Privacy Notice your data, handled with care

This Privacy Notice ("Notice") describes the information we gather on or through the SimpleKPI Service, how we use and disclose such information, and the steps we take to protect it. This Notice is incorporated into, and is subject to, the SimpleKPI Terms of Service.

Who is responsible for your data

The data controller for the Personal Data described in this Notice is:

SimpleKPI Ltd
86-90 Paul Street, London, EC2A 4NE, United Kingdom
Registered in England, company number 6191007
Email: privacy@simplekpi.com

For any question about this Notice, to exercise your rights over your Personal Data, or to withdraw a consent you have given us, contact us at privacy@simplekpi.com or through our contact page. You can change or withdraw your cookie consent at any time using the cookie settings link in the footer of every page.

If you are in the UK you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA you may lodge a complaint with your local supervisory authority.

Definitions

"Visitor" refers to any individual who accesses the Public Area of the SimpleKPI Website but does not hold a User account or access the Restricted Area.

"Service" refers to the SimpleKPI Services as defined in the Terms of Service, including the platform, features, and any associated tools provided by SimpleKPI.

"Restricted Area" refers to secure sections of the SimpleKPI platform that are accessible only to Users and require valid login credentials for entry.

"Public Area" refers to sections of the SimpleKPI Website that are accessible to both Users and Visitors without requiring login credentials.

"Personal Data" refers to any information that pertains to an identified or identifiable individual, such as names, contact details, or any data that can be linked to a specific person.

"AI Features" refers to functionality within the Service that uses machine-learning or generative artificial-intelligence technology, as described in the Terms of Service.

1. SimpleKPI Roles and Responsibilities

This section outlines SimpleKPI's roles and responsibilities concerning the processing of Personal Data:

1.1 SimpleKPI as a Data Controller

SimpleKPI acts as a data controller for its own business data: billing and payment records, data collected on our public Website (including cookies and enquiries), marketing and sales contacts, and our internal records. For that data SimpleKPI determines the purposes and means of processing, and ensures it is handled lawfully, fairly and transparently.

1.2 SimpleKPI as a Data Processor

Everything inside a customer's account is different. When you use SimpleKPI because your employer or another organization gave you access, that organization is the data controller and SimpleKPI is the data processor. This covers the data they upload, and it also covers your own User account record and your usage of the Service. SimpleKPI does not control or own that data, and clause 2.2 of our Data Processing Agreement sets out the split in full.

1.3 Responsibilities of Data Subjects and Clients

If you want to exercise your rights over data held inside a customer's account, including your own User account record, please contact that organization directly. The Client, as the data controller, manages such requests under data protection laws. SimpleKPI processes Client Data on the Client's instructions, and accesses it only to deliver the Service, to resolve a service or technical issue, or where required by law, as set out in Section 3.2 of the Terms of Service and clause 3.4 of our Data Processing Agreement.

For further details or inquiries, please contact us at privacy@simplekpi.com.

2. The Information We Collect

2.1 Information Provided Directly to SimpleKPI

Account Signup:

When creating an account to access our Service, we collect essential information such as your name and business email address to complete the signup process. Optionally, you can provide additional details such as your photo, time zone, and language preferences for account customization; however, these are not required to create an account.

Payment Processing:

Payments are handled by our payment provider, Stripe. When you subscribe, your card details are collected and stored by Stripe, not by SimpleKPI: card data is entered in Stripe's secure checkout and never passes through or is stored on SimpleKPI's servers. SimpleKPI stores only a Stripe customer reference and subscription reference for your Account; where card details (such as the card brand, expiry date, or last four digits) are shown in the application, they are retrieved from Stripe at the time of display. Stripe processes your payment information under its own privacy policy.

Testimonials:

If you authorize us, we may feature testimonials about our Service on our Website, which can include your name and other Personal Data. You will have the opportunity to review and approve the testimonial before it is posted. To update or remove your testimonial, contact us at privacy@simplekpi.com.

2.2 Information Collected Automatically

Information from Browsers, Devices, and Servers:

When you visit our Website, we collect information that web browsers, mobile devices, and servers provide, such as IP address, browser type, language preference, time zone, referring URL, access date and time, operating system, mobile device manufacturer, and mobile network details. This data is logged to better understand Website Visitors and tailor the Website experience to their needs.

Information from Cookies and Tracking Technologies:

We use temporary and permanent cookies to identify Visitors and Users and enhance their experience. Analytics cookies (such as Google Analytics on our Website) work differently depending on where you are. In the UK, the EEA and Switzerland we ask first and set nothing until you accept. Elsewhere, where no prior-consent requirement applies, they are active on arrival and you can decline at any time through the cookie banner or the Cookie settings link in the footer. We also use similar technologies to monitor Website navigation, gather aggregate demographic information, and measure the effectiveness of our communications.

