Privacy Notice your data, handled with care

This Privacy Notice ("Notice") describes the information we gather on or through the SimpleKPI Service, how we use and disclose such information, and the steps we take to protect it. This Notice is incorporated into, and is subject to, the SimpleKPI Terms of Service.

Who is responsible for your data

The data controller for the Personal Data described in this Notice is:

SimpleKPI Ltd
86-90 Paul Street, London, EC2A 4NE, United Kingdom
Registered in England, company number 6191007
Email: support@simplekpi.com

For any question about this Notice, to exercise your rights over your Personal Data, or to withdraw a consent you have given us, contact us at support@simplekpi.com or through our contact page. You can change or withdraw your cookie consent at any time using the cookie settings link in the footer of every page.

If you are in the UK you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA you may lodge a complaint with your local supervisory authority.

Definitions

"Visitor" refers to any individual who accesses the Public Area of the SimpleKPI Website but does not hold a User account or access the Restricted Area.

"Service" refers to the SimpleKPI Services as defined in the Terms of Service, including the platform, features, and any associated tools provided by SimpleKPI.

"Restricted Area" refers to secure sections of the SimpleKPI platform that are accessible only to Users and require valid login credentials for entry.

"Public Area" refers to sections of the SimpleKPI Website that are accessible to both Users and Visitors without requiring login credentials.

"Personal Data" refers to any information that pertains to an identified or identifiable individual, such as names, contact details, or any data that can be linked to a specific person.

"AI Features" refers to functionality within the Service that uses machine-learning or generative artificial-intelligence technology, as described in the Terms of Service.

1. SimpleKPI Roles and Responsibilities

This section outlines SimpleKPI's roles and responsibilities concerning the processing of Personal Data:

1.1 SimpleKPI as a Data Controller

SimpleKPI acts as a data controller when determining the purposes and means of processing your Personal Data. This includes data collected directly (e.g., when creating an account or interacting with our Service) and automatically (e.g., via cookies or third-party sources). As a data controller, SimpleKPI ensures lawful, fair, and transparent data processing while safeguarding your rights.

1.2 SimpleKPI as a Data Processor

When processing data on behalf of Clients, SimpleKPI operates as a data processor. SimpleKPI does not control or own Client Data and accesses it only as authorized or necessary to deliver the Service.

1.3 Responsibilities of Data Subjects and Clients

If you are a data subject seeking to exercise your rights (e.g., access, correction, or deletion of Personal Data), please contact the Client directly. The Client, as the data controller, manages such requests under data protection laws. SimpleKPI processes Client Data solely based on Client instructions and does not access it unless explicitly authorized.

For further details or inquiries, please contact us at privacy@simplekpi.com.

2. The Information We Collect

2.1 Information Provided Directly to SimpleKPI

Account Signup:

When creating an account to access our Service, we collect essential information such as your name and business email address to complete the signup process. Optionally, you can provide additional details such as your photo, time zone, and language preferences for account customization; however, these are not required to create an account.

Payment Processing:

Payments are handled by our payment provider, Stripe. When you subscribe, your card details are collected and stored by Stripe, not by SimpleKPI: card data is entered in Stripe's secure checkout and never passes through or is stored on SimpleKPI's servers. SimpleKPI stores only a Stripe customer reference and subscription reference for your Account; where card details (such as the card brand, expiry date, or last four digits) are shown in the application, they are retrieved from Stripe at the time of display. Stripe processes your payment information under its own privacy policy.

Testimonials:

If you authorize us, we may feature testimonials about our Service on our Website, which can include your name and other Personal Data. You will have the opportunity to review and approve the testimonial before it is posted. To update or remove your testimonial, contact us at privacy@simplekpi.com.

2.2 Information Collected Automatically

Information from Browsers, Devices, and Servers:

When you visit our Website, we collect information that web browsers, mobile devices, and servers provide, such as IP address, browser type, language preference, time zone, referring URL, access date and time, operating system, mobile device manufacturer, and mobile network details. This data is logged to better understand Website Visitors and tailor the Website experience to their needs.

