Privacy Policy
Last updated: 26 June 2026
This Privacy Policy describes how Organic Raspberry Pte. Ltd. (trading as "Sophia", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you use the Sophia platform, websites (sophiawomen.com and sophiawomen.ai), digital courses, AI money coaching application, and related services (collectively, the "Services").
By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not access or use our Services.
1. Who We Are
Organic Raspberry Pte. Ltd. (UEN: 202297027Z) is the data controller responsible for your personal data. We are incorporated in Singapore and provide Services across Singapore, Hong Kong, the United Kingdom, and Australia.
Contact: [email protected] | #02-01, 68 Circular Road, Singapore 049422
UK Representative (UK GDPR Art. 27): DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. DataRep is Sophia's appointed representative for the purposes of UK GDPR Article 27 and is the point of contact for UK data subjects and the Information Commissioner's Office (ICO) in respect of Sophia's processing of UK personal data. See Section 9 for contact details.
2. Scope and Applicable Laws
This Privacy Policy is designed to comply with the following data protection frameworks, depending on where you are located:
Singapore — Personal Data Protection Act 2012 (PDPA) and its subsidiary regulations
Hong Kong — Personal Data (Privacy) Ordinance (Cap. 486) (PDPO)
United Kingdom — UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
Australia — Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
California, USA — California Consumer Privacy Act 2018 as amended by the California Privacy Rights Act 2020 (CCPA/CPRA)
Where the laws of your jurisdiction grant you additional rights, we will honour those rights to the extent required by law.
3. Personal Data We Collect
3.1 Data You Provide Directly
Identity data: name, gender
Contact data: email address, phone number
Account data: username, password (hashed), profile preferences
Financial context data: savings goals, monthly savings amount, risk tolerance, life stage — provided voluntarily for personalised coaching
Payment data: billing information (processed by our payment provider; we do not store card details)
Communications: messages sent to us via email, contact forms, or in-app chat
Coaching session data: notes, questions, and information shared during human coaching sessions; and where you have given consent, coach-authored session summaries capturing key themes discussed and agreed next steps, retained for the purpose of continuity of coaching and service improvement
3.2 Data Collected Automatically
Usage data: pages visited, features used, course progress, session duration
Device data: IP address, browser type and version, operating system, device identifiers
Storage and tracking data: see Section 7 below
Analytics data: behavioural and usage data collected via a third-party product analytics service, including features used, navigation patterns, and session interactions. Only collected if you have given analytics consent. See Section 7.
3.3 Data from Corporate Partners (B2B Channel)
Where your employer or corporate partner has enrolled you in the Sophia platform as part of an employee benefit or financial wellness programme, we may receive your name, work email address, and enrolment information from that corporate partner. The corporate partner's use of your data is governed by their own privacy policy and any Data Processing Agreement (DPA) entered into with us.
3.4 AI and Human Coaching — Special Notice
Our coaching services include both AI-generated coaching and sessions with human coaches. Both process the financial context data you provide (e.g. life goals, monthly savings amount, savings habits) to deliver personalised educational guidance. In both cases:
Coaching does not constitute regulated financial advice in any jurisdiction
Human coaches are educators and facilitators only; they do not hold regulatory licences from the Monetary Authority of Singapore (MAS), the Financial Conduct Authority (FCA), the Australian Securities and Investments Commission (ASIC), the Securities and Futures Commission (SFC) in Hong Kong, or any other financial regulatory body
AI-generated responses are produced automatically and are for educational purposes only
Neither form of coaching involves automated or human decision-making with legal or similarly significant effects on your finances
Financial context data and coaching session notes are used solely to personalise and deliver your educational experience. Session summaries, where created, are used only for continuity of coaching and are not used for any other purpose
AI coaching is processed by AI infrastructure operated by our cloud service providers
We apply heightened care to all coaching data and do not use it for advertising or share it with third parties for marketing purposes. Human coaching session notes and summaries are accessible only to the coach assigned to you and authorised Sophia staff. Where your coach creates a session summary, this is done only with your consent. You may withdraw consent for session summaries at any time without affecting your right to continue using the coaching service.
4. How We Use Your Personal Data
4.1 To Provide and Improve our Services
Account creation and management
Delivering courses, content, and AI coaching functionality
Processing payments and managing subscriptions
Technical support and troubleshooting
Legal basis: performance of contract (Singapore PDPA: contractual necessity / legitimate purpose; UK GDPR Art. 6(1)(b); HK PDPO: use directly related to collection purpose).
4.2 Communications
Sending transactional and service-related communications
Sending marketing communications where you have opted in
Legal basis: consent (for marketing); legitimate interests / contractual necessity (for transactional communications). You may opt out of marketing communications at any time.
4.3 Analytics and Service Development
Understanding how users engage with our content
Improving course design, UX, and AI coaching accuracy
Legal basis: consent. You may grant or withdraw analytics consent at any time in your account settings. See Section 7 for further details.
4.4 Legal and Compliance
Complying with applicable laws and regulatory requirements
Responding to legal process or regulatory inquiries
Protecting our legal rights and those of our users
5. Sharing Your Personal Data
We do not sell your personal data. We may share it in the following circumstances:
5.1 Service Providers
We engage trusted third-party service providers who assist us in operating our Services. These include providers in the following categories:
Cloud infrastructure and hosting
AI language model processing
Database and application infrastructure
Content management
Learning management system hosting
Email and communications delivery
Payment processing
Usage analytics and performance monitoring
All service providers are contractually bound to process your personal data only on our instructions, for specified purposes, and in compliance with applicable data protection law. We maintain a register of sub-processors which is available to corporate partners upon request under a signed Data Processing Agreement.
