Privacy Policy

Interpretation

Under the following conditions, the meanings of words with capitalized first letters are defined. The following definitions have the same meaning whether they are written in singular or plural form.

Definitions

For the purposes of this Privacy Policy:

• Application means the Sim web or mobile application or related services.
• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
• Business, for the purpose of the California Consumer Privacy Act ("CCPA"), refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of processing that information, or on behalf of which that information is collected, and that does business in California.
• Company (referred to as "the Company", "We", "Us", or "Our") refers to Sim Studio, Inc. For the purpose of the GDPR, the Company is the Data Controller when it determines the purposes and means of processing Personal Data.
• Cookies are small files placed on Your computer, mobile device, or other device by a website, containing details of Your browsing history among their uses.
• Country refers to the United States, specifically California. Sim Studio, Inc. is a Delaware corporation with its principal place of business at 80 Langton Street, San Francisco, CA 94103, USA.
• Data Controller, for the purposes of the GDPR, refers to the person that alone or jointly with others determines the purposes and means of processing Personal Data.
• Device means any device that can access the Service, such as a computer, cellphone, or digital tablet.
• Do Not Track (DNT) is a concept promoted by U.S. regulatory authorities for mechanisms that allow internet users to control tracking of their online activities across websites.
• Personal Data or Personal Information means information relating to an identified or identifiable individual. Under the GDPR, this includes information such as a name, identification number, location data, online identifier, or factors specific to a person's physical, physiological, genetic, mental, economic, cultural, or social identity. Under the CCPA, it includes information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.
• Google Data means any data, content, or metadata obtained via Google APIs, including Google Workspace APIs.
• Generalized AI/ML Model means an AI or machine-learning model intended to be broadly trained across multiple users and not specific to a single user's data or behavior.
• User-facing Features means features directly visible or used by the individual user through the application interface.
• Sale, for the purpose of the CCPA, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a Consumer's Personal Information to another business or third party for monetary or other valuable consideration.
• Service Provider means a natural or legal person that processes data on behalf of the Company, including third parties engaged to facilitate, provide, support, or analyze the Service. For the purpose of the GDPR, Service Providers are Data Processors.
• Third-party Social Media Service means a website or social network through which a User can log in to or create an Account for the Service.
• Usage Data means data collected automatically, either generated through use of the Service or from the Service infrastructure itself.
• Website refers to Sim, accessible from sim.ai.
• You means the individual accessing or using the Service, or the company or other legal entity on whose behalf that individual accesses or uses the Service. Under the GDPR, You may be the Data Subject or User.

Personal Data You Provide

When you sign up, link accounts, or use features, you may provide Personal Data such as:

• Name and email address
• Phone number and mailing address
• Profile picture, settings, and preferences
• Content you upload, including documents and files
• Data you explicitly input or connect, including through Google integrations

Google Data via API Scopes

If you choose to connect your Google account, including Google Workspace, Gmail, Drive, Calendar, or Contacts, we may request specific scopes. Google Data we may access includes:

• Basic profile information, including name and email address
• Drive files
• Calendar events
• Contacts
• Gmail messages, only when explicitly requested for a specific feature
• Other Google Workspace content or metadata needed for an enabled feature

We request only the minimum scopes necessary for the features you enable. We do not request scopes for unimplemented features.

Usage Data

We may collect information about how the Service is accessed and used. Usage Data may include your Internet Protocol address, browser type, browser version, pages visited, date and time of a visit, time spent on pages, unique Device identifiers, and other diagnostic data.

When You access the Service through a mobile Device, we may collect the Device type, unique Device identifier, Device Internet Protocol address, mobile operating system, mobile browser type, and other diagnostic data. We may also collect information that Your browser sends when You visit or access the Service.

Tracking and Cookies Data

We use Cookies and similar tracking technologies, including beacons, tags, scripts, local storage, and pixels, to track activity and hold certain information. Where consent is required, non-essential Cookies are disabled until You make a choice through the cookie banner. Necessary Cookies remain enabled because the Service cannot operate without them. You may accept, reject, or customize non-essential Cookie categories and may later change or withdraw that choice.

The Cookie Policy lists the Cookies set by Sim and its providers, their purposes, lifetimes, providers, and the methods for changing or withdrawing a choice.

Where the GDPR applies, Sim relies on the legal bases in Article 6(1) as follows:

For processing based on legitimate interests, Sim performs a balancing assessment that considers the interest pursued, the necessity of the processing, and the rights and reasonable expectations of the affected individuals. You may object to that processing under Article 21 of the GDPR as described in section 14.

Sim does not rely on public interest under Article 6(1)(e) or vital interests under Article 6(1)(d) for any current processing. Sim does not process special-category data under Article 9 as part of providing the Service.