Information from Cookies and Tracking Technologies:

We use temporary and permanent cookies to identify Visitors and Users and enhance their experience. Analytics cookies (such as Google Analytics on our Website) are only activated with your consent, which you can give or decline through the cookie banner and change at any time. We also use similar technologies to monitor Website navigation, gather aggregate demographic information, and measure the effectiveness of our communications.

Information from Application Logs and Analytics:

We collect data from application logs and in-house analytics tools to understand your and your end-users' interactions with our Service. This includes information on clicks, scrolls, features accessed, access times and frequency, errors, performance metrics, storage utilization, user settings, configurations, and devices and locations used to access the Service. This data helps us enhance the functionality and relevance of our offerings.

2.3 Information Collected from Third Parties

Signups Using Federated Authentication Providers:

You can log in to the Service using federated authentication providers, currently Google and Microsoft, or, for enterprise customers, your organization's own single sign-on (SSO) identity provider. These services authenticate your identity and may share certain Personal Data, such as your name and email address, with us solely for the purpose of authentication and account setup. Check your privacy settings on these services to manage what information is shared, and review their terms and privacy notices before connecting them to our Service.

Information from Social Media and Public Sources:

If you engage with us on social media platforms (e.g., Facebook, X (Twitter), LinkedIn) or leave feedback or reviews on marketplaces or review sites, we may collect publicly available information, such as profile details and comments. This data helps us improve our Service, understand user reactions, and, where appropriate, reproduce and publish your feedback on our Website. Note that such information may remain with us even if removed from the original platform.

Information from Third-Party Integrations:

When you integrate third-party services with your SimpleKPI account, those integrations may request permissions to access data or exchange information with your account. This includes integrations with Google services, specifically Google Analytics and Google Sheets. You are responsible for reviewing the permissions you grant to these third-party applications, as they may have access to view, store, and potentially modify data according to their terms and privacy policies. We are not responsible for their practices, so please carefully evaluate the permissions granted. Specific limits apply to data accessed via Google APIs, as detailed in Section 3.6.

Information from Resellers, Partners, and Service Providers:

Resellers, partners, or service providers may share your information, such as name, email address, and company name, with us if you express interest in our Service (e.g., via a form or event registration). Event organizers for sponsored events may also share attendee information. Additionally, if you comment on a review of our Service, or if third-party providers help market our Service, we may receive information about you from those sources.

2.4 Information Processed When You Use AI Features

When you or your Users interact with AI Features (for example, asking the AI a question, importing a spreadsheet with AI mapping, or generating an AI analysis), the content of the interaction is processed to produce the response. This can include your prompts and messages, the relevant KPI and Account data needed to answer, and the resulting outputs. This information is processed on Microsoft Azure AI Foundry as described in Section 3.7.

3. How We Use the Information We Collect

3.1 Operations

We use the information to set up and maintain your Account and facilitate our Service, including collaboration features, website hosting, data processing, and data backup and restoration. We also use this information to provide customer support and improve interactions with Clients and Users, as well as to detect and prevent fraudulent transactions, illegal activities, and spam, protecting the rights and interests of SimpleKPI, its Clients, Users, and the public.

3.2 Improvements

We analyze how Users interact with our Service to troubleshoot issues, monitor usage trends, and improve functionality. We also track visitor behavior on our Website to enhance the user experience. Client Data processed for these purposes is anonymized or aggregated whenever possible. Data obtained via Google APIs (specifically Google Analytics and Google Sheets data, see Section 3.6) is used only for providing and improving the specific integration features within the Service itself (e.g., displaying analytics data, importing/exporting sheet data), in accordance with Google's policies.

3.3 Communications

We use your contact information to inform you about products, services, or materials you've signed up for, as well as to notify you of changes to this Notice, the Terms of Service, or other important updates. Additionally, we may use your information to keep you updated on new features, events, promotions, and offers that may interest you, or to request feedback and invite you to participate in surveys to improve our Service.

