Privacy Policy

1. Introduction

2. Data We Collect

We collect the following categories of information to provide and improve simplecx. We only collect data that is necessary, proportionate, and relevant to the purposes described below.

2.5 Data You Do Not Need to Provide

We do not require you to submit sensitive personal data (e.g., health data, political opinions, religious beliefs, or biometric data) to use simplecx. Please avoid uploading such data unless explicitly required for a specific use case and with your informed consent.

3. How We Use Your Data

We process your data only for the specific, explicit, and legitimate purposes described below. For each purpose, we rely on one or more lawful legal bases under the General Data Protection Regulation (GDPR) and applicable law.

4. How We Share Your Data

We do not sell your personal data to third parties. We do not share your data for advertising targeting by external parties. We may share data only in the following limited circumstances.

4.1 Authorised Service Providers

We engage trusted third-party providers to help us operate simplecx. These providers act as data processors under contract and may only process your data according to our documented instructions.

Our current sub-processors are:

• Cloud infrastructure (Google Cloud): Application hosting, database hosting, and file storage. The application and the database are hosted in Europe.
• AI model provider (Google Gemini): Processes the prompts, uploads, and brand context you submit in order to generate text, images, audio, and video.
• Web research (Tavily): Receives the research topics and page addresses you submit when you turn on Research Mode or attach a web page or PDF as campaign context.
• Payment processing (Stripe): Handles checkout, subscriptions, and billing. Card details go directly to Stripe and are never stored by us.
• Product analytics (PostHog, Microsoft Clarity, Google Analytics via Google Tag Manager): Records how the platform is used, including page views, interactions, and session replays. These load only if you accept analytics cookies. Where you are signed in, Microsoft Clarity is given your user ID, name, and email address so that replays can be linked to your account.
• Email delivery (Resend): Sends transactional email such as account confirmations, password resets, billing receipts, and service notices.
• Messaging and notification infrastructure (Google Firebase): Supports in-product messaging and notification delivery.
• Authentication providers (Google, Discord): Used only if you choose to sign in with one of them, and only to confirm your identity and email address.

We maintain a current list of sub-processors and will notify users of material changes.

4.2 Legal Requirements

We may disclose your data to law enforcement, government authorities, or courts when required to do so by applicable law, regulation, or a binding legal order.

4.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or prominent notice on the platform before any such transfer takes effect and explain your options.

4.4 With Your Explicit Consent

We may share your data with other parties where you have given us clear, informed, and specific consent to do so.

4.5 Connected Accounts and Publishing

simplecx lets you connect third-party accounts so that content created on the platform can be published or exported directly to them. This currently covers Facebook and Instagram (Meta), TikTok, LinkedIn, Canva, and Google Drive.

• What we store: When you connect an account we store the access and refresh tokens that platform issues to us, together with the account, page, or profile identifiers needed to publish on your behalf. We never receive or store your password for those platforms.
• What we send: Only the content you explicitly choose to publish or schedule: the media, captions, and any scheduling details you set. We do not send your other campaigns, drafts, or account data.
• What we receive back: Post identifiers and, where you have connected analytics, the engagement metrics that platform reports for the content you published through simplecx.
• Their handling, their rules: Once content reaches a connected platform it is governed by that platform's own privacy policy and terms, not this one.
• Disconnecting: You can disconnect any account at any time from Settings, Integrations. We delete the stored tokens for that account. Content already published on that platform is not withdrawn, because it is no longer under our control; remove it there.

4.6 International Transfers

The simplecx application and its database are hosted in Europe. Some sub-processors listed in Section 4.1 process data outside the European Economic Area (EEA); AI model inference and certain analytics services are the main examples. Where any sub-processor or partner operates outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or that the recipient country benefits from an adequacy decision.

5. Data Storage and Retention

5.1 Where Your Data is Stored

All user data is stored on servers located within the European Union. We have selected our infrastructure providers based on their compliance with GDPR and ISO 27001 (or equivalent) security standards.

5.2 Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy or as required by law. The following principles govern our retention:

• Active account data: Retained for the duration of your account and for up to 90 days after account deletion, to allow for recovery requests.
• Transaction and billing records: Retained for a minimum of 10 years to comply with German commercial and tax law (HGB, AO).
• Usage and analytics data: Aggregated usage data may be retained indefinitely in anonymised form. Identifiable usage logs are deleted after 24 months.
• Support communications: Retained for 3 years after the resolution of your enquiry.
• Legal compliance records: Retained as long as required by applicable law.
• Marketing consent records: Retained for the duration of our business relationship and for 3 years after consent is withdrawn, as evidence of compliance.

