Privacy Policy

Overview

Protecting your privacy matters to us — our whole business is helping companies prove they handle data responsibly, so we hold ourselves to the same standard. This Privacy Policy explains what information Simpra, Inc. ("Simpra", "we", "us") collects, why we collect it, where it is stored, and what we do with it.

We keep your information confidential. We share it only when we need to in order to deliver the Service to you, when you have given your consent, or when we are legally required to.

We have tried to make this policy as clear as possible. If something is not explained well, please contact us at privacy@simpra.ai.

1. What This Policy Covers

We want you to understand who we are, what kind of personal information we collect, and what we do with it.

• Personal information means information that identifies, or can reasonably be linked to, an individual. It does not include anonymous, de-identified, or aggregated statistical information that cannot be linked back to you.
• Our two roles. We act as a data controller for information about our website visitors, prospects, and customer account users. When customers use the Simpra platform, we act as a data processor on their behalf for the data they upload or generate (for example policies, controls, evidence, and questionnaire responses). That processing is governed by our agreement with the customer, including our Data Processing Addendum ("DPA").
• Part of our agreement. This policy forms part of our agreement with you and should be read together with our Terms of Service and any order form or DPA that applies to you.
• Updates. We may update this policy when our Service changes or when legal requirements change. See Section 12.

2. Who You Are Sharing Your Information With

You are sharing your information with Simpra, Inc. Sometimes we need to share it with others in order to provide the Service or because we are legally required to.

2.1 We do not sell your information

We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We do not share personal information for cross-context behavioral advertising.

2.2 Service providers and sub-processors

We use a limited set of vendors who need access to information to help us deliver the Service — for example, cloud hosting, AI model inference, payment processing, and email delivery. These providers may use the information only to perform services for us, must keep it confidential, and are contractually bound to protect it. Our current sub-processors are listed in Section 3.

2.3 Within your organization

Administrators of your Simpra account can see user activity and data within your organization's workspace.

2.4 With your instruction or consent

When you direct us to — for example, by connecting an integration or sharing a completed questionnaire or trust report with a third party — we share the information needed to carry out that instruction.

2.5 Legal and safety disclosures

We may disclose information to a third party where we believe in good faith that it is reasonably necessary to:

• comply with applicable law, regulation, legal process, or a valid government request;
• enforce our agreements and policies;
• protect the security and integrity of the Service;
• respond to data subject requests as required by law;
• protect Simpra, our customers, or the public from fraud or illegal activity; or
• respond to an emergency involving a risk of harm to any person.

2.6 Business transfers

If Simpra is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred or reviewed as part of that transaction. Any successor will be required to continue protecting your information in line with this policy, and we will notify you of any change in ownership that affects your information.

3. Where Your Information Goes

3.1 Hosting

The Simpra platform runs on Amazon Web Services (AWS) inside a private virtual network, with infrastructure located in the United States and Canada. Customer Data is stored and processed in these regions.

3.2 Our team

Simpra operates primarily from Canada. Team members may access limited information from where they work in order to provide support, billing, and account management — always under role-based access controls and only as needed for the task.

3.3 Sub-processors

We engage the following sub-processors. Each is contractually bound to confidentiality and data protection obligations at least as protective as those in this policy, and only receives the minimum information needed to perform its function.

We keep an up-to-date list of sub-processors on our Security page. Customers with an active DPA receive advance notice of material changes to this list.

3.4 How Customer Data flows

• Customers upload or connect data to Simpra — such as policies, evidence from integrated systems, and security questionnaires — to run their compliance program.
• Simpra processes that data to provide the Service, which may include sending relevant portions to our AI sub-processors to generate drafts, answers, and analysis.
• We do not decide what Customer Data contains. It may include sensitive information; we process it only on the customer's instructions and do not collect sensitive categories of personal information in our own capacity.

4. What Information We Collect and Why

We collect information when you set up an account, when you interact with us, and through your use of the Service. Sometimes we receive information from other sources, and we use cookies on our website.