3.4 Analytics

We update, expand, and analyze records to identify new customers and recommend relevant products or services. We enhance marketing campaigns by retargeting Users interested in our Service, finding similar high-value audiences, and ensuring relevant advertising for existing Clients. Data obtained via Google APIs (Google Analytics and Google Sheets data, see Section 3.6) is explicitly excluded from these general analytics and marketing activities, beyond what is necessary to provide the integrated feature itself.

3.5 Legal Bases for Processing Personal Data (UK, EEA, and Other Relevant Jurisdictions)

We process your Personal Data only when legally permitted, such as:

• To provide our Service: for operations, support, and personalized features, including integrated functionalities and AI Features.
• For legitimate interests: to ensure security, conduct research, improve marketing, and protect legal rights (without overriding your data protection rights).
• With your consent: for specific purposes where you've granted permission (e.g., analytics cookies on our Website, or connecting your Google account to integrate Analytics or Sheets data).
• To meet legal obligations: when compliance with applicable law is required.

You have the right to object to processing based on legitimate interests or direct marketing. If you withdraw consent for a specific integration or processing activity, we will stop processing your information for that purpose unless legally required or permitted to continue.

3.6 Additional Limits on Use of Your Google User Data

Notwithstanding anything else in this Privacy Notice, if you provide SimpleKPI access to your Google data via our integrations with Google Analytics and/or Google Sheets, SimpleKPI's use of that data will be subject to these additional restrictions:

• Permitted Use: SimpleKPI will only access, use, store, or share Google user data obtained through the Google Analytics API or Google Sheets API to provide or improve the user-facing integration features that are prominent in the SimpleKPI user interface. For example:
  • Accessing Google Analytics data to display metrics and reports within your SimpleKPI dashboard.
  • Accessing Google Sheets data to allow you to import data into SimpleKPI or export data from SimpleKPI to a specific Sheet you authorize.
• Prohibited Advertising Use: Google user data obtained via these APIs will never be used for serving advertisements, including personalized, re-targeted, or interest-based advertising.
• Prohibited Sale: We will never sell Google user data obtained via these APIs.
• Limited Transfer: We will not transfer Google user data obtained via these APIs to others unless doing so is:
  • Necessary to provide or improve the specific user-facing integration features described above.
  • Necessary to comply with applicable laws or regulations.
  • Necessary for security purposes (e.g., investigating abuse).
  • Part of a merger, acquisition, or sale of assets of SimpleKPI (you will be notified).
  • In response to your explicit consent for a specific purpose directly related to the integration.
• Limited Human Access: SimpleKPI personnel will not read your Google user data (e.g., specific cell content in Google Sheets or detailed analytics data) unless:
  • We have your affirmative agreement for specific data access (e.g., for support purposes related to the integration).
  • It is necessary for security purposes, such as investigating potential abuse related to the integration.
  • It is necessary to comply with applicable law.
  • The data has been aggregated and anonymized and is used solely for internal operations aimed at improving the integration features or overall Service performance (e.g., analyzing aggregated usage patterns of the integration).

SimpleKPI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.7 AI Features and AI Processing

AI Features are powered by large language models running on Microsoft Azure AI Foundry, Microsoft's enterprise AI platform, with Microsoft acting as our sub-processor. All AI processing takes place inside Microsoft Azure's infrastructure under Microsoft's data protection commitments. Your data is not sent directly to third-party AI companies such as OpenAI or Anthropic: the models run within Azure, and interaction content is not transmitted to a model provider's own servers. When you use an AI Feature, the information described in Section 2.4 is processed within this environment to generate the response.

• No training: SimpleKPI does not use your Personal Data or Client Data to train AI models, and Microsoft does not use data processed through Azure AI Foundry to train AI models or share it with model providers.
• Limited retention: Microsoft may retain interaction data for a short period (up to 30 days) solely for abuse and misuse monitoring under its own terms, after which it is deleted.
• No advertising use: data processed by AI Features is never used for advertising or sold.
• Your choice: AI Features are optional. If you prefer not to have particular data processed by AI Features, do not include it in prompts or AI-assisted imports.

