Privacy Policy

The Simp Company is an AI automation consulting practice operated by [Legal name of proprietor] as a sole proprietor from [City, State], India (“The Simp Company”, “we”, “us”). For anything in this policy, you can reach us at jay@simpcompany.com.

For visitors in the European Economic Area and the United Kingdom, we are the “data controller” of the personal data described here. For visitors in India, we are the “data fiduciary” under the Digital Personal Data Protection Act, 2023.

We collect personal information in exactly three situations:

• Contact form — if you write to us, we collect your name, email address, company name (optional), and your message, so we can reply to you. Legal basis: our legitimate interest in responding to enquiries you initiate, and taking steps prior to entering a contract.
• Booking a call — if you book an intro call, scheduling is handled by our booking provider (Calendly), which collects your name, email, and chosen time under its own privacy policy. We receive the booking details so we can hold the call.
• Analytics (only with your consent) — if you accept analytics cookies, we use Google Analytics 4 to understand how the site is used (pages visited, approximate location at city level, device and browser type). If you decline, no analytics run at all. Legal basis: your consent, which you can withdraw at any time via “Cookie preferences” in the footer.

We do not run advertising, we do not buy data about you, and we do not combine what you give us with data from data brokers.

• We never sell your personal information, and we never have. (For California readers: we do not “sell” or “share” personal information as defined by the CCPA/CPRA.)
• We never use your information for automated decisions that produce legal or similarly significant effects about you.
• We never send marketing email unless you explicitly asked for it — writing to us about a project is not a newsletter signup.

Like nearly every website, we rely on a small number of service providers who process data on our behalf, under contracts that restrict what they can do with it:

• Hosting and infrastructure — our website host (e.g. Vercel) processes technical request data (IP address, request logs) to serve the site securely.
• Scheduling — our booking provider processes booking details when you schedule a call.
• Analytics — Google processes analytics data described above, only after you consent.
• Email — our email provider processes correspondence you send us.

If we are ever required to disclose information by law, court order, or to protect our legal rights, we will do so only to the extent required.

We operate from India, and our service providers operate globally (including in the United States). When personal data moves across borders, we rely on the safeguards our providers offer — such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework — so that your data receives an equivalent level of protection wherever it is processed.

• Contact form messages and email correspondence — kept while we're in a conversation or engagement with you, then deleted or archived within 24 months of our last exchange.
• Booking records — retained per our booking provider's settings; we periodically delete stale records.
• Analytics data — Google Analytics retention is set to the minimum available period (currently 2 months for event data).

We keep information longer only where the law requires it (for example, records connected to invoicing and tax).

Wherever you are, we extend the same core rights to you: to know what we hold about you, to get a copy of it, to correct it, to have it deleted, to object to or restrict our use of it, and to withdraw consent (for example, for analytics) at any time without affecting anything that happened before you withdrew it.

Depending on where you live, these rights have specific legal names:

• EEA/UK (GDPR / UK GDPR) — rights of access, rectification, erasure, restriction, portability, and objection; and the right to lodge a complaint with your local supervisory authority or the UK ICO.
• United States (state privacy laws such as CCPA/CPRA) — the rights to know, delete, correct, and opt out of sale/sharing (we don't sell or share), and the right not to be discriminated against for exercising them.
• India (DPDP Act 2023) — the rights to access a summary of your personal data, correction and erasure, grievance redressal, and to nominate a person to exercise your rights.
• Australia (Privacy Act 1988) — rights to access and correct your personal information, and to complain to the OAIC if you believe we've mishandled it.

To exercise any of these, email jay@simpcompany.com with the subject “Privacy request”. We respond to all requests within 30 days, and we'll never charge you for a reasonable request. If you're in India, this address also serves as our grievance redressal contact under the DPDP Act; we acknowledge grievances within 48 hours and resolve them within 30 days.

The site is served entirely over HTTPS. We collect minimal data by design, restrict access to it to the people who need it, and use reputable providers with strong security practices. No internet transmission is 100% secure, but the less we collect, the less there is to protect — and that's our starting principle.

Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

If we change this policy, we'll update the “Last updated” date at the top. For material changes — like adding a new category of data collection — we'll make that clear on the site rather than burying it.

Questions, requests, or complaints: jay@simpcompany.com. We read every message.