4.1 Information you provide

• Account information: your name, business email, company name, role, and phone number (optional), plus the names and emails of users you invite.
• Company information: details about your organization such as its location, size, and the compliance frameworks you are working toward.
• Authentication data: credentials if you use password sign-in, or provider identifiers if you use SSO.
• Billing information: billing contact and payment method, handled by our payment processor. We do not store full payment card details.
• Communications: messages you send us through email, forms, support, or demo requests.
• Customer Data: data you upload or generate inside the Service. We process this on your behalf; you are the controller.

4.2 Information collected automatically

• Usage data: pages visited, features used, and actions taken within the Service.
• Device and browser data: IP address, browser type and version, operating system, and device identifiers.
• Log data: server logs, application logs, audit logs, and error reports.
• Cookies and similar technologies: see Section 9.

4.3 Information from third parties

• Identity providers: if you sign in through SSO (Google Workspace, Okta, Azure AD), we receive identifying information from those providers.
• Integration providers: if you connect integrations (AWS, GitHub, Azure, Jira, and others), we receive data from those systems according to the integration's configuration.
• Publicly available and business data: we may gather publicly available information about customer organizations (such as industry, size, and website) and limited enrichment data (such as job title) to understand our customer base and tailor our communications.

4.4 Why we use it

We use information to:

• provide, maintain, and improve the Service;
• create and manage your account, and recognize you when you sign in or contact us;
• process payments and send invoices;
• communicate with you about your account, the Service, updates, and support;
• send marketing communications, where permitted and subject to your right to opt out;
• monitor and analyze usage, performance, and reliability, and identify and fix problems;
• verify information and detect and prevent fraud, abuse, and security incidents;
• comply with legal obligations; and
• establish, exercise, and defend legal rights.

Under GDPR and similar laws, our legal bases for processing are:

• Contract: processing necessary to provide the Service you have requested.
• Legitimate interests: improving the Service, preventing abuse, and running our business, balanced against your rights.
• Consent: where required, such as for marketing communications and non-essential cookies.
• Legal obligation: where processing is required by law.

4.5 Data retained to make features work

Some Simpra features depend on keeping a history of what you have submitted. For example, your answer library stores previously approved questionnaire responses so they can be reused, and audit logs keep a record of changes to controls and evidence. If this content contains personal information, it is kept for as long as the feature needs it to work, or until you delete it or end your subscription. If you have questions about this, please contact us.

5. Your Rights and Preferences

Depending on where you live, you may have rights under GDPR, UK GDPR, PIPEDA, CCPA/CPRA, or similar laws, including the right to:

• Access: ask what personal information we hold about you and receive a copy.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion: ask us to delete your personal information, subject to legal exceptions.
• Portability: receive your information in a structured, machine-readable format.
• Objection and restriction: object to certain processing, or ask us to restrict how we use your information.
• Opt out of marketing: unsubscribe using the link in any marketing email.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Non-discrimination: exercise your rights without receiving worse treatment from us.
• Use an authorized agent: have someone submit a request on your behalf.
• Complain: lodge a complaint with your local data protection authority.

We work to keep the information we hold accurate, complete, and up to date, and may ask you to review or update it from time to time.

5.1 How to make a request

1. Email your request to privacy@simpra.ai.
2. We confirm receipt and, if needed, ask for information to locate the data we hold about you.
3. We verify your identity — for example, with a one-time code sent to the email address on your account — to make sure the request is legitimate.
4. We action your request and let you know the outcome within the timeframe required by applicable law.

If your request relates to data we process on behalf of a customer, we will refer you to that customer, who controls the data, and assist them in responding. Customers can send requests on behalf of their own data subjects and we follow the same process.

California residents. You also have the right to know the categories of personal information we collect, the purposes for which we use it, and the categories of third parties to whom we disclose it. We do not sell or share personal information as those terms are defined under California law.

6. Data Protection

Simpra is built to protect the policies, controls, evidence, and risk data that power your compliance program. We apply privacy by design when making product decisions and keep data collection to what is needed.

