Privacy Policy

This Privacy Policy explains how SimplSolutions ("SimplSolutions," "we," "us," or "our") handles personal information when you visit simplsolutions.app, contact us, use our AI assistant or phone experiences, access an account, or receive Services that reference this Policy.

SimplSolutions is the controller of personal information described in this Policy unless we process information on behalf of a customer. In that case, the customer is normally the controller and its privacy notice and our data processing agreement govern that processing.

Contact us at jeff@simplsolutions.app or through our Privacy Request form.

The categories below describe personal information we may have collected during the preceding 12 months, the sources, and why we use it. We collect only information reasonably necessary and proportionate to the disclosed purpose.

Please do not submit government identifiers, financial account credentials, health records, student records, biometric identifiers, precise geolocation, or other highly sensitive information through the public website unless we have expressly authorized that use and agreed to appropriate safeguards.

• provide, operate, configure, support, and improve the Services;
• respond to inquiries, schedule conversations, and communicate about a relationship;
• authenticate users, enforce roles, and maintain account and audit records;
• process voice, chat, call, meeting, and workflow requests you initiate or authorize;
• measure website use after consent and improve usability and performance;
• detect, investigate, and prevent fraud, abuse, security incidents, and legal violations;
• comply with law, enforce agreements, and establish or defend legal claims; and
• create aggregated or de-identified information that cannot reasonably identify a person.

Where the GDPR or UK GDPR applies, we rely on:

• Contract: to provide requested Services, accounts, and support or take steps before entering a contract.
• Consent: for optional analytics and other processing where we specifically ask for consent. You may withdraw consent at any time without affecting earlier lawful processing.
• Legitimate interests: to secure and improve the Services, respond to business inquiries, maintain records, prevent abuse, and operate our business, balanced against your rights.
• Legal obligation: to comply with applicable law, tax, accounting, regulatory, and valid legal-process requirements.

We use local storage and similar technologies to remember your privacy choice and support essential site functions. These essential uses do not track you for advertising.

Google Analytics and Google Tag Manager are optional. They do not load until you affirmatively accept analytics. We keep advertising storage, ad personalization, and advertising user-data signals denied. You can refuse analytics and still use the website. Use the "Your Privacy Choices" control in the footer at any time to withdraw or change your choice.

We recognize an enabled Global Privacy Control signal as a request to disable optional analytics on that browser. Browser settings may also let you delete cookies or local storage. Deleting the stored preference may cause the site to ask again.

We use AI to respond to requests, summarize conversations, classify or route workflows, and generate suggestions. The public website and Alex assistant are not intended to make solely automated decisions that produce legal or similarly significant effects about visitors. Where a customer configures our Services for its own workflow, that customer is responsible for lawful instructions, notices, and appropriate human oversight. You may request information about applicable automated processing through the Privacy Request form.

We may disclose information to:

• Infrastructure and security providers, including Render for hosting and Supabase for database, storage, and authentication;
• Communications providers, including Resend for email, ElevenLabs for AI voice and chat, and Twilio for telephony;
• Analytics providers, including Google, only after analytics consent;
• Professional advisers, such as legal, accounting, insurance, and security advisers under appropriate duties;
• Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or respond to valid legal process; and
• Transaction participants in a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice requirements.

We may also disclose information at your direction, with your consent, or to integrations you choose to connect.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics or for purposes that require a right to limit under the CCPA. We do not have actual knowledge that we sell or share personal information of people under 16.

During the preceding 12 months, we may have disclosed the categories listed in the Notice at Collection to the service-provider categories described above for the stated business purposes. We did not sell or share those categories for cross-context behavioral advertising.

We will treat a recognized Global Privacy Control signal as an opt-out preference signal. Because we do not sell or share personal information for cross-context behavioral advertising, there is no additional sale or sharing to opt out of. We also use the signal to disable optional analytics on that browser.

We retain personal information only as long as reasonably necessary for the purpose collected, including to provide Services, maintain security and auditability, honor choices and rights, resolve disputes, enforce agreements, and satisfy legal, tax, or accounting duties. Retention depends on the relationship, sensitivity, amount, risk, legal requirements, and whether the information can be deleted or de-identified. We periodically review information and delete or de-identify it when it is no longer reasonably needed. Third-party providers may maintain their own configured retention periods.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including encrypted transport, access controls, role-based authentication, security headers, input and rate-limit protections, audit records, restricted administrative routes, and provider security controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Notify us promptly if you believe information or an account has been compromised.

We and our providers operate primarily in the United States, so personal information may be processed outside your country. Where required for a restricted transfer, we use an approved mechanism such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard. You may request information about an applicable transfer mechanism.

Depending on where you live and applicable law, you may have rights to:

• know whether and how we process your information and access a copy;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• receive certain information in a portable format;
• restrict or object to certain processing;
• withdraw consent at any time;
• opt out of sale, sharing, targeted advertising, or qualifying profiling where applicable;
• appeal a denied request where state law provides an appeal right;
• receive equal service and pricing without unlawful discrimination for exercising a right; and
• complain to your local data protection authority.

Submit a request through our Privacy Request form or email jeff@simplsolutions.app. We will confirm and respond within the period required by applicable law. For GDPR requests, that is generally one month. For verified CCPA requests to know, delete, or correct, we generally confirm receipt within 10 business days and respond within 45 calendar days, subject to permitted extensions.

We verify requests in a way proportionate to the request and the information involved. We may ask you to confirm control of an email address, provide details about your interactions with us, or sign a declaration. Do not send government identification unless we specifically request it and provide a secure method.

An authorized agent may submit a request for a California consumer. We may require proof of signed permission and may ask the consumer to verify identity or confirm the authorization directly, unless the agent has a valid power of attorney. We use verification information only to process and document the request.

The public website is intended for business users and is not directed to children under 13. We do not knowingly collect personal information from children through the public website. Customer deployments involving students or minors require a separate written agreement, appropriate authorization, and safeguards. Contact us if you believe a child provided personal information without appropriate authorization.

We may update this Policy as our practices, Services, or laws change. We will post the revised Policy and update the date above. We will use additional notice when required for a material change.

Privacy questions and requests may be sent to jeff@simplsolutions.app or submitted through the Privacy Request form.