5.3 Data Deletion

When retention periods expire, or upon a valid deletion request (see Section 6), we securely delete or irreversibly anonymise your personal data. Deletion is applied across all production systems, backups (within standard backup cycle periods of up to 90 days), and sub-processors.

6. Your Rights

Under the GDPR and applicable data protection law, you have the following rights in relation to your personal data. We are committed to facilitating the exercise of these rights promptly and without unnecessary friction.

• Right of Access (Article 15 GDPR): You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification (Article 16 GDPR): You may ask us to correct any inaccurate or incomplete personal data.
• Right to Erasure (Article 17 GDPR): You may request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful.
• Right to Restriction of Processing (Article 18 GDPR): You may ask us to restrict processing of your data in certain circumstances, for example, while a dispute is being resolved.
• Right to Data Portability (Article 20 GDPR): You may request a copy of your data in a structured, commonly used, machine-readable format to transfer to another service.
• Right to Object (Article 21 GDPR): You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), or any EU data protection authority in your country of residence.

How to Exercise Your Rights

To exercise any of the above rights, please contact us at:

• Email: [email protected]
• Subject line: Data Rights Request, [Your Name]

We will acknowledge your request within 72 hours and respond fully within one calendar month. We may ask you to verify your identity before processing your request. If your request is complex or numerous, we may extend our response period by a further two months and will notify you accordingly.

7. Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

7.1 Technical Measures

• Encryption in transit: All data transferred between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at rest: Sensitive data stored on our servers is encrypted at rest using AES-256 or equivalent.
• Access controls: Role-based access control (RBAC) restricts data access to authorised personnel only.
• API security: Authentication tokens, rate limiting, and input validation protect our API endpoints.
• Intrusion detection: Automated monitoring systems detect and alert on anomalous activity.
• Regular backups: Automated backups ensure data can be recovered in the event of an incident.

7.2 Organisational Measures

• Internal data handling policies: Staff and contractors with access to personal data are bound by confidentiality obligations and trained on data protection.
• Sub-processor due diligence: We assess the security and GDPR compliance of all sub-processors prior to engagement.
• Data minimisation: We only collect and process the minimum data necessary for each purpose.
• Privacy by design: Data protection considerations are embedded in our product development process.

7.3 Incident Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected users without undue delay.

8. Cookies and Tracking

simplecx uses cookies and similar tracking technologies to enable essential platform functionality, remember your preferences, and understand how users interact with the platform.

• Essential cookies: Required for authentication, session management, security, your saved theme, and the record of your cookie choice itself. These cannot be disabled without breaking the platform.
• Analytics cookies: Set by PostHog, Microsoft Clarity, and Google Analytics via Google Tag Manager to record page views, interactions, and session replays. These are off until you accept them.

We do not use advertising or marketing cookies, and we do not set analytics cookies before you have accepted them. Refusing is as easy as accepting: the banner shown on your first visit offers both choices with equal prominence, and no analytics tool loads unless you opt in.

You can change your choice at any time through the Cookie Settings link in our website footer, or by adjusting your browser settings. Note that blocking essential cookies through your browser will affect core parts of the platform.

9. Children's Privacy

simplecx is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected] and we will take prompt action to delete that data.

10. Regulatory Compliance

simplecx and Retink Media UG are committed to compliance with applicable data protection laws and regulations, including:

• EU General Data Protection Regulation (GDPR): Regulation (EU) 2016/679, our primary data protection framework, governing the collection, processing, storage, and transfer of personal data of EU/EEA residents.
• Bundesdatenschutzgesetz (BDSG): The German Federal Data Protection Act, which supplements and implements the GDPR at the national level.
• Telemediengesetz (TMG) / Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG): German law governing electronic media and telecommunications services, including cookie consent.
• ePrivacy Directive (2002/58/EC) and future ePrivacy Regulation: Governing electronic communications and online privacy, as implemented in Germany.

Where simplecx serves users outside the EU/EEA, we apply GDPR-standard protections as a baseline and take reasonable steps to comply with applicable local laws. If you believe that our processing of your data does not comply with applicable law, please contact us or your local data protection authority.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of simplecx. When we make material changes, we will:

• Update the Effective Date at the top of this document.
• Post a prominent notice on the simplecx platform.
• Where required by law or where changes significantly affect your rights, notify you directly by email.

We encourage you to review this policy periodically. Your continued use of simplecx after the effective date of any update constitutes acceptance of the revised policy.

12. Contact and Data Controller Information

For any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact us:

We aim to respond to all privacy-related enquiries within 72 hours of receipt. For formal data subject requests (Section 6), we will respond within one calendar month.