6.1 Security measures

• Encryption: data is encrypted at rest using AES-256 (AWS KMS) and in transit using TLS 1.2 or higher.
• Private infrastructure: the platform runs inside a private AWS VPC with controlled network access and no unnecessary public exposure.
• Tenant isolation: each customer's data is logically isolated with tenant-level access controls.
• Least-privilege access: role-based access controls, MFA on all administrative accounts, and quarterly access reviews.
• Audit logging: platform and AI agent activity is logged with user, timestamp, and change history.
• Vulnerability management: automated dependency scanning and regular security testing.
• People: confidentiality obligations and security training for everyone with access to systems.

For more detail, see our Security page.

6.2 Incident management

We maintain incident response procedures for investigating and containing security events. If a personal data breach affects you, we will notify you — and, where we act as a processor, the affected customer — without undue delay and in accordance with applicable law.

6.3 Backups and continuity

Encrypted backups and recovery procedures help protect against data loss and support continuity of the Service.

No method of transmission or storage is completely secure, but we work continuously to protect your information.

7. Data Retention

We keep personal information only for as long as needed for the purposes in this policy, unless a longer period is required or permitted by law.

• Account data: for the duration of your subscription plus a reasonable wind-down period.
• Customer Data: according to your instructions and your subscription terms. After termination, Customer Data is available for export for thirty (30) days and is then deleted.
• Billing and tax records: as required by financial and tax regulations (typically 7 years).
• Logs and security telemetry: for a rolling period long enough for incident investigation and audit, typically 12–24 months.
• Marketing data: until you opt out, after which you are removed from active campaigns.

8. GDPR and International Transfers

The General Data Protection Regulation (GDPR) applies to Simpra when we process personal data of people in the European Economic Area — for example, when our customers' users or data subjects are located there. The same principles also guide how we meet the UK GDPR, Canada's PIPEDA, the California Consumer Privacy Act, and other privacy laws.

8.1 International transfers

Simpra operates primarily from Canada, with infrastructure in the United States and Canada. If you use the Service from outside these regions, your information will be transferred to, stored, and processed in them. Canada benefits from an EU adequacy decision for commercial organizations. For personal data transferred from the UK, EEA, or Switzerland to the United States, we rely on appropriate safeguards such as Standard Contractual Clauses.

8.2 Sub-processors

Every sub-processor that handles personal information on our behalf is bound by a written data processing agreement. See Section 3 for the current list.

8.3 Data Processing Addendum

Our standard DPA, which includes the current Standard Contractual Clauses, is available to customers on request. Email privacy@simpra.ai for a copy.

8.4 Privacy by design

Data protection is built into how we run the business, including:

• privacy governance and internal policies;
• data minimization and purpose limitation;
• physical and logical access controls;
• change management and security review;
• incident management;
• data retention, disposal, and deletion processes; and
• processes and tools to support data subject requests.

9. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential purposes: required for the Service to function (authentication, session management, security).
• Preferences: remembering your settings and choices.
• Analytics and advertising measurement: understanding how our website and Service are used, and measuring the effectiveness of our advertising (for example, through Google tags).

On our marketing website we also use Plausible Analytics to measure visits, time on page, scroll depth, traffic sources, approximate location, and clicks on key links. Plausible does not use cookies or store IP addresses, and it processes this data in the EU.

You can control cookies through your browser settings. Disabling essential cookies will prevent parts of the Service from working. We honor Global Privacy Control (GPC) signals where applicable.

10. Children's Privacy

The Service is a business tool and is not directed to individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Other Privacy Laws and Your Responsibilities

Privacy laws vary by country, and many industries have their own regulatory requirements. Customers remain responsible for meeting the privacy laws and industry rules that apply to them — including having a lawful basis for the data they upload to Simpra. We support customers in our role as a processor, and we ask that you tell us about any specific requirements that apply to your use of the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. For material changes, we will give additional notice — typically by email to account administrators or through a notice in the Service — at least thirty (30) days before the change takes effect.

13. Contact Us

Questions, requests, or concerns about this Privacy Policy? Contact us at:

Simpra, Inc.
Privacy and data requests: privacy@simpra.ai
Security: security@simpra.ai
General: sales@simpra.ai

For EU/UK residents: you also have the right to lodge a complaint with your local data protection authority.

© 2026 Simpra, Inc. This Privacy Policy is effective as of the date shown above and supersedes any prior versions.