Where Sim processes customer content on behalf of a customer, Sim acts as a processor, the customer is the controller, and the customer determines the applicable legal basis. That processing is governed by the Data Processing Addendum and the customer's documented instructions.

We use collected data for the following purposes:

• To provide and maintain the Service
• To notify You about changes to the Service
• To allow You to participate in interactive features when You choose to do so
• To provide customer care and support
• To provide analysis or information that helps us improve the Service
• To monitor use of the Service
• To detect, prevent, and address technical issues
• To manage Your Account
• To perform our contract with You
• To contact You by email, telephone, SMS, or equivalent electronic communications
• To enable and support user-enabled integrations with Google services, including file or calendar synchronization, personalization, suggestions, and user-specific automation
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations

Any Google Data used within Sim is used only for features tied to that specific user and is not used for generalized AI/ML training or shared model improvement across users.

Your information, including Personal Data, may be transferred to and maintained on computers outside Your state, province, country, or other governmental jurisdiction, where data protection laws may differ. If You are outside the United States and provide information to us, we transfer the data to the United States and process it there. Sim's primary hosting region is AWS us-east-1 in the United States. The current Service Provider list is maintained on the Sub-processors page.

Providing Personal Data does not by itself constitute consent to an international transfer. Where Sim relies on consent, that consent will be freely given, specific, informed, unambiguous, obtained separately through a positive action, and recorded.

International transfers from the European Economic Area or United Kingdom are made using applicable transfer safeguards, including:

• The European Commission's Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 and, for transfers from the United Kingdom, the UK International Data Transfer Addendum
• Data Processing Addenda with each sub-processor that incorporate the applicable transfer clauses
• Transfer impact assessments where required
• Technical and organizational measures described in section 5, including encryption in transit and at rest, access controls, and logging

A copy of the applicable transfer clauses is available on request at privacy@sim.ai.

Business Transactions

If the Company is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

The Company may be required to disclose Your Personal Data if required by law or in response to valid requests by public authorities, including a court or government agency.

Legal Requirements

Sim may disclose Your Personal Data in the good-faith belief that the action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Sim
• Prevent or investigate possible wrongdoing connected with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

The security of Your data is important to us, but no method of transmission over the Internet or method of electronic storage is completely secure. We use technical and organizational measures designed to protect Personal Data, including encryption in transit and at rest, access controls, role-based permissions, logging, and auditing. While we use commercially acceptable measures to protect Personal Data, we cannot guarantee absolute security.

We engage third-party companies and individuals to facilitate the Service, provide the Service on our behalf, perform Service-related services, or assist us in analyzing how the Service is used. These Service Providers may access Personal Data only to perform assigned tasks on our behalf and may not disclose or use it for another purpose.

The legal basis for disclosing Personal Data to Service Providers depends on the service involved:

• Contractual necessity — Article 6(1)(b): providers required to deliver the Service, integrations, billing, or other features requested by You
• Legitimate interests — Article 6(1)(f): providers used for security, hosting, monitoring, and support tooling, where Sim's interests are to operate, protect, maintain, and support the Service
• Consent — Article 6(1)(a): analytics and advertising providers activated through non-essential Cookies or similar technologies

Every Service Provider that processes Personal Data on Sim's behalf is engaged under a written data processing agreement that imposes confidentiality, purpose limitation, security, and sub-processor controls. Each provider is security-reviewed before onboarding and periodically thereafter and acts only on Sim's documented instructions. The current provider list is maintained on the Sub-processors page.

We may aggregate or anonymize non-Google data that is not tied to personal identity for internal analytics, product improvement, usage trends, or performance monitoring. This data cannot be tied back to individual users and is not used for generalized AI/ML training with Google Data.

The Company uses Google Ads, Twitter, and Facebook remarketing services to advertise on third-party websites after You visit the Service. These services operate through non-essential Cookies and similar technologies. They are activated only after You give consent to the Marketing category in the cookie banner. No marketing Cookie is set before that consent.

You may change or withdraw consent at any time through the cookie preferences link. If Your browser or extension sends a Global Privacy Control signal, we treat it as a withdrawal of consent for analytics and marketing Cookies. The Cookie Policy explains the technologies, providers, purposes, lifetimes, and available controls.

Provider-level controls remain available as an additional route:

• Google Ads: Google Ads Settings
• Twitter: Personalization and data settings
• Facebook: Ad preferences

We may provide paid products or services within the Service and may use third-party payment processors. We do not store or collect Your payment card details. Those details are provided directly to the payment processor, whose use of Personal Data is governed by its privacy policy. Payment processors adhere to the PCI Data Security Standard managed by the PCI Security Standards Council. The payment processor we use is Stripe.