4. To Whom We Disclose Information

4.1 Unrestricted Information

Any information you choose to include in a Public Area of the Service (e.g., community forums, support materials, or blogs) is publicly available to Visitors and Users. This includes profile information or posts that remain even after your account is terminated. Be cautious about sharing sensitive information in these areas. Upon request, we can remove or correct posted content, but certain information may not be removable.

4.2 Other Users in Your Company Account

Information about your Service use is accessible to your Account Administrator(s) and may also be visible to other Users based on the account settings.

4.3 Service Providers and Sub-processors

We work with third-party providers to support our Website, hosting, security, fraud detection, payment processing, and other essential services. These providers may access Personal Data (including potentially Google user data obtained via Analytics/Sheets APIs, strictly under the limitations described in Section 3.6) as required to perform their functions for SimpleKPI, but are contractually obligated to maintain the confidentiality and security of this information and are prohibited from using it for any other purpose.

Our key sub-processors, by category, are:

• Hosting and infrastructure: Microsoft Azure (application hosting, databases, storage, and security services) and Cloudflare (network security and content delivery).
• Payments: Stripe (subscription billing and card processing).
• AI Features: Microsoft Azure AI Foundry (see Section 3.7).
• Email delivery: Amazon Web Services (transactional and service emails).
• Support and communications: Zendesk (in-app messaging and support conversations).
• Website analytics: Google Analytics (with your consent, on the public Website).

We will update this list when we add or replace sub-processors that materially change how Personal Data is handled.

4.4 Social Media

Our Website links to our profiles on social media platforms (e.g., Facebook, LinkedIn, X (Twitter), YouTube, Vimeo). If you follow these links or interact with us on those platforms, your interactions are governed by the privacy notices of the respective social media providers.

4.5 Partners

We may share data with trusted partners who assist us with specific functions like analytics, technical support, or infrastructure provision. These partners help us operate and improve our Service. We do not permit partners to use shared data to directly contact our Clients for their own sales or marketing purposes. You can inquire about our partners by contacting us at partners@simplekpi.com.

4.6 Non-Personally Identifiable Information

We may share aggregated or non-personally identifiable information with third parties for business purposes, such as understanding user behavior, complying with legal obligations, or marketing analysis. This data does not identify individuals. Aggregated data derived from Google user data will only be shared externally if it is fully anonymized and complies with the Google API Services User Data Policy.

4.7 Law Enforcement, Legal Process, and Compliance

We may disclose Personal Data, including Google user data obtained via Analytics/Sheets APIs, if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, respond to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose information when we believe, in good faith, it is appropriate or necessary to prevent liability, protect against fraudulent, abusive, or unlawful uses or activity, protect the security or integrity of our Service, or protect our rights, property, or safety or those of others.

4.8 Change of Ownership

In the event of a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of SimpleKPI's assets, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, Personal Data, including Google user data subject to the limitations herein, may be shared or transferred, subject to standard confidentiality arrangements and compliance with the Google API Services User Data Policy.

4.9 International Data Transfers

Some of our sub-processors process data outside the UK and EEA, including in the United States. Where Personal Data is transferred internationally, we rely on appropriate safeguards under UK and EU data protection law, such as adequacy decisions (including the UK-US Data Bridge and EU-US Data Privacy Framework where the recipient is certified), the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses.

5. Data Security

At SimpleKPI, we prioritize the security of your data by implementing robust administrative, technical, and physical safeguards designed to prevent unauthorized access, use, modification, disclosure, or destruction of the information you entrust to us. These measures are regularly reviewed and updated. However, no security system is impenetrable, and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others. You are responsible for maintaining the secrecy of your unique password and account information and for controlling access to your email communications at all times. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us by contacting us at privacy@simplekpi.com.

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including providing the Service, complying with our legal obligations, resolving disputes, maintaining business records, and enforcing our agreements. Once we no longer have a legitimate business need to process your information, we will either delete or anonymize it. If deletion is not immediately possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.