Information from Application Logs and Analytics:

We collect data from application logs and in-house analytics tools to understand your and your end-users' interactions with our Service. This includes information on clicks, scrolls, features accessed, access times and frequency, errors, performance metrics, storage utilization, user settings, configurations, and devices and locations used to access the Service. This data helps us enhance the functionality and relevance of our offerings.

2.3 Information Collected from Third Parties

Signups Using Federated Authentication Providers:

You can log in to the Service using federated authentication providers, currently Google and Microsoft, or, for enterprise customers, your organization's own single sign-on (SSO) identity provider. These services authenticate your identity and may share certain Personal Data, such as your name and email address, with us solely for the purpose of authentication and account setup. Check your privacy settings on these services to manage what information is shared, and review their terms and privacy notices before connecting them to our Service.

Information from Social Media and Public Sources:

If you engage with us on social media platforms (e.g., Facebook, X (Twitter), LinkedIn) or leave feedback or reviews on marketplaces or review sites, we may collect publicly available information, such as profile details and comments. This data helps us improve our Service, understand user reactions, and, where appropriate, reproduce and publish your feedback on our Website. Note that such information may remain with us even if removed from the original platform.

Information from Third-Party Integrations:

When you integrate third-party services with your SimpleKPI account, those integrations may request permissions to access data or exchange information with your account. This includes integrations with Google services, specifically Google Analytics and Google Sheets. You are responsible for reviewing the permissions you grant to these third-party applications, as they may have access to view, store, and potentially modify data according to their terms and privacy policies. We are not responsible for their practices, so please carefully evaluate the permissions granted. Specific limits apply to data accessed via Google APIs, as detailed in Section 3.6.

Information from Resellers, Partners, and Service Providers:

Resellers, partners, or service providers may share your information, such as name, email address, and company name, with us if you express interest in our Service (e.g., via a form or event registration). Event organizers for sponsored events may also share attendee information. Additionally, if you comment on a review of our Service, or if third-party providers help market our Service, we may receive information about you from those sources.

2.4 Information Processed When You Use AI Features

When you or your Users interact with AI Features (for example, asking the AI a question, importing a spreadsheet with AI mapping, or generating an AI analysis), the content of the interaction is processed to produce the response. This can include your prompts and messages, the relevant KPI and Account data needed to answer, and the resulting outputs. This information is processed on Microsoft Azure AI Foundry as described in Section 3.7.

3. How We Use the Information We Collect

3.1 Operations

We use the information to set up and maintain your Account and facilitate our Service, including collaboration features, website hosting, data processing, and data backup and restoration. We also use this information to provide customer support and improve interactions with Clients and Users, as well as to detect and prevent fraudulent transactions, illegal activities, and spam, protecting the rights and interests of SimpleKPI, its Clients, Users, and the public.

3.2 Improvements

We analyze how Users interact with our Service to troubleshoot issues, monitor usage trends, and improve functionality. We also track visitor behavior on our Website to enhance the user experience. Client Data processed for these purposes is anonymized or aggregated whenever possible. Data obtained via Google APIs (specifically Google Analytics and Google Sheets data, see Section 3.6) is used only for providing and improving the specific integration features within the Service itself (e.g., displaying analytics data, importing/exporting sheet data), in accordance with Google's policies.

3.3 Communications

We use your contact information to inform you about products, services, or materials you've signed up for, as well as to notify you of changes to this Notice, the Terms of Service, or other important updates. Additionally, we may use your information to keep you updated on new features, events, promotions, and offers that may interest you, or to request feedback and invite you to participate in surveys to improve our Service.

3.4 Analytics

We update, expand, and analyze records to identify new customers and recommend relevant products or services. We enhance marketing campaigns by retargeting Users interested in our Service, finding similar high-value audiences, and ensuring relevant advertising for existing Clients. Data obtained via Google APIs (Google Analytics and Google Sheets data, see Section 3.6) is explicitly excluded from these general analytics and marketing activities, beyond what is necessary to provide the integrated feature itself.

3.5 Legal Bases for Processing Personal Data (UK, EEA, and Other Relevant Jurisdictions)

We process your Personal Data only when legally permitted, such as:

• To provide our Service: for operations, support, and personalized features, including integrated functionalities and AI Features.
• For legitimate interests: to ensure security, conduct research, improve marketing, and protect legal rights (without overriding your data protection rights).
• With your consent: for specific purposes where you've granted permission (e.g., analytics cookies on our Website, or connecting your Google account to integrate Analytics or Sheets data).
• To meet legal obligations: when compliance with applicable law is required.

