Privacy Policy

Last edited on: 15-10-2026

1. About this policy

SimplyAi B.V. provides SimplyOS and this website. We are at Gildekamp 21, 5431 SP Cuijk, the Netherlands (KvK 89521811). Contact [email protected] about privacy.

We are the controller for our website, enquiries, commercial relationships, billing and marketing. For customer recruitment records, communications and workspace logs, we act as processor on the customer’s instructions under the Data Processing Agreement (DPA). The recruiting organisation’s notice explains its purposes, legal grounds and retention. Contact it about its records; we help route requests and assist it. Separate information covers Simply’s own employment and recruitment.

2. Information we collect and why

For our own activities, we collect contact and company details, demo and booking information, correspondence, account-administration and billing records. Website visits generate IP addresses, device information, logs and, with consent, identifiers and interaction data. Information comes from you, your device, your organisation or referrals. For indirect collection, we explain the source by first contact or disclosure, or otherwise within one month where required.

Where you personally request or enter a contract, necessary pre-contract and service administration rely on contractual necessity instead. We assess legitimate interests against your rights. Required fields are needed to handle the request; without them we may be unable to do so. Optional tracking is not required to browse or request a demo. Using Simply is not blanket consent.

3. Customer data and AI

We process CVs, professional and contact details, applications, assessments, documents, communications, recordings and generated results for customer-configured transcription, search, drafting, matching and automation. Sources include customers, candidates, imports, connected accounts and external enrichment providers.

Matching uses customer-selected criteria such as skills, experience and qualifications; scores can affect who recruiters review. Customers can inspect and override results and must provide required human review and decision information. Simply does not make hiring decisions for customers or solely automated decisions with legal or similarly significant effects for its own business activities.

We and our subprocessors do not use customer data to train or fine-tune AI models, or use it for advertising. We do not sell it or build a shared candidate database.

4. Connected accounts and Google user data

With your permission, connections such as Google and Microsoft provide identity, contacts, email, attachments, calendars and access tokens for enabled synchronisation, communication, scheduling and AI features. Connection screens explain access and uses. Authorised workspace users and necessary service providers receive data subject to these restrictions.

Simply’s use and transfer of Google API data comply with the Google API Services User Data Policy, including Limited Use, and the Google Workspace policy. This includes derived data: no advertising, sale, credit assessment or AI training. Staff reading requires the relevant Google user’s affirmative agreement to the specific content, unless a Google-policy exception applies. General support authorisation is insufficient; business-sale transfers require explicit prior user consent. These restrictions prevail over general sharing permissions.

Who receives Google user data. We share, transfer or disclose Google user data only with the recipients below, and only to provide the features you enabled:

• Authorised users of your organisation’s Simply workspace, within its permissions.
• Worldstream B.V. (Netherlands), our hosting provider, which stores the databases and backups that hold it.
• Microsoft Ireland Operations Limited, through Azure OpenAI in EU regions, for Simply-managed AI features such as summarising, drafting and classifying emails and calendar items. It receives only the content a request needs and does not use it to train models.
• The AI provider your organisation connects with its own API key, if it chooses one instead of Simply-managed AI. That provider processes the data under your organisation’s own contract. Simply supports only the OpenAI, Anthropic and Azure OpenAI API services, whose business terms exclude training on API data.
• Authorities, advisers or a business successor, only where the law requires it or to protect legal rights; a business-sale transfer requires your explicit prior consent.

We do not sell Google user data or share it with advertisers, data brokers or other third parties.

Google user data and AI. We do not use Google user data, including raw, aggregated, anonymised or derived data, to create, train or improve generalised or foundational AI or machine-learning models, and we do not transfer it to any service that would. Search, matching and message labelling use models we run ourselves, self-hosted on our infrastructure in the Netherlands: Google user data they process stays there, is never sent to the models’ original developers and is not used to train them. AI outputs derived from Google user data, such as summaries, follow the same restrictions.

Disconnect in Simply or revoke permissions through your Google or Microsoft account. This stops future access. Contact the customer or us about deleting retained copies, which follow lawful customer instructions, the DPA and any stricter provider requirements.