5.2 Corporate Partners
Where you access Sophia through an employer or corporate partner, we may share aggregated, anonymised programme engagement data with that partner (e.g. overall course completion rates). We do not share individual personal data with corporate partners without your consent, except where required under the applicable DPA.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.
5.4 Legal Requirements
We may disclose your data to comply with applicable law, court order, or lawful government request, or to protect the safety, rights, or property of Sophia, our users, or the public.
6. International Data Transfers
Your data may be processed in countries other than Singapore, including where our service providers are located. We take steps to ensure that any cross-border transfers comply with applicable law, including:
For Singapore: transfers only to countries with adequate protection or governed by PDPC-approved contractual clauses
For UK GDPR: International Data Transfer Agreements (IDTAs) or adequacy decisions
For Australia: contractual protections binding overseas recipients to equivalent privacy standards
Details of international transfer safeguards for specific sub-processors are available to corporate partners upon request under a signed Data Processing Agreement.
7. Storage and Analytics Technologies
Sophia uses browser storage (such as localStorage) rather than cookies for its core functionality. This applies across both sophiawomen.com and sophiawomen.ai.
Essential storage: required for the platform to work — e.g. keeping you logged in (an authentication token) and security.
Analytics: we use Mixpanel, a third-party product analytics service, to understand how the platform is used. This data is linked to your account (your email) and may include profile and engagement information. This includes information such as screens visited, features used, session frequency, and your email address as an account identifier. We only send analytics data to Mixpanel if you have given analytics consent, which you can grant or withdraw at any time in your account settings. Mixpanel processes data in the United States. By enabling analytics consent, you agree to this transfer.
Third-party login: signing in via our learning management system takes you to that service's site, which uses its own cookies under its own privacy policy.
We do not use marketing or advertising cookies. You can manage analytics consent in your account settings, and clear browser storage through your browser. Disabling essential storage will prevent you from staying logged in.
8. Data Retention
Financial context and coaching data, including session summaries: deleted or anonymised within 12 months of account closure, or within 30 days of withdrawal of consent for session summaries
Payment records: retained for 7 years for financial and tax compliance
Communications logs: retained for 3 years
Usage/analytics data: retained in anonymised form indefinitely
You may request deletion of your account and personal data at any time (subject to legal retention obligations).
9. Your Rights
Access: request a copy of the personal data we hold about you
Correction: request correction of inaccurate or incomplete data
Erasure / Deletion: request deletion of your data where we have no lawful basis to retain it
Portability: receive your data in a structured, machine-readable format
Objection: object to processing based on legitimate interests
Restriction: request that we restrict processing in certain circumstances
Withdraw consent: withdraw consent for marketing or other consent-based processing at any time
To exercise any of these rights, please contact us at: [email protected]
UK residents — contacting our UK Representative (DataRep)
If you are located in the United Kingdom, you may also exercise your rights under the UK GDPR by contacting our appointed UK representative, DataRep, through any of the following channels:
Email: [email protected] — please include “Sophia, SophiaAI” in the subject line.
Online: www.datarep.com/data-request
Post: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Address your letter to “DataRep” (not “Sophia”), and clearly reference “Sophia, SophiaAI” in the correspondence.
We or DataRep may request proof of your identity before processing your request, to protect your personal data. For further information about your rights under the UK GDPR, you may consult the UK Information Commissioner’s Office at ico.org.uk. DataRep’s own privacy notice is available at www.datarep.uk/privacy-policy.
We will respond within 30 days (or such shorter period as required by applicable law). We may ask you to verify your identity before processing your request.
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the relevant supervisory authority (e.g. PDPC in Singapore, PCPD in Hong Kong, ICO in the UK, OAIC in Australia).
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption in transit (TLS), encryption at rest, access controls, and regular security reviews.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant regulators as required by applicable law.
11. California Privacy Rights (CCPA / CPRA)
This section applies to residents of California and supplements the rest of this Privacy Policy, pursuant to the CCPA/CPRA.
11.1 Categories of Personal Information Collected
Identifiers: name, email address, IP address, device identifiers, account username
Personal information under Cal. Civ. Code § 1798.80(e): name, email, financial context data voluntarily provided
Commercial information: records of courses purchased or subscribed to
Internet / network activity: usage data, pages visited, features accessed
Inferences: personalised coaching profile derived from data you provide
11.2 Sale or Sharing of Personal Information
We do not sell your personal information for monetary consideration. We do not share your personal information with third parties for cross-context behavioural advertising. We therefore do not offer a ‘Do Not Sell or Share’ opt-out as we do not engage in these activities.
11.3 Your California Privacy Rights
Right to Know: request disclosure of categories and specific pieces of personal information collected
Right to Delete: request deletion of personal information, subject to certain exceptions
Right to Correct: request correction of inaccurate personal information
Right to Limit Use of Sensitive Personal Information: limit use to necessary service purposes only
Right to Non-Discrimination: we will not discriminate against you for exercising your rights
11.4 How to Submit a Request
Contact us at [email protected] with subject line ‘California Privacy Request’. We will respond within 45 days (extendable by a further 45 days with notice).
11.5 Shine the Light
We do not share personal information with third parties for their direct marketing purposes.
12. Children
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. Contact us immediately if you believe a minor has provided us with personal data.
13. Changes to This Policy
We will notify you of material changes by email and/or in-app notice at least 14 days before they take effect.
14. Contact Us
Organic Raspberry Pte. Ltd. (trading as “Sophia”) | UEN: 202297027Z
[email protected] | #02-01, 68 Circular Road, Singapore 049422 | sophiawomen.com | sophiawomen.ai