You have the right to object to processing based on legitimate interests or direct marketing. If you withdraw consent for a specific integration or processing activity, we will stop processing your information for that purpose unless legally required or permitted to continue.

3.6 Additional Limits on Use of Your Google User Data

Notwithstanding anything else in this Privacy Notice, if you provide SimpleKPI access to your Google data via our integrations with Google Analytics and/or Google Sheets, SimpleKPI's use of that data will be subject to these additional restrictions:

• Permitted Use: SimpleKPI will only access, use, store, or share Google user data obtained through the Google Analytics API or Google Sheets API to provide or improve the user-facing integration features that are prominent in the SimpleKPI user interface. For example:
  • Accessing Google Analytics data to display metrics and reports within your SimpleKPI dashboard.
  • Accessing Google Sheets data to allow you to import data into SimpleKPI or export data from SimpleKPI to a specific Sheet you authorize.
• Prohibited Advertising Use: Google user data obtained via these APIs will never be used for serving advertisements, including personalized, re-targeted, or interest-based advertising.
• Prohibited Sale: We will never sell Google user data obtained via these APIs.
• Limited Transfer: We will not transfer Google user data obtained via these APIs to others unless doing so is:
  • Necessary to provide or improve the specific user-facing integration features described above.
  • Necessary to comply with applicable laws or regulations.
  • Necessary for security purposes (e.g., investigating abuse).
  • Part of a merger, acquisition, or sale of assets of SimpleKPI (you will be notified).
  • In response to your explicit consent for a specific purpose directly related to the integration.
• Limited Human Access: SimpleKPI personnel will not read your Google user data (e.g., specific cell content in Google Sheets or detailed analytics data) unless:
  • We have your affirmative agreement for specific data access (e.g., for support purposes related to the integration).
  • It is necessary for security purposes, such as investigating potential abuse related to the integration.
  • It is necessary to comply with applicable law.
  • The data has been aggregated and anonymized and is used solely for internal operations aimed at improving the integration features or overall Service performance (e.g., analyzing aggregated usage patterns of the integration).

SimpleKPI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.7 AI Features and AI Processing

AI Features inside the SimpleKPI application are powered by large language models running on Microsoft Azure AI Foundry, Microsoft's enterprise AI platform, with Microsoft acting as our sub-processor. All AI processing for those features takes place inside Microsoft Azure's infrastructure under Microsoft's data protection commitments. Your account data and Client Data are not sent directly to third-party AI companies such as OpenAI or Anthropic: the models run within Azure, and interaction content is not transmitted to a model provider's own servers. When you use an AI Feature, the information described in Section 2.4 is processed within this environment to generate the response.

Two tools on our public website work differently. The free KPI Generator sends the business area you describe, such as "sales" or "customer support", to OpenAI, which returns a list of suggested KPIs. The contact form sends the text of your message to OpenAI so it can be screened for spam before it reaches our team. Nothing that identifies you is sent with either: not your name, not your email address, not your IP address, and nothing from a SimpleKPI account. Neither tool involves Client Data or the AI Features inside the Service.

• No training: SimpleKPI does not use your Personal Data or Client Data to train AI models, and Microsoft does not use data processed through Azure AI Foundry to train AI models or share it with model providers.
• Limited retention: Microsoft may retain interaction data for a short period (up to 30 days) solely for abuse and misuse monitoring under its own terms, after which it is deleted.
• No advertising use: data processed by AI Features is never used for advertising or sold.
• Your choice: AI Features are optional. If you prefer not to have particular data processed by AI Features, do not include it in prompts or AI-assisted imports.

4. To Whom We Disclose Information

4.1 Unrestricted Information

Any information you choose to include in a Public Area of the Service (e.g., community forums, support materials, or blogs) is publicly available to Visitors and Users. This includes profile information or posts that remain even after your account is terminated. Be cautious about sharing sensitive information in these areas. Upon request, we can remove or correct posted content, but certain information may not be removable.

4.2 Other Users in Your Company Account

Information about your Service use is accessible to your Account Administrator(s) and may also be visible to other Users based on the account settings.

4.3 Service Providers and Sub-processors

We work with third-party providers to support our Website, hosting, security, fraud detection, payment processing, and other essential services. These providers may access Personal Data (including potentially Google user data obtained via Analytics/Sheets APIs, strictly under the limitations described in Section 3.6) as required to perform their functions for SimpleKPI, but are contractually obligated to maintain the confidentiality and security of this information and are prohibited from using it for any other purpose.

