Privacy Policy
You do not need an account and we will not ask you why. Email [email protected], or read section 5 first.
The short version
We hold two kinds of information: details about our customers, and public information about the creators our customers research. Everything lives on a server in Germany. We do not sell anything, we run no advertising trackers, we count visits without storing anything on your device (section 13), and if you connect a mailbox we only use it for the outreach you send from this app. Customers can have everything deleted by emailing [email protected].
1. Who is responsible
SIMPLISIO INNOVATION SRL, registration number J40/14613/2021, CUI 44791098, registered office Bucuresti, Sectorul 3, Strada Nerva Traian, Nr. 27-33, Birou 6, Bl. B, Etaj 1, Ap. 6, Romania. For anything about privacy, write to [email protected].
2. Two groups of people, and the two roles we play
Customers are the people and businesses with accounts. Creators are the public social media profiles our customers research. They are treated differently and each has its own section below.
Our role also changes depending on the activity:
- We are the controller for customer account data, and for the creator research database, because we decide to build and maintain it.
- We act on the customer's instructions for the outreach they send: they choose who to contact and what to say, and we carry it out. Our Data Processing Agreement covers that part and applies automatically to every customer, with nothing to request or sign.
3. What we hold about customers
| What | Why | Legal basis |
|---|---|---|
| Name, email, password stored only as a one way hash, workspace name, role | Creating and running your account | Performance of our contract |
| If you sign in with Google: your Google email, name and a stable account identifier | Signing you in without a password | Performance of our contract |
| If you sign in with GitHub: your main GitHub email address, your name and a stable account identifier | Signing you in without a password | Performance of our contract |
| Billing details: company name, VAT number, address, and what you bought | Taking payment and issuing invoices | Contract, and legal obligation for the invoices |
| Your work in the app: projects, campaigns, keywords, settings, notes, outreach text, credit history | Providing the service and showing you your own work | Performance of our contract |
| Technical records: IP address, browser type, timestamps in server logs | Security, blocking abuse, limiting repeated login attempts | Our legitimate interest in keeping the service secure |
| If you use the free onboarding without an account: a scrambled code made from your IP address, browser type and the minute your visit started. Your IP address itself is not stored, and the code changes every day | Counting how many people start the free onboarding and how many get a search plan, once per person per day | Our legitimate interest in knowing whether the onboarding works |
| If you connect a mailbox: an encrypted access token, the outreach you send and the replies you receive | Sending your outreach and showing you replies | Performance of our contract |
We send service emails such as address verification, password resets, receipts and credit alerts, because they are part of running your account. We do not send marketing email unless you ask for it.
You do not have to give us any of this. Without an email address and a password we cannot create an account, and without billing details we cannot invoice you, so the service would not work.
We also record when you accepted these policies and which version you accepted, so that both of us can tell later what was agreed.
4. What we hold about creators
The service reads public profiles and public posts on TikTok, Instagram and YouTube and stores: username, display name, public bio or channel description, follower, view and engagement counts, public captions and post statistics, contact details the creator has published publicly such as an email in a bio or on a linked website, and public links. It also generates and stores transcripts of public videos, and AI written summaries, scores and notes based on that public content.
Where it comes from. Public pages on those platforms, collected through a third-party data provider, and in some cases from a website the creator links to publicly. We do not buy contact lists and we do not use data brokers.
Our legal basis is legitimate interest: running a professional research tool over information that creators have published publicly to a professional audience, in a way they would reasonably expect, in order to connect them with brands that may want to work with them. We do not sell this information, we do not use it for advertising, and we do not use it to build profiles for any purpose other than the research a customer asked for.
Personal subjects in public content. Creators sometimes publish content about their faith, their recovery from addiction, or similar personal matters, and where that is part of the public content being evaluated, our summaries can reflect it. We rely on the fact that this information was manifestly made public by the creators themselves. We do not look for private information and we do not try to work out anything a creator has not published.
Why you may not have heard from us before. We collect this information from public pages rather than from creators directly, and we do not hold a reliable way to contact most of them. Publishing this policy is how we make that collection known. If a customer contacts a creator, that message comes from the customer's own mailbox and identifies the customer, not us.
