not offered as an instant self-serve process in the product today. Preferences pages labeled for privacy or data controls may not yet complete a deletion or export on their own. We will handle email requests as described under "Your rights."
Depending on where you live, you may have rights in your personal information. For California residents, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides the rights described below. Residents of other U.S. states with similar laws may have comparable rights, which you may exercise the same way.
Right to know and access. You may request that we disclose the personal information we have collected about you, the categories of personal information, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
Right to correct. You may request that we correct inaccurate personal information we maintain about you.
Right to delete. You may request that we delete personal information we collected from you, subject to exceptions allowed by law (for example, to complete a transaction, detect security incidents, or comply with a legal obligation).
Right to limit use of sensitive personal information. If we process sensitive personal information (for example, account credentials or secrets you store, or payment-related identifiers processed in connection with Stripe), we use it to provide the Services you requested, to secure those Services, and as otherwise permitted by law. We do not use sensitive personal information to infer characteristics about you for cross-context advertising. You may ask us to limit any use that is not reasonably necessary to provide the Services by emailing privacy@somi.co.
Right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. Because we do not sell or share in those senses, there is no separate "Do Not Sell or Share" control. You may still write to privacy@somi.co if you want confirmation.
Non-discrimination. We will not discriminate against you for exercising these rights.
Email privacy@somi.co. There is no in-app data-subject request portal. We may need to verify your identity before we fulfill a request, for example by confirming control of the email address on the account. You may designate an authorized agent to submit a request; we may require proof of authorization and may still need to verify you directly.
If your request concerns a tenant's customer booking records, we may need to involve the tenant as controller, or we may direct you to the tenant.
In the last twelve months, depending on how you use the Services, we have collected the following categories of personal information (as those categories are commonly described under California law): identifiers (such as name, email address, and IP address); commercial and transaction information (such as payment status and Stripe customer or connected-account metadata); internet or other electronic activity (such as authentication logs and product telemetry); audio information (if you use voice features); professional or employment-related information you choose to put in a business profile; and inferences we may draw in operating the product (for example, that a feature was used). We do not collect precise geolocation. We do not collect Social Security numbers or government ID numbers as part of ordinary use of the Services.
We collect these categories from you directly, automatically from your device when you use the Services, from Google if you use Google sign-in (profile and email only), from Stripe in connection with payments, and from a tenant if you are that tenant's customer.
We use and disclose these categories for the purposes and to the recipients described in this Privacy Policy. We do not sell them and we do not share them for cross-context behavioral advertising.
We may deidentify or anonymize your information so that it cannot reasonably be used to infer information about you or otherwise be linked to you ("deidentified information"), or we may collect information that is already deidentified or anonymized. We may use deidentified information for any purpose. To the extent we hold or process deidentified information, we will maintain and use it in deidentified form and will not attempt to reidentify it, except to confirm that our deidentification process meets legal requirements.
The Services are for users 14 years of age and older. They are not directed to children under 14, and we do not knowingly collect personal information from anyone under 14. If we learn that we have collected personal information from a child under 14, we will delete it. If you are the parent or guardian of a child under 14 who has provided personal information to us, email privacy@somi.co to request deletion.
We take reasonable measures to protect your information. No security measures are impenetrable, and we cannot guarantee perfect security. Features that can act for you may raise additional privacy and security considerations, because they can perform tasks or take actions based on the permissions you grant.
As with any technology that acts for you, there are inherent considerations. Those include the possibility of unintended actions (including unintended communications to outside parties), incorrect or incomplete outputs, and interactions with third parties who may include misleading instructions intended to influence autonomous software. You should review actions taken on your behalf, remain attentive while using the Services, and keep these considerations in mind.
Information you send to us electronically, while using the Services or otherwise communicating with us, may not be secure while in transit. In-transit email is not guaranteed secure. We recommend that you not use unsecured channels to send sensitive or confidential information.
The Services are operated from the United States. If you access the Services from another country, you do so at your own initiative. Your information may be processed in the United States and in other countries where our subprocessors operate. Those countries may have data-protection laws that differ from the laws of your home country.
We may include links to third-party websites or platforms. If you follow a link to a site or platform we do not control and that is not affiliated with us, you should review that party's privacy policy, other policies, and terms. We are not responsible for the privacy or security of those sites or platforms, or for information found on them. Information you provide in public or semi-public venues, such as third-party social networking platforms, may be visible to other users of the Services and to users of those platforms, without limitation as to use. Including a link does not, by itself, mean we endorse the content on that platform or its owners or operators.
Questions about our privacy practices or this Privacy Policy, and requests to exercise privacy rights, may be sent to privacy@somi.co.
Somi AI Inc.
455 Market St Ste 1940 PMB 428524
San Francisco, CA 94105
United States
+1 (628) 218-7818