Privacy Policy

At a glance

Who we are

SimplyAI ("SimplyAI", "we", "us") provides a self-service AI marketing service at simplyai.one. We are the controller of the personal information about our customers described in this policy. For leads collected on our customers' landing pages, the customer is the controller and we process that information on their behalf (see Your leads' data).

For any question about this policy or your data, email support@simplyai.one.

Information we collect

Information you give us

• Account information: your name, email address and a securely hashed password, plus optional details such as your business name, phone number, country, city and industry.
• Business profile: what you tell us about each business, such as its description, products and prices, audience, locations, opening hours, brand colours, logo, tone of voice, budget and goals, and the claims you allow or forbid in your marketing.
• Files you upload, such as logos and images.
• Messages to support, by email or in the AI support chat.

Information from your website

When you give us your website, we fetch a few of its public pages (for example the home, about, services, pricing and contact pages), your logo and a brand image to build your business profile and brand kit. We keep a snapshot of what we read so you can review and edit it. If you give a social media handle, we don't fetch it; we only pass the handle to the AI as text.

Content you create

Growth plans, ad copy, images, videos, landing pages, email sequences and content calendar posts, including earlier versions and your approvals.

Leads from your landing pages

When someone fills in a form on a landing page you publish with SimplyAI, we store what they submit (for example name, email, phone and message), the campaign or link they came from, whether they agreed to receive emails (with the exact consent wording and the time), and a one-way hash of their IP address used to prevent spam and abuse. We also count page views and button clicks on your landing pages without cookies and without identifying visitors.

Information from accounts you connect (only if you connect them)

If you connect Facebook & Instagram, we receive the data allowed by the permissions you grant (listed below), including the names and IDs of your ad accounts, Pages, Instagram accounts and pixels, the status of your ad account, and performance data for campaigns we manage for you. We store the access token Meta gives us in encrypted form.

If you connect Google Ads, YouTube, Microsoft Advertising, TikTok or Telegram, we receive the equivalent information from that platform: the identifiers and names of the ad accounts, channels, advertiser accounts or chats you choose, their status and currency, and the performance of the campaigns and posts SimplyAI created for you. Access tokens are stored encrypted. The section Google user data explains the Google and YouTube connection in detail.

Payment information

We keep your plan, payment status, amounts, currency and the payment provider's references. Card and bank details are entered on the payment provider's own checkout and never reach SimplyAI.

Usage, technical and security information

• A history of important actions in your account, for example approvals, publishing, pauses, budget changes, plan changes and staff access.
• Records of background jobs (such as image or video generation) and any errors.
• AI usage records: which provider and model was used, how much, and the cost. These records do not contain the content of your requests.
• Technical logs from our servers, which can include IP addresses, browser details and the pages requested.

Facebook and Instagram permissions

We only request the permissions needed for features you choose to use, and we only act on the assets you select.

• ads_management, ads_read: to create, pause and edit the campaigns you approve in your own ad account, and read their results (spend, impressions, clicks and conversions reported by Meta).
• business_management: to list the ad accounts, Pages and pixels your Meta login can use, so you can choose which ones SimplyAI works with.
• pages_show_list, pages_read_engagement: to show your Facebook Pages so you can pick the one your ads run from.
• pages_manage_ads: to run ads on behalf of the Page you selected.
• pages_manage_posts: to publish organic posts you have approved in your content calendar.
• instagram_basic, instagram_content_publish: to identify the Instagram account linked to your Page and publish posts you have approved.

We do not use data from Meta to build advertising profiles of people, and we do not share it with other advertisers.

Google user data (Google Ads and YouTube)

SimplyAI lets you connect your own Google account so it can run Google Search campaigns in your Google Ads account and upload YouTube Shorts to your channel. Both connections use Google sign-in (OAuth). You choose whether to connect, which account or channel SimplyAI works with, and you can disconnect at any time.

What we access, and why

• Google Ads (scope adwords): the list of Google Ads accounts your login can use (so you can choose one), that account's status, currency and time zone, and the ability to create, pause, resume and change the budget of the campaigns you approve in SimplyAI, and to read their results (impressions, clicks, spend and conversions). Campaigns are created paused and only switched on when you say so.
• YouTube (scopes youtube.upload and youtube.readonly): your channel's identifier, name, handle, picture and subscriber count (so you can see which channel is connected), the ability to upload the Shorts you approved in your content calendar to that channel, and the view, like and comment counts of the videos SimplyAI uploaded. SimplyAI never edits, deletes or comments on videos, and never reads your private videos, watch history or subscriptions.
• Basic profile: Google sends your account's unique identifier with the sign-in. We use it only to tell your connection apart from other users' connections.

