October 16, 2026

Privacy policy

This Privacy Policy explains how Simeon ("Simeon," "we," "us," or "our") collects, uses, discloses, and safeguards your information when you use our website (simeon.so) and our revenue aggregation service (the "Service").

By using Simeon, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Who We Are

Simeon (simeon.sh, application at app.simeon.sh) is a revenue dashboard that reads the transactions of the payment providers you connect. It is operated by MOSHYMERCY, a micro-entreprise registered in France (SIRET 83430430500016), 132 rue des Poissonniers, 75018 Paris, France.

  • For the data of your Simeon account, we are the controller.

  • For the data of third parties that you enter or import into Simeon (for example your own clients on an invoice, or people named in receipts you upload), you are the controller and Simeon is your processor. The Data Processing Addendum governs that processing.

Contact for anything about your data: privacy@simeon.sh.

2. The Short Version

We collect what we need to run your account and show your revenue. Nothing more.

  • We do not sell your personal information and we do not share it for advertising.

  • There is no analytics, no advertising and no tracker on Simeon, so there is no cookie banner.

  • Transactions read from your payment providers are not stored. They are read live and cached for at most 5 minutes.

  • Credentials of your connected providers are encrypted.

  • You can export all your data at any time on every plan, and delete your account from the app.

  • The rights described here apply to every user, wherever you live.

3. What we collect, why, and on what legal basis

Account. Email address, name (optional), date of creation and your preferences (currency, time zone, notifications, goal thresholds). We use them to create your account, let you sign in and send you the notifications you chose. Legal basis: performance of our contract with you (GDPR, art. 6(1)(b)).

Sign-in. You sign in with a one-time code sent to your email address. There is no password. Two-factor authentication with an authenticator app is optional; if you enable it, its secret is stored encrypted. Legal basis: performance of the contract, and our legitimate interest in securing accounts (art. 6(1)(f)).

Subscription. Your plan, billing interval, status and end of period. Payment methods and billing address for your Simeon subscription are handled by our merchant of record, Polar, not by Simeon. Legal basis: performance of the contract.

Invoicing. If you use the invoicing feature, we store your business profile (name and address of your activity, invoice prefix, external payment links) and your invoices, including the name, email and address of your clients, line items, amounts and notes. For your clients’ data, you are the controller and we act only on your instructions.

Manual entries. Revenue and expenses you enter by hand.

Connected providers. To read your revenue, you connect providers such as Stripe, PayPal, Gumroad or Shopify. We store the credentials you provide (API keys or tokens), encrypted with AES-256-GCM. The transactions themselves are read live from the provider and are not stored in our database; they are kept in a short-lived cache for at most 5 minutes (1 minute if a provider’s answer is partial).

API keys and connected apps. If you create Simeon API keys or connect an app such as Claude or ChatGPT, we store only a SHA-256 hash of the key or token, with its name, its last 4 characters, its scope and dates.

Security log. Sign-ins, activation and deactivation of two-factor authentication, data exports, events concerning API keys and connected apps, with the IP address and the date. Legal basis: our legitimate interest in security and in detecting abuse (art. 6(1)(f)).

Email imports. Optional. See section 6.

Built-in assistant. An assistant explains how to connect a provider. It receives only the question you type. Legal basis: performance of the contract.

Notifications. Weekly, monthly and yearly reports, goal and high-value transaction alerts, new-transaction alerts and connection error alerts, according to your settings. Every notification contains a one-click unsubscribe link. Sign-in codes and account emails are not notifications.

Cookies and local storage. We use only strictly necessary ones: a session cookie (7 days), a signed “2fa_verified” cookie (8 hours), sign-in security cookies (CSRF and callback), short-lived state cookies while you connect a provider through OAuth, and a few interface preferences stored in your browser (for example dismissed banners). We use no analytics, no advertising and no tracker. Because these cookies are strictly necessary, we show no cookie banner.

4. Who receives your data

We use a limited number of providers (our sub-processors) to host and operate Simeon. They are listed with their role, location and transfer safeguard on our Sub-processors page. They process data only on our instructions.

We may also disclose data where the law requires it (for example a valid request from an authority). We do not sell your personal information.

The payment providers you connect are independent of us: you choose them and Simeon reads your data with the keys you provide.

5. International transfers

Simeon’s main hosting is in the United States: our database is hosted by Neon (Ohio) and the application by Vercel (Washington, D.C.). Our Redis service (Upstash) and our company mailbox (Zoho Mail) are in the European Union (Ireland). Anthropic, which processes the content described in section 6 and the assistant questions, is in the United States. [TO CONFIRM: Resend location].

When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework (with its UK Extension and the Swiss–US framework) where the provider is certified, or on the European Commission’s Standard Contractual Clauses, completed by the UK International Data Transfer Addendum and the Swiss amendments where needed.

We add supplementary measures: encryption of provider credentials and two-factor secrets (AES-256-GCM), encrypted connections, minimisation of what is sent to providers (for AI processing, only the sender, the subject and the first 6,000 characters of an email), and contractual commitments restricting use of the data to providing the service.

You can obtain a copy of the safeguards by writing to privacy@simeon.sh.

6. Importing receipts from your mailbox

Some payment providers have no API that Simeon can read. For those, you can upload an export of your mailbox (.mbox or .eml files) and Simeon looks for payment receipts in it.

  1. You choose what to upload. Nothing is read from your mailbox automatically. Simeon only sees the files you upload. We recommend exporting only receipts and payment notifications from the senders you care about.

