Last updated: 16 August 2026

Privacy Policy

This policy explains how Simam Digital ("we", "us") handles personal data when you use the Simam AI Strategy Consultant platform (the "Service"). It covers our obligations under the UK GDPR, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and comparable regimes including Saudi Arabia's PDPL and India's DPDP Act.

Review notice. This document was drafted to accurately describe how the Service currently processes data, but it has not yet been reviewed by a qualified solicitor. If you operate outside the UK and EU, have it checked against your local regime before relying on it.

1. Who we are

Simam Digital is the data controller for personal data processed through the Service.

Controller	Simam Digital
Registered address	2 Windhill Road, Wakefield, England, WF1 4BG
Company number	14105316 (registered in England and Wales)
Privacy contact	junaid.malik@simamdigital.com
Website	www.simamdigital.com

2. What we collect, and why

2.1 Account information

If you sign in with Google, we receive your name, email address, and profile picture URL from Google. You may instead continue as a guest, in which case no account data is collected. Legal basis: performance of a contract.

2.2 Digest subscription

If you subscribe to the Weekly AI Strategy Digest, we store your email address, chosen topics, delivery frequency, format preference, and selected persona. Legal basis: consent, which you may withdraw at any time.

2.3 Analytics

With your consent, we use Google Analytics (via Firebase) to understand which parts of the Service are used. This collects a randomly generated identifier, approximate location derived from IP address, device and browser type, and pages viewed. We do not use analytics to identify you personally. Legal basis: consent. No analytics cookies are set until you accept them.

2.4 Information stored only on your device

The following are held in your browser's local storage and are never transmitted to us:

Item	Purpose
Gemini API key	Authenticates your own requests to Google's Gemini API. Sent only to Google, never to our servers.
Theme preference	Remembers light or dark mode.
Language preference	Remembers your chosen interface language.
Flow board notes	Keeps sticky notes you add to the System Flow Board.
Cookie choice	Records whether you accepted or declined analytics.

2.5 Content you submit to AI features

Text you enter into the AI Consultant, App Architect, Idea Lab, Strategic Roadmap, or Topic Discovery is sent directly from your browser to Google's Gemini API using your own API key. It does not pass through our servers and we do not retain it. Google's handling of that content is governed by the terms of your own Google account. Do not paste confidential or personal data belonging to third parties into these features.

3. What we do not do

We do not sell personal data.
We do not use personal data for automated decision-making with legal or similarly significant effects.
We do not process payment card information through the Service.
We do not run advertising or third-party tracking pixels.

4. Processors and third parties

Provider	Purpose	Location
Google Firebase (Authentication, Firestore, Analytics)	Sign-in, subscriber storage, usage analytics	United States / EU
Google Gemini API	Generates AI output, using your own API key	United States
Google Fonts	Serves the interface typefaces	United States

5. International transfers

Google processes data in the United States and other territories outside the UK and EEA. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards from the contact address above.

6. How long we keep data

Data	Retention
Digest subscriber record	Until you unsubscribe, then deleted within 30 days
Account data	For as long as your account exists
Analytics events	14 months (Google Analytics default)
Browser-stored preferences	Until you clear your browser data

7. Your rights

Under the UK and EU GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to our processing;
receive your data in a portable format;
withdraw consent at any time, without affecting processing carried out beforehand;
lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

To exercise any of these, email junaid.malik@simamdigital.com. We respond within one month.

8. Security

Data in transit is encrypted with TLS. Subscriber records are protected by Firestore security rules that permit writes but block client-side reads, so no visitor can enumerate our subscriber list. Your Gemini API key never leaves your browser except in requests to Google.

9. Children

The Service is intended for business users and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We will update this page when our processing changes, and revise the "last updated" date above. Material changes affecting your rights will be notified to subscribers by email.