• The contents of closed Accounts are generally deleted within 90 days of closure, and in any event within the six-month period described in the Terms of Service. Clients may request earlier deletion, which we will fulfill within one month.
• The contents of closed Free Trial Accounts are generally deleted within 60 days of closure.
• Server archival backups containing Personal Data are retained for a limited period (generally up to 120 days) before being securely deleted.
• Clients may request alternative retention arrangements upon account cancellation, subject to agreement. Data flagged by the Client not to be deleted may be retained for up to 6 months before permanent deletion, unless otherwise required by law or agreement.

7. Your Choices

7.1 Your Rights with Respect to Information We Hold About You as a Controller

Depending on your location and applicable law, you may have the following rights regarding your Personal Data:

• Right to Access: request access to the Personal Data we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete Personal Data.
• Right to Erasure (Deletion): request deletion of your Personal Data under certain conditions.
• Right to Restrict Processing: request restriction of how we use your data under certain conditions.
• Right to Data Portability: request transfer of your Personal Data to another entity in a structured, machine-readable format where technically feasible.
• Right to Object: object to our processing of your data based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent (this does not affect lawfulness of processing before withdrawal).
• Right to Lodge a Complaint: file a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

You can exercise many of these rights through your Account settings or by contacting us at privacy@simplekpi.com. We will respond to requests in accordance with applicable data protection laws.

• Account Information: you can update, correct, or delete profile information in your Account settings.
• Declining Information: you may decline to share certain information, but this may limit access to some Service features.

7.2 Opting Out

We provide various options for opting out of data processing activities:

• Marketing Communications: you can opt out of receiving promotional emails by using the "unsubscribe" link in the email or contacting us. You will still receive essential service-related communications.
• Cookies: analytics cookies on our Website only run with your consent. You can decline them via the cookie banner, and change your choice at any time by clearing the consent cookie in your browser.
• Analytics: opt out of Google Analytics tracking on our website by declining cookies, or using Google's browser add-on. (Note: this relates to tracking on the SimpleKPI website, not the Google Analytics data you might integrate into SimpleKPI.)
• Google Account Access: you can revoke SimpleKPI's access to your Google account (for Google Analytics or Google Sheets integration) at any time via your Google account security settings page (https://myaccount.google.com/permissions). Revoking access will disable the related integration features in SimpleKPI.
• AI Features: if you prefer not to have particular data processed by AI Features, do not include it in AI prompts or AI-assisted imports (see Section 3.7).

Contact privacy@simplekpi.com for assistance with opt-out requests.

7.3 Information Processed on Behalf of Clients

SimpleKPI processes data provided by our Clients (acting as a data processor). If your data has been submitted to the Service by a SimpleKPI Client and you wish to exercise your data subject rights, please contact the relevant Client (the data controller) directly. SimpleKPI Clients can manage data within the application or contact support@simplekpi.com for assistance.

8. Cookies and Similar Technologies

These are every cookie this website sets. Nothing here is set before you make a choice, with the single exception of the cookie that records the choice itself.

The two Google Analytics durations are Google's defaults for GA4. Until you accept, Google Consent Mode holds all four of its signals (ad_storage, ad_user_data, ad_personalization and analytics_storage) at "denied", so no analytics cookie is written and no identifier is sent.

Embedded videos do not set anything on arrival. YouTube and Vimeo players load only when you deliberately click or activate them by keyboard, so their cookies are set at that moment and not before.

To change your mind later, use the Cookie settings link in the footer of any page. That clears the consent cookie and brings the banner back, so you can answer again. You can also delete cookies through your browser settings at any time.

9. Updates to This Privacy Notice

This Privacy Notice may be revised periodically to reflect changes in our practices, services, or legal requirements. We will post any adjustments on this page, and the revised version will be effective when it is posted. If we make significant changes, we will provide more prominent notice (e.g., through the Service interface or via email). We encourage you to review this Notice periodically. Your continued use of the Service after the revised Notice has become effective indicates that you have read, understood, and agreed to the current version.

10. Contacting Us

If you have any questions, comments, or concerns about this Privacy Notice, your Personal Data, our use and disclosure practices, or your consent choices, please contact us at privacy@simplekpi.com.