Affirmative Statement and Compliance

Sim's use, storage, processing, and transfer of Google Data, whether raw or derived, strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API user data policy where applicable. We affirm that:

• Sim does not use, transfer, or allow Google Data to be used to train, improve, or develop generalized or non-personalized AI/ML models.
• Processing of Google Data is limited to providing or improving user-facing features visible in the application interface.
• We do not allow third parties to access Google Data for training or model improvement.
• Transfers of Google Data are disallowed except in the limited permitted cases described below.

Permitted Transfers and Data Use

We may transfer Google Data, whether raw or derived, to third parties only under the following limited conditions and in line with user disclosures and consent:

• To provide or improve user-facing features, with the user's explicit consent
• For security, abuse investigation, or system integrity
• To comply with laws or legal obligations
• As part of a merger, acquisition, divestiture, or sale of assets, with explicit user consent

Human Access Restrictions

No employee, contractor, or agent may view Google Data unless one of the following applies:

• The user gave explicit, documented consent to view specific items, such as allowing customer support to view a particular email or file.
• Access is necessary for security, abuse investigation, or legal process.
• The data is aggregated and anonymized and used for internal operations only, without re-identification.

Scope Minimization and Justification

We request only scopes essential to features You choose to enable. We do not request broad or unused permissions. For each Google API scope requested, we maintain internal documentation explaining why the scope is needed and why a narrower scope is insufficient. Where possible, we use incremental authorization and request additional scopes only when needed in context.

Secure Handling and Storage

• Google Data is encrypted in transit using TLS/HTTPS and at rest.
• Access controls, role-based permissions, logging, and auditing protect Google Data.
• OAuth tokens and credentials are stored securely using encrypted vault or secure key-management controls.
• We regularly review security practices and infrastructure.
• If a security incident affects Google Data, we notify Google as required and cooperate fully.

Retention and Deletion

We retain data only as long as necessary for the disclosed purposes:

When You revoke access, delete Your Account, or stop using a feature, we remove associated data within the timeframes above. You may request deletion through in-app settings or by contacting us.

Sim is a platform for building and running AI agents. AI models process the prompts, files, records, integration data, and other content that users choose to send through their workflows.

Model providers are engaged as sub-processors under Data Processing Addenda and are identified on the Sub-processors page. Customer content sent to a model provider is not used by Sim or by that provider to train or improve generalized or shared models. This commitment applies to customer content generally and restates the Google Data Limited Use commitment in section 10 for Google Data.

Users choose which models and providers their workflows call. Users may also bring their own provider credentials. When a user supplies provider credentials, the selected provider's processing remains subject to the user's arrangement with that provider as well as the workflow configuration chosen by the user.

AI outputs are probabilistic and may be incomplete, inaccurate, or unsuitable for a particular purpose. Users should review outputs and should not rely on them as the sole basis for a decision that produces legal or similarly significant effects on an individual.

Sim does not carry out automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Article 22 of the GDPR. If that changes, we will update this Privacy Policy and provide the safeguards required by Article 22, including information about the logic involved and the right to obtain human intervention, express a point of view, and contest the decision where applicable.

Prompts and outputs are retained according to the data category and context in which they are processed. Account and workflow content follows the Account Data period in the retention table in section 10; Google Data, Usage Logs, and Transaction Records follow their respective periods in that table. Questions about AI processing may be sent to privacy@sim.ai.

Our Service may contain links to sites not operated by us. If You follow a third-party link, You will be directed to that third party's site. We recommend reviewing the privacy policy of each site You visit. We do not control and are not responsible for the content, privacy policies, or practices of third-party sites or services.

The Service is not directed at anyone under the age of 18, and Sim does not knowingly collect or process children's Personal Data. If children's Personal Data has been collected inadvertently without appropriate parental consent, Sim will take the necessary steps to erase it from its records. Anyone who believes that Sim has collected children's Personal Data should contact privacy@sim.ai so the matter can be addressed promptly.

We may update this Privacy Policy from time to time. We will notify You by posting the revised Privacy Policy on this page and updating the "Last updated" date. For a material change, we will provide notice by email or a prominent notice on the Service before the change becomes effective. Changes take effect when posted unless the notice states otherwise.