5. If you are a creator and you want out
Email [email protected] from any address, or tell us your profile handle. You do not need an account and we will not ask you why. We will:
- Delete the information we hold about you and your posts.
- Add you to a do not contact list, so our customers cannot email you through the service.
- Confirm when it is done.
To make the do not contact list work, we keep the minimum needed to recognise you, such as your handle or email address, and nothing else. That is the only reason we keep it, and keeping it is what stops your profile being added again later.
One honest limit: a customer who already downloaded a copy of their research holds it on their own computer, and we cannot reach into it. Our terms require them to handle it lawfully and to stop contacting anyone who has opted out. If a customer keeps contacting you after you have asked us to remove you, tell us and we will act on it.
You can also ask us for a copy of what we hold, ask us to correct it, or object to the processing described in section 4. We answer within one month.
6. How AI is used
We send creator content, such as captions, transcripts and descriptions, together with your project instructions, to AI providers so they can produce scores, summaries and draft messages. We use those providers on business terms and settings under which your content is not used to train their models, and we do not use free or community model routes that would allow it. If we ever add a provider that cannot offer that, we will say so here before we start sending anything to it.
If you use the reply features, the replies you receive are also sent to an AI provider, so it can tell a genuine reply from a bounce or an opt-out, summarise it, and draft an answer for you to review.
The AI produces research aids, not decisions. A person always chooses who to contact. Nothing the AI produces has a legal or similarly significant effect on a creator, and our terms forbid customers from using it that way.
7. Companies that process data for us
| Provider | What it receives and does | Where |
|---|---|---|
| Hetzner | Hosts the servers and the database, so all data described here | Germany |
| Stripe | Your billing details and payment. Card details go to Stripe, never to us | Ireland and United States |
| Oblio | Your billing details and what you bought, to issue the legally required invoice | Romania |
| Amazon Web Services (SES) | Your email address, to send account emails such as verification and receipts | United States |
| Cloudflare | Your IP address and request data, to protect and speed up the site, and to count visits to our public pages (section 13) | United States |
| Sign in with Google, and sending your outreach if you connect a Gmail mailbox | Ireland and United States | |
| GitHub | Sign in with GitHub, if you choose that button. It tells us your name, your main email address and a stable account identifier, and nothing else | United States |
| Public social media data provider | The search terms and profiles we look up. It supplies the public social media data | United States |
| AI providers | Creator content, your project instructions, and the replies you receive, to produce evaluations, summaries and drafts | United States |
| Transcription provider | Audio from public videos, to turn it into text | United States |
| Error monitoring provider | Technical details of faults in the app, so we can find and fix them. Personal details are removed before sending, though a fault report can still include fragments of the data that was being handled at the time | Germany |
Where a provider is outside the EU, the transfer relies on the European Commission's standard contractual clauses or, where the provider is certified, the EU to US Data Privacy Framework. For a copy of the safeguards, email [email protected].
We list these by the role they play rather than by company name. If you want to know the identity of a specific provider, including the one our creator information comes from, email [email protected] and we will tell you.
8. Where data is stored
On a server in Nuremberg, Germany. Backups are taken nightly, kept on that server and mirrored as provider held snapshots, all within the EU.
9. How long we keep things
| Data | Kept for |
|---|---|
| Account and workspace data | While the account is open, then deleted on request |
| Invoices and payment records | the period Romanian accounting and tax law requires, at least 5 years |
| Creator research data | For as long as we run the research service. Creators can ask us to delete their records at any time (section 5) |
| Do not contact records | Kept indefinitely, because deleting them would undo the opt-out |
| Server logs | up to 30 days, and sooner when log files rotate |
| Onboarding visitor codes (section 3) | Deleted when the following day ends. Only the daily totals are kept |
| Backups | 7 daily and 4 weekly copies, so deleted data leaves the backups within about five weeks |
10. Security
- All traffic is encrypted in transit.
- Passwords are stored as one way hashes and cannot be read by anyone, including us.
- Mailbox access tokens are encrypted before they are stored, with the key held outside the database.
