LEGAL · PRIVACY

Privacy Policy

Last updated: 2026-05-16. Controller: Simulatte. Contact: privacy@simulatte.io.

SUMMARY

Simulatte processes account information (name, email, organisation), product usage data, and the study content you submit. We use this data to run your studies, bill credits, and improve the product. We do not sell personal information. We retain study content for as long as your account is active plus 12 months. EU/UK and California residents have the rights described below; email privacy@simulatte.io to exercise them.

1. Data controller

Simulatte is the data controller for personal information processed through app.simulatte.io. For data-protection questions, contact privacy@simulatte.io. We do not currently appoint a Data Protection Officer; if our processing materially expands we will publish DPO contact details here.

2. Personal information we collect

We collect the following categories of personal information directly from you and through your interactions with the service:

Category	Source	Purpose	Retention
Account identifiers (name, email, org name, profile image)	You, via Clerk sign-up	Authentication, billing, support	Lifetime of account + 12 months
Study content (uploaded creatives, copy, audience descriptions, persona pools)	You	Run the studies you request; surface results to your workspace	Lifetime of account + 12 months, or until you delete the study
Usage logs (page views, study runs, credits consumed, API key activity)	Automatic	Product analytics, abuse prevention, billing reconciliation	24 months
Network metadata (IP address, user agent, request timestamps)	Automatic	Security, rate limiting, audit logs	13 months
Integration credentials (encrypted OAuth tokens for Slack/Jira/HubSpot/Salesforce)	You, via OAuth consent	Run integration-triggered studies; post results back	Until you disconnect the integration (immediately deleted on disconnect)
Support correspondence	You	Respond to your inquiry; quality assurance	36 months

3. Lawful basis (GDPR Art. 5 & 6)

We process personal information under the following lawful bases:

Contract (Art. 6(1)(b)) — for account creation, running studies you request, billing, and support.
Legitimate interest (Art. 6(1)(f)) — for security logging, fraud / abuse prevention, and product analytics. We have weighed our interest against your privacy and can provide the balancing test on request.
Consent (Art. 6(1)(a)) — for non-essential cookies, marketing communications, and connecting external integrations (Slack, Jira, HubSpot, Salesforce). You can withdraw consent at any time.
Legal obligation (Art. 6(1)(c)) — for tax records, regulator requests, and law-enforcement responses.

4. Recipients & third-party processors

We share personal information only with the processors required to operate the service. Each is bound by a data-processing agreement.

Processor	Purpose	Location
Anthropic (Claude API)	Synthetic persona inference	United States
Vercel	Frontend hosting	United States
Railway	Backend + database hosting	United States
Clerk	Authentication	United States
Cloudflare R2	Object storage for uploaded creatives	Cloudflare global network
Resend	Transactional email	United States
Slack / Atlassian / HubSpot / Salesforce	Integration endpoints (only when you connect them)	United States

International transfers (Art. 46): processors based in the United States receive data under EU Standard Contractual Clauses (SCCs) + supplementary technical measures (encryption in transit, encryption at rest, key control). UK transfers use the UK International Data Transfer Addendum to the SCCs.

5. Automated decision-making (Art. 13(2)(f))

Simulatte runs AI inference (synthetic personas) on the content you submit. These outputs are decision-support; they do not produce legal or similarly significant effects on data subjects. The personas themselves are synthetic — they do not represent real individuals. You retain full control over how to act on the results.

6. Your rights

EU / UK / EEA residents (GDPR + UK GDPR)

You have the right to:

Access — request a copy of the personal information we hold about you
Rectification — correct inaccurate information
Erasure — delete your account and associated personal information (subject to legal retention requirements)
Restriction — pause processing in defined circumstances
Portability — receive your data in a structured machine-readable format
Object — to processing based on legitimate interest
Withdraw consent — at any time for processing based on consent
Lodge a complaint with your local supervisory authority (for UK residents: the ICO, ico.org.uk)

California residents (CCPA / CPRA)

You have the right to:

Right to Know — what categories of personal information we have collected, sources, purposes, and recipients (covered in sections 2 and 4 above)
Right to Delete — request deletion of your personal information (subject to limited statutory exceptions)
Right to Correct — fix inaccurate personal information
Right to Opt-Out of Sale/Sharing — Do Not Sell or Share My Personal Information. We do not sell personal information in the conventional sense, and we do not share for cross-context behavioural advertising, but we honour the request as a precaution.
Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information under the CCPA definition
Right of Non-Retaliation — we will not deny service, change pricing, or degrade quality if you exercise these rights

To exercise any of these rights, email privacy@simulatte.io. We respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before acting on a request.

7. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Integration OAuth tokens are encrypted at the application layer using Fernet (AES-128-CBC + HMAC). API keys are stored as hashes only. Access to production systems requires SSO with hardware-key MFA and is logged.

8. Cookies

We use strictly necessary cookies for authentication (Clerk session) and a single first-party cookie to remember UI preferences. We do not use third-party analytics, advertising, or behavioural tracking cookies.

9. Children's data

Simulatte is a B2B product not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@simulatte.io.

10. Changes to this policy

When we change this policy materially we will notify active users by email and update the “Last updated” date at the top. Continued use after the notice period constitutes acceptance.