If You are in the European Economic Area, You have the following data protection rights:

• Access: the right to obtain confirmation of whether we process Your Personal Data and to receive a copy of that data.
• Rectification: the right to correct inaccurate Personal Data and complete incomplete Personal Data.
• Erasure: the right to request deletion of Your Personal Data where the applicable conditions are met.
• Objection: the right to object to processing based on legitimate interests and to object at any time to processing for direct marketing.
• Restriction: the right to request restriction of processing where the applicable conditions are met.
• Data portability: the right to receive Personal Data You provided in a structured, commonly used, machine-readable format and to transmit it to another controller where applicable.
• Withdrawal of consent: the right to withdraw consent at any time where Sim relies on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

You may submit a request at privacy@sim.ai, through in-app Account settings for access and deletion, or by using the postal address in section 17.

We respond without undue delay and within one month after receiving a request. That period may be extended by up to two further months where necessary because of the complexity or number of requests. If an extension is required, we will tell You within the first month and explain the reason.

Requests are handled free of charge. Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee based on the administrative cost or refuse to act. If we refuse or charge a fee, we will give reasons and explain the available complaint and judicial-remedy rights.

We may request information needed to verify Your identity before acting on a request. Information collected for verification will be used only for that purpose.

You have the right to lodge a complaint with the supervisory authority in the Member State of Your residence, place of work, or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

The same rights are extended to data subjects in the United Kingdom under the UK GDPR.

If You are a California resident, You have rights under the CCPA and California Privacy Rights Act, including the right to know what Personal Information we collect, the right to delete Personal Information, and the right to opt out of the sale or sharing of Personal Information.

Do Not Sell or Share My Personal Information

We do not sell Personal Information for monetary consideration. Some analytics or advertising disclosures may be considered a "sale" or "share" under California law. You may opt out by contacting privacy@sim.ai or by using the cookie preferences link.

Global Privacy Control

We recognize and honor Global Privacy Control signals. When Your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of the sale or sharing of Personal Information.

California Civil Code section 1798.83 permits California residents to request information about categories of Personal Information disclosed to third parties for direct-marketing purposes during the preceding calendar year. Requests under the CCPA, California Privacy Rights Act, or Shine the Light law may be submitted using the contact information in section 17.

Sim is dedicated to preserving data security by preventing unauthorized disclosure of information. This section provides security researchers with instructions for conducting vulnerability discovery and reporting identified vulnerabilities.

Guidelines

• Notify us as soon as possible after discovering a real or potential security issue.
• Give us a reasonable amount of time to resolve the issue before public disclosure.
• Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Use exploits only to the extent necessary to confirm that a vulnerability exists. Do not use an exploit to compromise or obtain data, establish command-line access or persistence, or pivot to other systems.
• If You encounter sensitive data, including Personal Data, financial information, proprietary information, or trade secrets, stop testing, notify us immediately, and keep the data confidential.
• Do not submit a high volume of low-quality reports.

Authorization

Security research performed in conformity with this policy is considered permissible. We will work with You to understand and correct the issue, and Sim will not suggest or pursue legal action in connection with conforming research.

Scope

This policy applies to the following systems and services:

• sim.ai website
• Sim web application
• Sim API services

A service not expressly listed above, including related third-party services, is out of scope and may not be tested. Vulnerabilities in third-party products used by Sim are not covered and should be reported to the relevant provider under its disclosure policy. If You are unsure whether a system or endpoint is in scope, contact security@sim.ai before testing.

Unauthorized Testing

The following testing is not authorized:

• Network denial-of-service or distributed denial-of-service testing
• Physical testing, including office access, open doors, or tailgating
• Social engineering, including phishing or vishing
• Other non-technical vulnerability testing

Reporting

Send vulnerability reports to security@sim.ai. We will acknowledge a report by the next business day. Reports may be submitted anonymously.

A report should include, where possible:

• A description of the vulnerability
• The location where it was discovered
• Its potential impact
• Steps to reproduce it, including scripts and screenshots if available

Reports should be provided in English where possible. If You provide contact information, we will communicate in a transparent and timely manner. We will acknowledge receipt within three business days and will keep You informed about validation and remediation to the extent possible.

Questions, requests, or complaints about this Privacy Policy or our data practices may be submitted to:

• Email: privacy@sim.ai
• Mailing Address: Sim Studio, Inc., 80 Langton Street, San Francisco, CA 94103, USA

Our EU Representative

Under Article 27 of the GDPR, Sim has appointed an EU Representative to act as its data protection agent:

Instant EU GDPR Representative Ltd.
Adam Brogden
contact@gdprlocal.com
Tel: +353 1 554 9700
INSTANT EU GDPR REPRESENTATIVE LTD
Office 2, 12A Lower Main Street
Lucan, Co. Dublin, K78 X5P8
Ireland

Data subjects in the European Economic Area may contact the Representative on any matter relating to the processing of their Personal Data.

We will respond to Your request within the timeframes stated in section 14 where those timeframes apply.