How we use and store it

• Google user data is used only to provide the features you asked for above and to show you their results inside SimplyAI. We do not use it for advertising profiles, market research, building datasets, or training AI models, and we never show it to anyone outside your business.
• Access and refresh tokens are encrypted at rest (AES-256-GCM) on our servers in Frankfurt, Germany, and are used only by our servers; they are never sent to your browser or to third parties.
• Campaign and video identifiers and performance numbers are stored with your account so your Results page can show them. They are not merged with data from other customers.

Who can see it

Only you, the members you invited to your business in SimplyAI, and SimplyAI staff when you ask for support (each access is logged). We do not sell Google user data, do not share it with other companies for their own purposes, and do not transfer it to anyone except as needed to run SimplyAI (our hosting provider, Render) or as required by law. Google user data is never sent to our AI providers.

How to disconnect and delete

In SimplyAI, open Settings → Integrations and choose Disconnect under Google Ads or YouTube: we revoke the token with Google and delete it immediately, and pause the campaigns we were managing. You can also remove SimplyAI at myaccount.google.com/permissions; the next time our stored token stops working we mark the connection as revoked and delete it. To delete the campaign, channel and performance data we kept, email support@simplyai.one or delete your account; we delete it within 30 days.

Microsoft Advertising, TikTok, Telegram and marketplaces

The same rules apply to the other accounts you can connect. Microsoft Advertising: we read the accounts your login can use, create the Search campaigns you approve (paused), control them within your limits and read their results. TikTok for Business: we read your advertiser accounts and identities, create the video ads you approve (paused), read their results and, where TikTok has approved it, post approved videos to your TikTok account. Telegram: you add SimplyAI's bot to a channel or group; we post the content you approve there and read the member count and reactions. Tokens are encrypted, nothing is posted or spent without your approval, and disconnecting deletes the token at once.

Marketplace seller accounts (eBay, Amazon, TikTok Shop): we read your seller account name, the marketplaces or shops it sells on, your business policies and inventory locations (eBay); we create or update the product listings you approve; and we read your orders only to store daily totals per marketplace and currency (number of orders, items and sales value). We never store buyers' names, addresses, emails or phone numbers. If eBay tells us a seller has closed their eBay account, we delete that connection. Product feeds: a feed link you create gives Google Merchant Center or Meta your active products (title, description, price, stock, pictures, product page link) — no personal information — and stops working when you turn it off or make a new link.

How we use information and our legal bases

We use personal information only for the purposes below. Where the EU or UK GDPR applies, the table shows the legal basis we rely on.

We don't use your content to train AI models, and we don't send your leads' personal details to AI providers.

How AI is used

SimplyAI uses AI models from the providers listed in Service providers to write, design and produce your marketing. To do that, we send them the information each task needs: for example your business profile and website text for a growth plan, brand colours and your logo for an image, or the voiceover script for a video. Images used as a starting point for videos are shared through temporary links that expire within two days.

The providers process this information to deliver their service to us. Everything they produce is shown to you to review, edit and approve before it is published or used.

AI support chat

SimplyAI offers an AI support chat on our website and in the app. What you type, together with the recent conversation, is sent to our AI provider, Anthropic (or xAI if Anthropic is unavailable), so it can write a reply. If you are logged in, we also tell the AI your plan and current credit balance so it can answer accurately.

We don't store chat transcripts in our database and we don't write message contents to our logs. We keep only usage and cost records (without the messages), rate-limit counters, and our standard server logs, which are deleted on a rolling basis. Your browser keeps the conversation in session storage so it survives moving between pages; it is cleared when you close the tab.

Please don't enter passwords, card numbers or sensitive personal information (such as health details) in the chat. For anything about your account, billing or data, email support@simplyai.one so a person can help.

When SimplyAI staff look at your account

To provide support, resolve complaints, check payments or investigate a problem, authorised SimplyAI staff (currently the owner's administrator account) can view your account, payments, generated images and videos, landing pages and job history, and can correct your plan or add credits. Every time staff open a customer's account, the access is recorded in an audit log. Staff access is limited to what is needed for these purposes.

Who we share information with

We do not sell your data or your leads' data, and we do not share it for cross-context behavioural advertising. We share information only:

• with the service providers listed below, under contracts that limit their use of it to providing their service to us;
• with Meta, Google, YouTube, Microsoft Advertising, TikTok, Telegram, eBay, Amazon or TikTok Shop, when you connect that account and ask us to publish or manage campaigns, posts or listings there, and with Google or Meta when you give them your product feed link;
• if the law requires it, or to protect the rights, property and safety of our customers, the public or SimplyAI;
• with a buyer or successor if SimplyAI is reorganised, merged or sold, in which case this policy continues to protect your information.

Export files: if you prefer not to connect an account, SimplyAI can create a file that you download and import into Google Ads Editor or Meta Ads Manager yourself. Nothing is sent to the platform in that case.

Service providers (sub-processors)

These companies process personal information for us. We update this list when it changes.

