Sub Processors

Vercel Inc.

• Purpose: hosting of the application and scheduled jobs.

• Data concerned: requests to the application, account data in transit, technical logs (including IP address).

• Location: United States (Washington, D.C.).

• Transfer safeguard: EU–US Data Privacy Framework, with the UK Extension and the Swiss–US Data Privacy Framework.

  
  

Neon

• Purpose: PostgreSQL database.

• Data concerned: account data (email, name, preferences), subscription status, billing profile, invoices and the details of your clients that you enter, manual entries, encrypted provider credentials, hashed API keys and connected-app tokens, security log, email-import results.

• Location: United States (Ohio). Backups are kept for 6 hours.

• Transfer safeguard: EU–US Data Privacy Framework, with the UK Extension and the Swiss–US Data Privacy Framework.

  
  

Upstash (Redis)

• Purpose: rate limiting, one-time sign-in codes, sign-out markers, two-factor status, short-lived cache of revenue figures (up to 5 minutes).

• Data concerned: IP addresses, email address, authentication markers, cached revenue figures.

• Location: European Union (Ireland, eu-west-1).

• Transfer safeguard: data stays in the EU; any access from outside the EU is covered by the European Commission’s Standard Contractual Clauses.

  
  

Resend

• Purpose: sending of emails (sign-in codes, reports, alerts, welcome, account deletion, copy of your data).

• Data concerned: your email address and the content of the emails, which may include amounts and the names of the payment providers you connected. Customer names are not included.

• Location: United States, North Virginia

• Transfer safeguard: EU–US Data Privacy Framework.

  
  

Anthropic (artificial intelligence)

• Purpose: (1) email import: extraction of amount, currency, date and description from the receipts you upload; (2) built-in assistant that explains how to connect a provider.

• Data concerned: for email import, the sender, the subject and the first 6,000 characters of each email you upload (attachments and images are not sent); for the assistant, only the question you type.

• Location: United States.

• Retention at Anthropic: inputs and outputs are deleted from its systems within 30 days, unless longer retention is required by law or to enforce its usage policy. Content sent through its API is not used to train its models without permission.

• Transfer safeguard: EU–US Data Privacy Framework, with the UK Extension and the Swiss–US Data Privacy Framework.

  
  

Zoho Mail (Zoho Corporation)

• Purpose: our company mailbox, used for support requests and privacy requests (hello@simeon.sh, privacy@simeon.sh).

• Data concerned: your email address and the content of the messages you send us.

• Location: European Union (Ireland).

• Transfer safeguard: not applicable for hosting in the EU.

  
  

Polar (merchant of record)

• Purpose: billing and payment of your Simeon subscription; verification that an email address is entitled to sign in.

• Data concerned: email address, name and billing details you give at checkout, subscription data. Payment methods are handled by Polar, not by Simeon.

• Location: Stockholm, Sweden

• Transfer safeguard: EU–US Data Privacy Framework where applicable.

• Roles: Polar is an independent controller for its tax and accounting obligations (it may keep what the law requires, generally 10 years) and our processor for the customer record we ask it to delete when you close your account.