October 16, 2026
Data Processing Addendum
Simeon (simeon.sh) is operated by MOSHYMERCY, a micro-entreprise registered in France (SIRET 83430430500016), 132 rue des Poissonniers, 75018 Paris, France. To run the service we use the providers below. They act as our sub-processors: they process personal data only on our instructions, under a written agreement, and are bound by confidentiality and security obligations.
1. Scope, roles and definitions
1.1. This DPA applies when Simeon processes personal data on behalf of the Customer while providing the service (“Customer Personal Data”). This is the data of third parties that the Customer enters or imports into Simeon, for example the names, emails and addresses of the Customer’s own clients on invoices, and the personal data of people appearing in receipts the Customer uploads through the email import feature.
1.2. For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Simeon is the processor (or sub-processor). For the data of the Customer’s own account (email, name, preferences, security log), Simeon is a controller; see the Privacy Policy.
1.3. “Data Protection Law” means the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act as amended (“CCPA”), and any other data protection law that applies to the processing. Terms such as “controller”, “processor”, “personal data”, “personal data breach” and “processing” have the meaning given in the GDPR.
1.4. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.
2. Details of the processing
The subject matter, duration, nature, purpose, types of personal data and categories of data subjects are described in Annex I.
3. Instructions
3.1. Simeon processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use of the features of Simeon (for example creating an invoice, uploading a mailbox export, deleting an account) are the Customer’s complete instructions.
3.2. Simeon tells the Customer without delay if it believes an instruction infringes Data Protection Law, and may suspend the instruction until the Customer confirms or changes it.
3.3. Simeon does not process Customer Personal Data for its own purposes, does not sell it, and does not use it to train artificial intelligence models. The AI provider it uses (see Annex III) is bound by terms that restrict it in the same way.
4. Confidentiality
Simeon makes sure that every person authorised to process Customer Personal Data is bound by a duty of confidentiality.
5. Security
Simeon applies the technical and organisational measures in Annex II, which it may update provided the overall level of security is not reduced.
6. Sub-processors
6.1. The Customer gives Simeon a general authorisation to use the sub-processors listed on the Sub-processors page (Annex III).
6.2. Simeon gives the Customer at least 30 days’ notice before adding or replacing a sub-processor, by email to the address of the Customer’s account and by updating that page. The Customer may object on reasonable data-protection grounds by writing to privacy@simeon.sh within that period. If the parties cannot agree on a solution, the Customer may stop using the service and delete its account.
6.3. Simeon imposes on each sub-processor, by contract, data protection obligations at least as protective as this DPA, and remains responsible for their performance.
7. International transfers
7.1. Simeon is established in the European Union. Its main hosting is in the United States (database: Neon, Ohio; application: Vercel, Washington, D.C.); other sub-processors are described in Annex III.
7.2. Where Simeon transfers Customer Personal Data to a sub-processor in a country without an adequacy decision, it does so only under the EU–US Data Privacy Framework (with its UK Extension and the Swiss–US framework) if the sub-processor is certified, or otherwise under the European Commission’s Standard Contractual Clauses (Module 3, processor to processor) with the UK International Data Transfer Addendum and the Swiss amendments where required.
7.3. Standard Contractual Clauses. To the extent that a transfer of Customer Personal Data from the Customer to Simeon is a restricted transfer under the GDPR for which the Standard Contractual Clauses are required, the parties agree that the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA, and that:
the Customer is the “data exporter” and Simeon the “data importer”;
Clause 7 (docking clause) applies;
Clause 9(a): Option 2 (general written authorisation) applies, with a notice period of 30 days as in section 6.2;
Clause 11(a): the optional language does not apply;
Clause 13: the competent supervisory authority is identified in Annex I.C;
Clause 17: Option 1 applies and the clauses are governed by the law of France;
Clause 18(b): the courts of France have jurisdiction;
Annexes I, II and III of this DPA are Annexes I, II and III of the clauses.
7.4. United Kingdom. For transfers subject to the UK GDPR, the parties agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0) issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, which is incorporated into this DPA. Tables 1 to 3 are completed by the details in sections 7.3 and Annexes I to III. In Table 4, the data importer may end the Addendum when the Information Commissioner issues a revised Addendum.
7.5. Switzerland. For transfers subject to the FADP, the Standard Contractual Clauses in section 7.3 apply with these amendments: references to the GDPR are references to the FADP; the competent supervisory authority is the Federal Data Protection and Information Commissioner; references to “Member State” include Switzerland, so that data subjects in Switzerland may enforce their rights in Switzerland (Clause 18(c)).
8. Assistance to the Customer
8.1. Data subject requests. Taking into account the nature of the processing, Simeon assists the Customer by appropriate technical and organisational measures in answering requests from data subjects. The Customer can access, correct, export (full JSON export on every plan) and delete invoices, entries and imported data directly in the app. If Simeon receives a request concerning Customer Personal Data, it forwards it to the Customer and does not answer it itself unless the law requires.
8.2. Impact assessments. Simeon provides reasonable assistance with data protection impact assessments and prior consultations related to the service, where the Customer does not have the necessary information.
