# Privacy Policy *Updated 2026-08-25. What data Simpled.ai collects, why, which sub-processors it is shared with, how long it is kept, and how to request access or deletion. Operated by Makai Care, San Francisco.* This policy explains what Simpled.ai collects when you visit the site or use the product, why we collect it, who processes it on our behalf, and how to get it back or have it deleted. It applies to simpled.ai, api.simpled.ai, and the Simpled.ai web application. ## Who we are Simpled.ai is operated by Makai Care, 650 California Street, San Francisco, CA 94108, US. For any question about this policy, or to exercise any right described in it, write to manav@simpled.ai. Makai Care is the controller of the personal data described here. The sub-processors listed further down act as processors on our instructions. ## What we collect and why We collect four kinds of data. Nothing here is sold, and none of it is used to build advertising profiles. | Category | What it contains | Why we hold it | | --- | --- | --- | | Account data | Name, email address, profile image, and either a hashed password or a Google account identifier if you sign in with Google. | To create and secure your account and to bill the right person. | | Usage and session data | Session tokens, IP address, browser user-agent, pages viewed, and product events. | To keep you signed in, to detect abuse, and to understand which parts of the product are used. | | Content you create | The prompts and topics you submit, generation settings, any PDF or document you upload, any watermark logo you upload, and the rendered videos. | To generate your video, to show it back to you in your history, and to let you download it later. | | Billing data | Your Stripe customer identifier, subscription plan and status, and a ledger of credit debits and credits. | To run subscriptions, apply credits, and answer billing questions. | Card numbers never reach our servers. Stripe collects and stores payment instruments directly. ## Legal bases Where the GDPR or UK GDPR applies, we rely on: performance of a contract for account, generation and billing data; legitimate interests for security, abuse prevention and product analytics; and consent where consent is separately requested. Where the CCPA/CPRA applies, we do not sell or share personal information as those terms are defined, and we do not process it for cross-context behavioural advertising. ## Sub-processors Running the product means handing specific data to specific vendors. This is the complete list, and what each one receives. ### Supabase (PostgreSQL) -- United States Primary database. Holds account data, project metadata, prompts, and the credit ledger. ### Amazon Web Services (S3, us-east-1) -- United States Object storage for rendered videos, uploaded documents, and watermark images. ### Vercel -- global edge Hosting and CDN for the website and application. Processes request metadata including IP address. ### Stripe -- United States Payments and subscription management. Receives your email and billing details directly; returns a customer identifier to us. ### Google (Sign in with Google) -- United States Optional authentication. If you use it, Google returns your name, email address and profile image to us. ### PostHog -- product analytics Product usage events. Signed-in sessions are identified with your user identifier, email and name so we can debug an account-specific problem. ### Intercom -- customer support In-app chat. Receives your user identifier, name and email so a conversation persists across sessions. ### Resend -- transactional email Sends the 'your video is ready' and account emails. Receives your email address and name. ### Fontshare -- web fonts Every page loads a stylesheet from api.fontshare.com, so your browser contacts that host directly and it sees your IP address and user agent. No account data is sent to it. ### Azure OpenAI, Google Gemini, ElevenLabs and Replicate -- generation Your prompt and any document you upload are sent to these model providers to plan the script, illustrate the scenes, and synthesise the narration. They receive the content of the generation request, not your account or billing data. ## International transfers Our infrastructure and the sub-processors above are primarily located in the United States. If you use the product from outside the United States, your data is transferred there. Where required, transfers rely on the European Commission's Standard Contractual Clauses or the vendor's equivalent transfer mechanism. ## How long we keep things Account data is retained for as long as the account exists. Projects, prompts and rendered videos are retained while the account exists so they stay available in your history. Session records expire automatically. Billing records are retained for as long as tax and accounting law requires, typically seven years. When you ask us to delete your account, we delete account data, projects, prompts and rendered media within 30 days, except for billing records we are legally required to keep. ## Cookies We set a first-party session cookie so you stay signed in -- the product does not work without it. PostHog and Intercom set their own cookies for analytics and for continuity of support conversations. We do not run advertising or retargeting pixels. ## Your rights Write to manav@simpled.ai to exercise any of these. We respond within 30 days and do not charge for a first request. ### Access Get a copy of the personal data we hold about you. ### Correction Have inaccurate data corrected. Write to manav@simpled.ai with the correction and we will apply it. ### Deletion Have your account and its content deleted, subject to the retention exceptions above. ### Portability Receive your data in a machine-readable format, and download your rendered videos at any time. ### Objection and restriction Object to processing based on legitimate interests, or ask us to restrict it while a dispute is resolved. ### Complaint Lodge a complaint with your local supervisory authority. We would rather you told us first. ## Children Simpled.ai is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, write to us and we will delete it. ## Changes to this policy When this policy changes materially we update the date at the top of the page and, for changes that affect how we use existing data, notify account holders by email. The current version is always the one published here, and a plain-text version is available at https://simpled.ai/privacy.md. ## Questions Privacy questions, access requests and deletion requests all go to manav@simpled.ai. Enterprise customers who need a signed DPA should contact sales@makai.video.