- Every workspace's data is kept separate, and only the members of a workspace can reach its contents.
- Repeated login attempts are throttled, and backups are tested by restoring them.
No system is completely secure. If you find a vulnerability, please tell us at [email protected]. If a breach puts anyone's rights at risk, we will notify the affected people and the relevant supervisory authority, within 72 hours where the GDPR requires it.
11. Your rights
You can ask us for a copy of your data, ask us to correct it, delete it, restrict how we use it, object to processing based on legitimate interest, or receive it in a portable format. Write to [email protected] and we will answer within one month. Account deletion is handled by email today rather than by a button in the app.
If you are not satisfied, you can complain to the Romanian supervisory authority, ANSPDCP, or to the authority in the EU country where you live.
12. Minors
The service is for business use by adults, and accounts are for people aged 18 or over. Some social media creators are minors. The app detects and flags likely minor accounts so customers can exclude them, and our terms forbid targeting them for commercial outreach. If you tell us a record belongs to a minor, we delete it.
13. Cookies and browser storage
We do not run advertising or tracking, and nothing we use to count visits stores anything on your device. Everything we do store on your device is needed to make the site and the app work, which is why there is no cookie banner and no separate cookie policy. This is the whole list:
| What | Set by | Purpose |
|---|---|---|
| Session cookie | Us | Keeps you signed in as you move between pages, and cleared when you log out. If you use the free onboarding without an account, it also counts how many free AI answers your browser has used, so the free step cannot be abused, and remembers that you went to sign up from it, so you land back on your search plan |
| Sign-in reminder cookie | Us | Remembers which sign-in button worked last time in this browser, so the log-in page can mark it and you do not have to guess. It holds the name of the method only, never your email address, your name or anything about your account |
| Security cookies | Cloudflare | Tells real visitors from bots and protects the site from attack |
| Browser storage (not a cookie) | Us | Remembers your display choices (table columns, filters, text size, the last project you had open), which notices you have already seen, and "don't ask again" choices. While you set up an AI connection, it also remembers that connection in the open tab, so a reload does not create a second one. It stays in your browser, and clearing your browser data removes it |
| Free onboarding without an account (browser storage) | Us | Keeps your answers and search plan for 24 hours after your last change, so a reload does not lose them. They are sent to us and our AI provider only to get the AI's reply, and saved on our servers only if you create an account |
| Your first sentence (browser storage, this tab only) | Us | Carries what you typed on the home or pricing page into the free onboarding. Deleted as soon as the onboarding reads it, and when you close the tab |
Counting visits. Our public pages (such as the home page, pricing, these policy pages, the free onboarding, sign-up and log-in) can load Cloudflare Web Analytics, whether or not you are signed in. The pages of the app itself, such as your projects, creators, emails and settings, never do. It measures how the page loaded and reports page views and visits, broken down by country, page, referring site, device type, browser and operating system. It sets no cookies and stores nothing in your browser, and Cloudflare states that it does not fingerprint visitors or follow them from site to site. The measurements go to Cloudflare, which already runs in front of this site (section 7). Ad blockers often block it. Separately, the free onboarding counts how many people start it and get a search plan, using the daily code described in section 3, with nothing stored on your device.
Some fonts and code libraries load from other companies' networks, and those companies can see your IP address when that happens. If we ever want to store information on your device for anything other than making the site and the app work, we will ask for your consent first and publish a full cookie policy before doing it.
14. Information we receive from Google
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. When you connect a Gmail mailbox: we use that access only to draft and send the outreach you create in this app and to show you the replies; we do not transfer that information to anyone except as needed to provide that feature or as required by law; we never use it for advertising; no person reads it except with your permission, to resolve a security issue, or where the law requires it; and we never use it to develop, improve or train generalised AI models.
15. Changes to this policy
If we change something important we will email account holders before it takes effect, and we always update the version at the top.
16. Contact
[email protected]
SIMPLISIO INNOVATION SRL, Bucuresti, Sectorul 3, Strada Nerva Traian, Nr. 27-33, Birou 6, Bl. B, Etaj 1, Ap. 6, Romania