9. Personal data breach
Simeon notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 48 hours after becoming aware of it, by email to the address of the Customer’s account. The notification contains the information available at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Simeon provides further information as it becomes available and reasonably helps the Customer to meet its own notification duties.
10. Deletion and return
10.1. The Customer can export its data at any time on every plan (Settings > Data export, and Account > Privacy & your data).
10.2. When the Customer deletes its account, Simeon first emails a copy of the data to the Customer, then deletes the account and all the data in it from its database. Database backups are kept for 6 hours and then expire. Retention periods of data before deletion are described in section 7 of the Privacy Policy.
10.3. Simeon may keep data only where the law requires it, and tells the Customer where this is the case.
11. Audits and information
11.1. Simeon makes available to the Customer the information necessary to demonstrate compliance with this DPA, including its answers to reasonable security questionnaires.
11.2. If this is not sufficient, the Customer may, no more than once a year (or after a personal data breach), carry out an audit, with 30 days’ written notice, during business hours, without disrupting the service, subject to confidentiality, and at the Customer’s own cost. Audits are carried out remotely where possible.
12. CCPA: service provider terms
12.1. To the extent the CCPA applies, Simeon is a service provider and the Customer is a business. Simeon processes personal information only for the business purposes of providing the service described in the Terms and Annex I.
12.2. Simeon will not: (a) sell or share personal information; (b) retain, use or disclose it for any purpose other than the specified business purposes, including any commercial purpose other than providing the service, or outside the direct business relationship with the Customer; (c) combine it with personal information it receives from other sources or collects from its own interactions with the consumer, except as the CCPA allows.
12.3. Simeon complies with the CCPA and provides the same level of privacy protection as the CCPA requires, and tells the Customer if it can no longer meet its obligations. The Customer may take reasonable and appropriate steps to make sure Simeon uses the personal information consistently with the Customer’s CCPA obligations and, on notice, to stop and remediate any unauthorised use.
13. Customer responsibilities
The Customer is responsible for: having a lawful basis for the Customer Personal Data it enters or imports; informing its own clients and other data subjects as the law requires; uploading to the email import feature only emails it is entitled to use for its bookkeeping; and the lawfulness of its instructions.
14. Liability
Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law or the Standard Contractual Clauses provide otherwise.
15. Term and governing law
This DPA lasts as long as Simeon processes Customer Personal Data. Subject to section 7, it is governed by the law of France and the courts of France have jurisdiction.
Annex I: Details of the processing
A. Parties
Data exporter / controller: the Customer, identified by the account data it provided to Simeon.
Data importer / processor: MOSHYMERCY, micro-entreprise, SIRET 83430430500016, 132 rue des Poissonniers, 75018 Paris, France. Contact: privacy@simeon.sh.
B. Description of the processing
Categories of data subjects: the Customer’s own clients and prospects (on invoices); people named in receipts and emails the Customer uploads; the Customer’s contacts mentioned in manual entries or notes.
Categories of personal data: names, email addresses and postal addresses of clients; invoice lines, amounts and notes; sender addresses, subjects and extracted payment details (amount, currency, date, description) from imported receipts.
Sensitive data: none intended. The Customer must not enter special categories of data.
Frequency: continuous, for as long as the Customer uses the service.
Nature of the processing: storage and hosting; display and export; extraction of payment details from uploaded emails with an AI provider (the email is read once, its raw content erased immediately, and only the result kept).
Purpose: to provide the Simeon service described in the Terms: revenue tracking, invoicing, manual entries and receipt import.
Duration and retention: until the Customer deletes the data or its account, as described in section 7 of the Privacy Policy. Raw uploaded emails are erased once read, or after 7 days if an upload is not finished.
Sub-processors: see Annex III. The subject matter, nature and duration of the processing by sub-processors are the same as above, limited to what each needs.
C. Competent supervisory authority
The CNIL (Commission Nationale de l’Informatique et des Libertés), France, or, where the Customer is established in another EU Member State, the authority of that Member State. For Switzerland: the Federal Data Protection and Information Commissioner. For the United Kingdom: the Information Commissioner’s Office.
Annex II: Technical and organisational security measures
Encryption of provider credentials and two-factor secrets with AES-256-GCM.
Hashing (SHA-256) of API keys and connected-app tokens.
Mandatory PKCE and rotation of refresh tokens with replay detection.
Rate-limited one-time sign-in codes that do not reveal whether an email has an account; optional two-factor authentication, requested again for sensitive actions; sessions that can be revoked everywhere.
Strict Content-Security-Policy; rate limiting per key and per IP.
Protection against formula injection in CSV exports.
Unguessable invoice payment links (192 bits).
Separate development and production environments.
Data minimisation toward the AI provider: only the sender, the subject and the first 6,000 characters of an email; attachments and images are not sent; raw email content erased once read.
Automatic daily retention jobs for the security log, import data, notification markers and expired codes.
Security log of sign-ins, two-factor changes, exports and API key and connected-app events.
Contractual confidentiality and data protection obligations for sub-processors..
Annex III: Sub-processors
The current list, with each provider’s role, data concerned, location and transfer safeguard, is published at simeon.sh/subprocessors. It is part of this DPA