Privacy policy (draft)

This policy explains what personal information Plexus Labs ([address]) collects when you use simmail, what we do with it and the choices you have. It covers the website at simmail.dev, the platform where you sign in, and the hosted service.

Two kinds of data

Account data is information about you as our customer: your name, email address, organization, members and roles, sign-in sessions, plan, usage and billing status. For this data, we decide how it is used.

Universe data is what you and your apps put into simmail: mail, attachments, app logins, personas, settings and activity. We process it only to run the service for you, following your instructions. If it contains personal information, you are responsible for having a basis to use it. We ask you to use test data; see the acceptable use policy. For business customers, our data processing addendum covers universe data.

What we collect

When you sign up and sign in: name, email address, a hash of your password (never the password itself), and session records. If your organization uses single sign-on, the details your identity provider sends us.
When you use the service: the universe data described above, usage counts for your plan's limits, and an audit log of significant account actions.
When you pay: Polar collects your payment details. We receive your subscription status, plan and invoice information, but not your full card number.
When you contact us: the messages you send and our replies.
Technical data: IP addresses and request logs, used for security, abuse prevention (for example, limiting sign-ups per address) and fixing problems.

How we use it

To provide, secure and support the service.
To enforce plan limits and bill you through Polar.
To send you service messages, such as about your account, billing, security or changes to these policies.
To prevent abuse and comply with the law.

We do not sell personal information, and we do not use universe data for advertising.

Who processes it for us

Google (Gemini API): when AI is on, parts of the mail in a universe and persona details are sent to Google's Gemini API so simulated people can read and answer. Links in mail may also be checked against Google Web Risk.
Polar: merchant of record for payments, invoices and tax.
Cloudflare: hosts this website and documentation, and may relay link fetches made by simulated people.
[Hosting provider]: runs the servers and databases that hold account and universe data.

We may also disclose information if the law requires it, to protect people or the service, or as part of a merger or sale of the business, in which case this policy would continue to apply.

How long we keep it

Universe data: for as long as your plan's retention allows, or less if you set a shorter period. Older mail and activity are deleted automatically. Deleting a universe deletes its data.
Account data: while your account is open. After you close it, we delete it, except records we must keep for legal, tax or security reasons.

Cookies

The platform and the dashboards use cookies to keep you signed in: a session cookie and a short-lived signed pass. This website does not use advertising cookies.

Your choices and rights

You can view and update your account details, export mail over IMAP or the API, and delete universes or your organization at any time. Depending on where you live, you may have rights to access, correct, delete or port your personal information, or to object to some uses. Email [email protected] and we will respond within the time the law requires. If your information is in a customer's universe, we will refer your request to that customer.

International transfers

Plexus Labs is based in the United States, and our providers may process data in the United States and other countries. Where the law requires it, we use appropriate safeguards for these transfers.

Children

simmail is not meant for children, and we do not knowingly collect information from anyone under 16.

Changes

We will post changes here and, for significant ones, tell you by email or in the dashboard before they take effect.

Contact

Privacy questions: [email protected].