Controller: Simplify Tech Solutions W.L.L
Commercial Registration: 153908-1
Jurisdiction: Kingdom of Bahrain
Service: SimpleX (simplexnow.com)
1. What this policy covers
This policy explains how Simplify Tech Solutions W.L.L ("Simplify", "we") handles personal data in connection with SimpleX, our cloud accounting and inventory service.
It is written to meet the Kingdom of Bahrain's Personal Data Protection Law (Law No. 30 of 2018) ("PDPL") and is structured so that it can be extended to GDPR and India's DPDP Act as SimpleX expands, without being rewritten.
Two different roles, and the difference matters.
| Who decides what happens to the data | Who we are | |
|---|---|---|
| Your account data — your name, your email, your users, your billing | You gave it to us to run the service | Simplify is the data controller |
| The data you put into SimpleX — your customers, suppliers, employees, invoices | You decide what to record and why | Simplify is a data processor acting on your instructions |
For everything in the second row, you are the controller and this policy does not replace your own obligations to the people whose data you hold. The written processing agreement covering that relationship is described in §12.
2. The personal data we hold
2.1 Data you give us directly
- Account and identity — name, work email address, password (stored only as a bcrypt hash, never in readable form), and your role within your organisation.
- Organisation details — legal name, commercial registration number, VAT registration number, addresses, contact numbers, and your company logo where you upload one.
- Two-factor authentication — where you enable it, an encrypted authenticator secret and a set of single-use backup codes.
- Billing — the plan and number of licences you hold, your billing contact, and the invoices we raise to you.
- Support conversations — what you send us when you contact support by email or WhatsApp, including the email address or phone number you contact us from.
2.2 Data you enter about other people
SimpleX is an accounting system, so the records you create will normally contain personal data belonging to third parties — your customers, your suppliers, your salespeople. Typically: names, trading names, email addresses, phone numbers, postal addresses, VAT registration numbers and bank details.
We hold this on your behalf and on your instructions. We do not decide what you record, we do not use it for our own purposes, and we do not sell it, share it for advertising, or use it to train machine-learning models.
2.3 Data generated by your use of the service
- Audit trail. Every financial action is recorded with who did it, what changed, when, and the originating IP address. This is a deliberate design decision and a regulatory requirement — a VAT audit or a PDPL access request cannot be answered without it. The audit trail is not editable and not erasable while the underlying record must be retained (see §7).
- Security and session records — sign-in events, refresh tokens, and revoked-token records used to make signing out take effect immediately.
- Technical logs — structured request logs used for diagnosing faults. These are configured not to record passwords, tokens, bank account numbers, IBANs, full VAT registration numbers, or card numbers.
2.4 What we do not collect
- We do not take card payments online and we never see card details. Subscription payments are made outside the product — by bank transfer, Benefit, cash or cheque — and we record them when we receive them. If that changes we will update this policy before, not after.
- We do not use analytics, advertising cookies or third-party tracking pixels, on simplexnow.com or in the application.
3. Why we process it, and on what basis
| What we do | Why | PDPL basis |
|---|---|---|
| Create and run your account | To provide the service you signed up for | Performance of a contract |
| Store and process the records you enter | Same | Performance of a contract |
| Send transactional email and in-app notifications — invoices, quotations, reminders, password resets | To deliver a function you asked for | Performance of a contract |
| Answer support requests you send by email or WhatsApp | To give you the support you asked for | Performance of a contract |
| Keep an audit trail of financial changes | Accounting integrity, and Bahraini VAT record-keeping obligations | Legal obligation |
| Retain records for the statutory period | Bahraini VAT and commercial law | Legal obligation |
| Keep security, sign-in and token records | To protect accounts against unauthorised access | Legitimate interest |
| Diagnose faults from technical logs | To keep the service working | Legitimate interest |
| Bill you, and chase non-payment | To be paid | Performance of a contract |
We do not rely on consent for any of the above, which means withdrawing consent is not a route to stopping processing that is necessary to run your account. The route for that is to close your account (§7).
We do not send you WhatsApp or SMS messages about your account. If we introduce either channel, we will ask for your explicit consent first, and you will be able to withdraw it at any time.
We do not make automated decisions that produce legal effects about you. SimpleX includes AI-assisted insights — cash-flow projection, expense trends, payment-delay and unusual-spend alerts. These are advisory and explainable; they summarise your own data back to you. They do not decide anything, and they do not score individuals.
AI features are off until your company switches them on. Some features can use an AI model to word insights and report notes, suggest bank-reconciliation matches (and read the columns of a bank statement you upload), and translate item names. They are off for every company until its owner or an administrator turns them on in Settings → Data & privacy, which shows exactly what each feature sends. When they are on, that data goes to Anthropic (see §4). For insights, report notes and bank reconciliation, customer and vendor names are replaced with placeholders first, and any other text on a bank statement is sent as it appears on the statement; a translation sends only the item name you ask to translate. They can be switched off at any time, and nothing is sent while they are off.