Your leads' data

For leads captured on your landing pages, you (the business) are the controller and SimplyAI is your processor. We store and use that information only to provide the service to you: to show leads in your account, notify you of new leads and send the follow-up emails you approve.

• Follow-up emails go only to leads who ticked the consent box, and every email includes an unsubscribe link. We keep a suppression list so people who unsubscribe are not emailed again.
• You can view, update and export your leads in your account, and ask us to delete them.
• You are responsible for having a lawful basis to contact your leads and for answering their privacy requests. If a lead contacts us, we will pass the request to you or help you deal with it.

If you were a lead and want your details removed, use the unsubscribe link in any email you received, contact the business directly, or email support@simplyai.one and we will help.

International transfers

Our servers and database are in the European Union (Frankfurt, Germany). Some of our service providers, including our AI, email and payment providers, process information in the United States and other countries. When personal information from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum where needed), or on the provider's certification under the EU-U.S. Data Privacy Framework where available. You can ask us for more information about these safeguards.

How long we keep information

How we protect information

• All connections to SimplyAI are encrypted in transit (HTTPS).
• Passwords are stored only as salted hashes (bcrypt), never in plain text.
• Access tokens for connected accounts (Meta, Google, YouTube, Microsoft, TikTok) are encrypted at rest with AES-256-GCM and are only ever used by our servers.
• Each business's data is kept separate, and every request is checked against the businesses you belong to.
• Uploaded and generated files are private to your business. They are shared outside your account only through signed links that expire, or when you publish them (for example on a landing page or in an ad).
• Payments and webhooks from payment and email providers are verified by signature before we act on them.
• Staff access is restricted to the owner's administrator account and is logged. Important actions in your account are recorded in an audit log.
• Login, sign-up, checkout and form submissions are rate-limited to slow down abuse.

No system is perfectly secure, so please use a strong, unique password. If we become aware of a security breach that affects your personal information, we will notify you and the relevant authorities as the law requires.

Cookies and browser storage

SimplyAI uses only what it needs to work. We do not use advertising or analytics cookies on simplyai.one, and we host our own fonts, so your browser doesn't contact a font service when you visit.

Landing pages that customers publish with SimplyAI count page views and button clicks on our own servers without cookies. Because these cookies are strictly necessary, we don't ask for consent to them. You can block cookies in your browser, but you won't be able to log in.

Your privacy rights

Everyone

Whatever the law where you live, you can ask us for a copy of your data, to correct it, or to delete your account. You can also edit your business profile in Settings, export your leads, download your creatives and disconnect any connected account (Meta, Google Ads, YouTube, Microsoft Ads, TikTok, Telegram) yourself at any time.

EEA, UK and Switzerland (GDPR and UK GDPR)

You have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected (rectification);
• have your information erased;
• restrict how we use it;
• receive it in a portable format and have it sent to another provider;
• object to processing based on our legitimate interests;
• withdraw consent at any time, where we rely on consent (this doesn't affect what we did before);
• complain to a data protection supervisory authority, for example in the country where you live or work. In the UK this is the Information Commissioner's Office (ICO).

California and other US states (including CCPA/CPRA)

In the last 12 months we collected these categories of personal information: identifiers (such as name, email address and IP address), commercial information (plans and purchases), internet activity (logs and in-app actions), professional information (your business details) and, for leads, the contact details they submit. We use them only for the purposes in this policy.

• You have the right to know what we collect, use and disclose, to delete it and to correct it.
• We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about you.
• We will not discriminate against you for using your rights.
• You can use an authorised agent. We may ask the agent for proof of your permission.

How to make a request

Email support@simplyai.one from the email address on your account. We may ask you to confirm your identity before we act. We respond within 30 days, and within any shorter period the law sets. Requests are free unless they are clearly unfounded or excessive.

Automated decision-making

SimplyAI's AI makes suggestions: plans, copy, images, videos, landing pages and forecasts, which you review and approve. If you choose the Assisted or Autopilot control mode, SimplyAI can also pause weaker ads and adjust daily budgets automatically, always within the limits you set, and it tells you what it changed and why. These are decisions about your ads, not about people. SimplyAI does not make decisions about individuals that have legal or similarly significant effects on them.

Children

SimplyAI is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, email support@simplyai.one and we will delete it.

Deleting your data

You can disconnect any connected account (Meta, Google Ads, YouTube, Microsoft Ads, TikTok, Telegram) at any time in Settings → Integrations; the stored token is deleted immediately. To delete your account and data, email support@simplyai.one from the email address on your account. You can also remove SimplyAI from your Facebook settings, which sends us a deletion request for your Meta data automatically. See Data deletion instructions for the steps.

Changes to this policy

We may update this policy as SimplyAI changes. The date at the top shows when it last changed. If we make material changes, we will tell account holders by email or in the app before they take effect.

Contact

Questions, requests or complaints about privacy: support@simplyai.one. If you are not satisfied with our answer, you can contact your local data protection authority.