Our key sub-processors, by category, are:

• Hosting and infrastructure: Microsoft Azure (application hosting, databases, storage, and security services) and Cloudflare (network security and content delivery).
• Payments: Stripe (subscription billing and card processing).
• AI Features: Microsoft Azure AI Foundry (see Section 3.7).
• Email delivery: Amazon Web Services (transactional and service emails).
• Support and communications: Zendesk (in-app messaging and support conversations).
• Website analytics: Google Analytics (with your consent, on the public Website).
• Website tools: OpenAI (spam screening on our contact form, and KPI suggestions in our free KPI Generator, as described in Section 3.7).

We will update this list whenever we add or replace a sub-processor. Where we act as your processor, we give at least 30 days' advance notice of every addition or replacement, and you may object, as set out in clause 6 of our Data Processing Agreement. The full list, with each sub-processor's location and transfer safeguard, is in that agreement.

4.4 Social Media

Our Website links to our profiles on social media platforms (e.g., Facebook, LinkedIn, X (Twitter), YouTube, Vimeo). If you follow these links or interact with us on those platforms, your interactions are governed by the privacy notices of the respective social media providers.

4.5 Partners

The service providers we share data with are the sub-processors named in Section 4.3, and the full list, with each one's location and safeguard, is in our Data Processing Agreement. We do not permit any of them to use shared data to contact our Clients for their own sales or marketing purposes.

4.6 Non-Personally Identifiable Information

We may share aggregated or non-personally identifiable information with third parties for business purposes, such as understanding user behavior, complying with legal obligations, or marketing analysis. This data does not identify individuals. Aggregated data derived from Google user data will only be shared externally if it is fully anonymized and complies with the Google API Services User Data Policy.

4.7 Law Enforcement, Legal Process, and Compliance

We may disclose Personal Data, including Google user data obtained via Analytics/Sheets APIs, if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, respond to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose information when we believe, in good faith, it is appropriate or necessary to prevent liability, protect against fraudulent, abusive, or unlawful uses or activity, protect the security or integrity of our Service, or protect our rights, property, or safety or those of others.

4.8 Change of Ownership

In the event of a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of SimpleKPI's assets, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, Personal Data, including Google user data subject to the limitations herein, may be shared or transferred, subject to standard confidentiality arrangements and compliance with the Google API Services User Data Policy.

4.9 International Data Transfers

Some of our sub-processors process data outside the UK and EEA, including in the United States. Where Personal Data is transferred internationally, we rely on appropriate safeguards under UK and EU data protection law: adequacy decisions (including the UK-US Data Bridge and EU-US Data Privacy Framework where the recipient is certified), the EU Standard Contractual Clauses, and, for UK transfers, the UK Addendum to those clauses. Each sub-processor's location and the safeguard that applies to it are set out in our Data Processing Agreement.

5. Data Security

At SimpleKPI, we prioritize the security of your data by implementing robust administrative, technical, and physical safeguards designed to prevent unauthorized access, use, modification, disclosure, or destruction of the information you entrust to us. These measures are regularly reviewed and updated. However, no security system is impenetrable, and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others. You are responsible for maintaining the secrecy of your sign-in credentials and account information and for controlling access to your email communications at all times. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us by contacting us at privacy@simplekpi.com.

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including providing the Service, complying with our legal obligations, resolving disputes, maintaining business records, and enforcing our agreements. Once we no longer have a legitimate business need to process your information, we will either delete or anonymize it. If deletion is not immediately possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.

• The contents of cancelled and expired Accounts are permanently deleted within the six-month period described in the Terms of Service. We send a warning notice around 14 days before deletion. Clients may request earlier deletion, which we will fulfill within one month.
• The contents of lapsed Free Trial Accounts are generally deleted within two months of the trial lapsing.
• Where a Client asks us to keep their data when cancelling (for example, because they may re-subscribe), it is retained for up to 12 months before permanent deletion, unless otherwise required by law or agreement.
• Server backups containing Personal Data are retained for a limited period (generally up to 35 days) before being securely deleted. During our platform migration, long-term archival backups of the previous-generation database are retained for up to six months.
• AI conversation transcripts are retained for 12 months and are then deleted. They are never used to train models, and are deleted immediately if the Account is deleted.
• Spreadsheets uploaded through the AI-assisted import, and the redacted samples we keep to improve import quality, are retained for up to 12 months.