5. Cookies and marketing

Necessary storage supports functions such as security and language preferences. With your prior consent, we use Google Tag Manager to manage tags, Google Analytics for usage measurement, Meta Pixel and LinkedIn Insight Tag for conversions and retargeting, Factors.ai for company identification and attribution, and Contentsquare for experience analysis and session visualisations. These involve technical identifiers and activity data; company-level reporting does not make collection anonymous. Form inputs and sensitive content are excluded or masked. Customer workspace content and submitted contact details are not used for these tools.

Cookie settings identifies technologies, providers, purposes and durations and lets you reject optional tracking or withdraw consent. Embedded booking and video services may also receive technical data; their optional tracking requires consent.

For relevant Pixel collection and transmission, Simply and Meta share responsibilities under the Meta Controller Addendum: Simply handles its implementation, notice and consent; Meta handles its processing and associated safeguards. Rights may be exercised against either. Meta’s further uses and LinkedIn’s independent-controller processing follow their Meta and LinkedIn notices.

You can stop direct marketing and related profiling at any time, using unsubscribe, Cookie settings or our email address. A demo request does not subscribe you to promotions. Essential service messages may continue.

6. Who receives information

Access is limited to authorised staff and suppliers supporting hosting, security, communications, support, billing and the website. Our demo form uses Formspark; bookings use TidyCal. Other website providers appear in section 5. Processors act under processing agreements; providers acting independently have their own notices. Customer-data subprocessors appear in the DPA’s register.

Necessary, protected disclosures to advisers, authorities or business successors require legal justification. Customer-selected integrations follow their own terms. Customer-data restrictions and the Google user data limits in section 4 still apply.

7. Where data is processed

The platform, primary databases and stored customer files are hosted in the Netherlands. Simply-managed AI, backups, support and logs containing customer data remain in the EU. Customer-selected integrations or AI provider keys can direct specified data elsewhere, subject to lawful transfer safeguards.

Website and business providers have a separate processing chain, including US processing by TidyCal and Factors.ai and international processing by analytics and advertising providers. Transfers outside the EEA use applicable adequacy decisions or appropriate safeguards, normally EU standard contractual clauses with necessary assessments and supplementary measures. Ask us for destination details and copies of the relevant safeguards.

8. Retention and security

For information we control, our usual maximum periods are:

• Enquiries and unsuccessful demos: 12 months after substantive contact; ordinary account administration: the relationship plus 12 months; administrative support correspondence: 24 months after closure.
• Routine website security logs: 90 days; identifiable analytics events: 14 months; session visualisations: 30 days; company-identification and attribution records: 12 months; retargeting audience membership: 90 days after the last qualifying event.
• Marketing contacts: until withdrawal or objection, with an inactivity review after 24 months. We keep minimal suppression records to honour objections.
• Required tax records: normally seven years. Necessary consent, contract and claim evidence: the applicable limitation period and ongoing proceedings, subject to periodic necessity review.

We delete earlier when no longer needed or legally required. Specific records may be kept longer for a legal duty, an identified incident or a live dispute. These limits include our processors’ copies; independent providers explain their separate retention. Customer records follow customer instructions and the DPA’s deletion, backup and exit provisions.

Our service’s ISO 27001-certified information-security management system includes encryption, access controls, confidentiality, monitoring and incident response. See our Security page.

9. Your rights and policy updates

Under the GDPR, you may request access, correction, deletion, restriction and, where applicable, portability. You may object to legitimate-interest processing based on your circumstances; we stop unless a GDPR exception applies. Direct-marketing objections are unconditional. You may withdraw consent without affecting earlier lawful processing and exercise applicable rights concerning significant automated decisions, including human intervention and contesting a decision.

Email [email protected]. Requests are normally free; we may proportionately verify identity. We respond within one month, explaining any justified extension of up to two further months within that first month. You may complain directly to the Autoriteit Persoonsgegevens or another competent supervisory authority and seek a judicial remedy.

We date updates and notify material changes as required. New purposes are explained before use, with fresh consent where needed. Updates do not reduce existing contractual data-protection commitments.