  2. We read each email once. For every message, Simeon sends the sender, the subject and the first 6,000 characters of the text to Anthropic (United States), which returns the amount, currency, date and a short description. Attachments and images are not sent. Anthropic deletes inputs and outputs from its systems within 30 days, unless longer retention is required by law or to enforce its usage policy, and does not use content sent through its API to train its models without permission.

  3. We erase the email. As soon as a message has been read, its raw content is erased from our database. An upload that is never finished is erased after 7 days.

  4. We keep the result for you to review. For each detected payment we keep the sender address, subject, amount, currency, date, description and a confidence level. You confirm or reject each one. Rejected candidates are deleted immediately. Undecided candidates are deleted after 180 days. Confirmed ones become transactions in your dashboard and stay until you delete them or your account.

  5. A person always decides. The AI only proposes. Nothing counts toward your revenue until you confirm it, and no decision with legal or similarly significant effect is taken automatically.

Why we may do this. Processing your own receipts is the service you asked for (GDPR, art. 6(1)(b)). For the personal data of your customers or other people that appears in those emails, you are the controller and Simeon is your processor.

Your responsibility. Upload only emails you are entitled to use for your bookkeeping. If a mailbox contains other people’s private correspondence, do not upload it.

Your choices. Reject any candidate and it is deleted immediately (“reject all” is available per source). Delete your account and every candidate, source and transaction is deleted with it.

7. How long we keep data, and what happens when you delete your account

Retention periods

  • Account, subscription, invoices, manual entries, integrations: until you delete them or your account.

  • Security log: 365 days.

  • Raw emails from an unfinished import: 7 days. Raw emails already read: erased immediately.

  • Tracking line of a completed import: 90 days.

  • Undecided import candidates: 180 days. Rejected candidates: deleted immediately.

  • Revoked API keys and connected apps: 365 days after revocation.

  • “Already notified” markers: 7 days.

  • Expired sign-in codes and links: deleted every day.

  • Sessions: 7 days.

  • Revenue cache: at most 5 minutes.

Deleting your account. In Account > Danger zone. If two-factor authentication is on, a fresh code is required. Then:

  1. We email you a copy of your data (CSV) at the address of your account. If sending fails, deletion continues.

  2. Your Polar subscription is cancelled. If cancellation fails, nothing is deleted.

  3. Your sessions are revoked and your account and all its data are deleted from our database.

  4. Your customer records at Polar are deleted. If Polar cannot be reached, the step is retried every day for up to 30 days.

  5. We send you a goodbye email.

Polar may keep or anonymise what tax and accounting law requires it to keep (generally 10 years).

Backups. Database backups are kept for 6 hours, after which data deleted from the live database is no longer in them.

8. Your rights

You have the right to access your data, to receive it in a portable format, to correct it, to have it deleted, to restrict or object to its processing, and to withdraw any consent you gave.

  • Access and portability. A complete JSON export of everything we store about you is available on every plan in Settings > Data export and in Account > Privacy & your data. It never contains secrets. Detailed CSV exports (transactions, invoices, manual entries) are part of the Pro plan.

  • Deletion. Account > Danger zone (see section 7).

  • Notifications. Turn them off in Settings > Notifications or use the unsubscribe link in any notification email.

  • Anything else. Write to privacy@simeon.sh. We answer within one month; for complex requests we may extend this by up to two further months and we will tell you why.

If you think we do not respect your rights, you can complain to the CNIL (cnil.fr), the French data protection authority, or to the authority of your country.

9. Security

AES-256-GCM encryption of provider credentials and two-factor secrets.

  • Hashing of API keys and tokens.

  • Mandatory PKCE and rotation of refresh tokens with replay detection.

  • Rate-limited one-time sign-in codes that do not reveal whether an email has an account.

  • Optional two-factor authentication, asked again for sensitive actions; sessions can be revoked everywhere.

  • Strict Content-Security-Policy and rate limiting per key and per IP.

  • Protection against formula injection in CSV exports.

  • Unguessable invoice payment links (192 bits).

  • Separate development and production environments.

No system is perfectly secure. If a breach affects your personal data, we notify you and the competent authority as the law requires.

10. Children

Simeon is a professional product and is not intended for people under 18. We do not knowingly collect their data. If you think a minor has an account, write to privacy@simeon.sh.

11. Cookies

We use cookies for:

  • Essential/session cookies: To keep you logged in and maintain security (e.g., authentication state)

  • Preference cookies: To remember dashboard settings, where applicable

We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent you from using the Service.

11. California residents

We apply the rights below to all users, wherever they live, even where the law does not require it.

Categories of personal information we collect: identifiers (email address, name, IP address); commercial information (subscription data); internet activity (security log); and, as sensitive personal information, the account credentials of the providers you connect. The purposes and retention periods are in sections 3 and 7.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months. We use sensitive personal information only to provide the service you asked for.

Your rights: to know what we collect and why, to delete your information, to correct it, to limit the use of sensitive information, and not to be discriminated against for exercising these rights.

How to exercise them: use the tools in section 8 or write to privacy@simeon.sh from the address of your account, which is how we verify your identity. An authorized agent may act for you with your written permission. We confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days, with notice).

12. Changes

We may update this policy. If a change is significant, we will tell you by email or in the app before it applies. The date at the top shows the last update.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

Email:privacy@simeon.sh Website:simeon.sh