4. Who else touches the data
We use a small number of processors. Each has access only to what it needs.
| Processor | Role | Location |
|---|---|---|
| Norq Technologies W.L.L | Development and technical operation of SimpleX under a contract with Simplify | Kingdom of Bahrain |
| Neon | Managed PostgreSQL — this is where your records live | Frankfurt, Germany (European Union) |
| Render | Application server hosting | Frankfurt, Germany (European Union) |
| Vercel | Web application delivery | Global edge network |
| Brevo | Transactional email (invoices, reminders, password resets) | European Union |
| Cloudflare R2 | File storage — the receipts and other files you attach to your records | European Union |
| GlitchTip | Error reports, so that we can find and fix faults: what failed and where, the page or request, your browser, the address it was sent from, and the identifiers of your user and company (we do not attach your name or email); sign-in tokens and reset codes are removed first | Frankfurt, Germany (European Union) |
| Anthropic | AI model (Claude Haiku) for the AI features — only for a company whose owner or an administrator has switched them on; they are off by default | United States |
| Google Workspace (Google) | Our own mailboxes — support@, privacy@, finance@ and info@simplexnow.com — for support, privacy and billing correspondence | Google's data centres (no data region selected) |
This table is our current list of processors, and it is always at www.simplexnow.com/privacy#who-else-touches-the-data. We give 30 days' notice before adding or replacing one. If you object on reasonable data-protection grounds and we cannot resolve the objection, you may end your subscription.
If you chat with us on WhatsApp, the conversation is carried by WhatsApp (Meta) under WhatsApp's own terms.
We do not sell or rent personal data. We have never sold personal data. There is no arrangement under which we would. We share it only with the service providers listed above, who process it on our behalf and on our instructions, or where the law requires us to disclose it.
5. Where the data is held, and transfers out of Bahrain
Bahrain does not impose a general data-localisation requirement on accounting software of this kind, so SimpleX is hosted outside Bahrain for reliability and latency reasons. Your records are held in Frankfurt, Germany, in the European Union, where our database (Neon) and our application servers (Render) are. Files you attach are stored with Cloudflare R2 in the European Union. Our other processors, and where they are, are listed in §4.
The PDPL restricts transferring personal data outside Bahrain unless the destination offers adequate protection or a lawful transfer mechanism is in place. Where a processor is outside an adequate jurisdiction we rely on contractual safeguards with that processor, and on any other transfer mechanism the law requires.
6. How we protect it
- Data is encrypted in transit and at rest.
- Passwords are hashed with bcrypt. We cannot read your password.
- Every tenant's data is isolated at two independent layers: every query is scoped to your organisation, and the database itself enforces row-level security as a second, independent barrier.
- Access tokens are short-lived; signing out revokes both your session and your refresh token immediately.
- Two-factor authentication is available and we recommend it for every user with financial permissions.
- Access to production systems is limited to named personnel who need it.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data, we will notify you within 72 hours of becoming aware of it, and notify the Personal Data Protection Authority where, and within the time, the law requires.
7. How long we keep it
- While your subscription is active — for as long as you keep it.
- When your subscription ends — your account stays read-only, with no time limit: you can still sign in, see your records and export them. We keep your data until you ask us to delete it.
- When you ask us to delete it — we delete it or irreversibly anonymise it, except records we are required to keep.
- Accounting records — retained for ten years, as Bahraini VAT and commercial law require, whether or not your subscription continues and even if you ask for deletion. After ten years they are deleted.
- Files you attach — kept for ten years from the day you attach them, like the records they support, even if you later remove them from a record.
- Audit trail — retained for the life of the records it describes. This is not an oversight: an audit trail that can be edited or selectively deleted is not an audit trail.
Financial records are never hard-deleted while they are in scope. Invoices, bills, payments, journals and credit notes are voided or cancelled, not destroyed. This is a requirement of double-entry accounting and of VAT auditability, and it constrains what a deletion request can achieve — see §8.
8. Your rights
Under the PDPL you may ask us to:
- tell you what personal data we hold about you and why;
- correct it where it is wrong;
- erase it where we have no lawful reason to keep it;
- give you a copy in a portable form;
- stop or restrict processing based on legitimate interest;
- object to processing you consider unlawful.
Where to send the request depends on whose data it is.
If you are a SimpleX account holder asking about your own account data, contact us at privacy@simplexnow.com. We will respond within 30 days.
If you are a customer, supplier or employee of a business that uses SimpleX, we hold your data on that business's behalf and we are not permitted to act on your request directly. Please contact that business. If you contact us, we will pass your request to them and tell you we have done so.
The honest limit on erasure. Where the law requires us to keep a financial record — a VAT invoice, for instance — we cannot delete it on request, and we will tell you plainly that we are refusing and why, rather than deleting something we are obliged to retain or pretending the request succeeded.
9. Cookies and similar technologies
SimpleX uses browser storage strictly to keep you signed in and to remember interface preferences such as a chosen filter or column layout. We do not use analytics, advertising or cross-site tracking cookies, on simplexnow.com or in the application. You can clear this storage in your browser at any time; doing so signs you out.
10. Children and minors
SimpleX is a business product and is not directed at children. Accounts are for people aged 18 or over, and we do not knowingly collect personal data from anyone under 18.
11. Changes to this policy
We will post any change here and update the version and effective date. Where a change materially affects how we handle personal data we will give you at least 30 days' notice before it takes effect.
12. Data processing agreement
Where SimpleX processes personal data on your behalf, our Data Processing Agreement governs that processing. It forms part of our Terms of Service for every customer, so accepting the Terms accepts it, and no separate signature is needed. It is published at www.simplexnow.com/dpa.
A separate contract between Simplify and Norq governs the Simplify↔Norq relationship; it does not replace the customer agreement.
13. Contact
Simplify Tech Solutions W.L.L
CR 153908-1
Registered address: 502, Building 2504, Road 2832, Block 428, Al Seef, Kingdom of Bahrain
Privacy requests: privacy@simplexnow.com — handled by Simplify.
If you believe we have mishandled your personal data you may complain to us first, and you have the right to complain to Bahrain's Personal Data Protection Authority.