7. Your Choices

7.1 Your Rights with Respect to Information We Hold About You as a Controller

Depending on your location and applicable law, you may have the following rights regarding your Personal Data:

• Right to Access: request access to the Personal Data we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete Personal Data.
• Right to Erasure (Deletion): request deletion of your Personal Data under certain conditions.
• Right to Restrict Processing: request restriction of how we use your data under certain conditions.
• Right to Data Portability: request transfer of your Personal Data to another entity in a structured, machine-readable format where technically feasible.
• Right to Object: object to our processing of your data based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent (this does not affect lawfulness of processing before withdrawal).
• Right to Lodge a Complaint: file a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

You can exercise many of these rights through your Account settings or by contacting us at privacy@simplekpi.com. We will respond to requests in accordance with applicable data protection laws.

• Account Information: you can update, correct, or delete profile information in your Account settings.
• Declining Information: you may decline to share certain information, but this may limit access to some Service features.

7.2 Opting Out

We provide various options for opting out of data processing activities:

• Marketing Communications: you can opt out of receiving promotional emails by using the "unsubscribe" link in the email or contacting us. You will still receive essential service-related communications.
• Cookies: in the UK, the EEA and Switzerland, analytics cookies run only after you accept them. Elsewhere they are on by default and you can decline at any time. Either way, use the Cookie settings link in the footer of any page to change your choice.
• Analytics: opt out of Google Analytics tracking on our website by declining cookies, or using Google's browser add-on. (Note: this relates to tracking on the SimpleKPI website, not the Google Analytics data you might integrate into SimpleKPI.)
• Google Account Access: you can revoke SimpleKPI's access to your Google account (for Google Analytics or Google Sheets integration) at any time via your Google account security settings page (https://myaccount.google.com/permissions). Revoking access will disable the related integration features in SimpleKPI.
• AI Features: if you prefer not to have particular data processed by AI Features, do not include it in AI prompts or AI-assisted imports (see Section 3.7).

Contact privacy@simplekpi.com for assistance with opt-out requests.

7.3 Information Processed on Behalf of Clients

SimpleKPI processes data provided by our Clients (acting as a data processor). If your data has been submitted to the Service by a SimpleKPI Client and you wish to exercise your data subject rights, please contact the relevant Client (the data controller) directly. SimpleKPI Clients can manage data within the application or contact privacy@simplekpi.com for assistance.

Where we act as your processor, the terms of that processing are set out in our Data Processing Agreement, which is available to every customer and needs no separate request. Our wider approach to GDPR, including where data is stored, how international transfers are handled and what happens in the event of a breach, is set out on our GDPR page.

8. Cookies and Similar Technologies

These are every cookie this website sets. Whether any of them is set before you choose depends on where you are. In the UK, the EEA and Switzerland we ask first: the only cookies written beforehand are the ones that record your choice and where you are, so we know whether to ask. Elsewhere the analytics and marketing cookies below are set on arrival and you can decline at any time. The Purpose column says which rule applies to each one.

The two Google Analytics durations are Google's defaults for GA4.

Where you are changes when we ask. In the European Economic Area and the United Kingdom, prior consent is required, and we apply the same rule in Switzerland, so the banner appears and Google Consent Mode holds all four of its signals (ad_storage, ad_user_data, ad_personalization and analytics_storage) at "denied" until you accept. No analytics cookie is written and no identifier is sent before that. Elsewhere, where no prior-consent requirement applies, analytics is enabled by default and the banner does not interrupt you.

You can decline anywhere, at any time. The Cookie settings link in the footer of every page opens the same choice wherever you are, and choosing to decline is remembered across visits. To work out which rule applies we read the country your network connection reports, through Cloudflare, on our own domain. That check involves no third party and stores nothing beyond a short-lived note of the answer so we do not have to repeat it on every page.

Embedded videos do not set anything on arrival. YouTube and Vimeo players load only when you deliberately click or activate them by keyboard, so their cookies are set at that moment and not before.

To change your mind later, use the Cookie settings link in the footer of any page. That clears the consent cookie and brings the banner back, so you can answer again. You can also delete cookies through your browser settings at any time.

9. Updates to This Privacy Notice

This Privacy Notice may be revised periodically to reflect changes in our practices, services, or legal requirements. We will post any adjustments on this page, and the revised version will be effective when it is posted. If we make significant changes, we will provide more prominent notice (e.g., through the Service interface or via email). We encourage you to review this Notice periodically. Your continued use of the Service after the revised Notice has become effective indicates that you have read, understood, and agreed to the current version.

10. Contacting Us

If you have any questions, comments, or concerns about this Privacy Notice, your Personal Data, our use and disclosure practices, or your consent choices, please contact us at privacy@simplekpi.com.