Privacy Policy
Privacy Policy
Last updated: April 2026
Last Updated On 04-Mar-2025
Effective Date 04-Mar-2025
This Privacy Policy describes the policies of Digital Artflow SRL, Calea Mosilor, nr.88, Bucharest, Ilfov 030167, Romania, on the collection, use and disclosure of your information that we collect when you use our website ( https://www.simplio3d.com ) and application (app.simplio3d.ai). (the “Service”). By accessing or using the Service, you are consenting to the collection, use and disclosure of your information in accordance with this Privacy Policy. If you do not consent to the same, please do not access or use the Service.
We may modify this Privacy Policy at any time without any prior notice to you and will post the revised Privacy Policy on the Service. The revised Policy will be effective 180 days from when the revised Policy is posted in the Service and your continued access or use of the Service after such time will constitute your acceptance of the revised Privacy Policy. We therefore recommend that you periodically review this page.
-
Information We Collect:
We will collect and process the following personal information about you:
- Name
- Mobile
- Payment Info
-
How We Collect Your Information:
We collect/receive information about you in the following manner:
- When a user fills up the registration form or otherwise submits personal information
- Interacts with the website
- From public sources
-
How We Use Your Information:
We will use the information that we collect about you for the following purposes:
- Marketing/ Promotional
- Creating user account
- Testimonials
- Customer feedback collection
- Processing payment
- Support
- Administration info
- Targeted advertising
- Dispute resolution
- Manage user account
If we want to use your information for any other purpose, we will ask you for consent and will use your information only on receiving your consent and then, only for the purpose(s) for which grant consent unless we are required to do otherwise by law.
-
How We Share Your Information:
We will not transfer your personal information to any third party without seeking your consent, except in limited circumstances as described below:
- Analytics
- Data collection & process
We require such third party’s to use the personal information we transfer to them only for the purpose for which it was transferred and not to retain it for longer than is required for fulfilling the said purpose.
We may also disclose your personal information for the following: (1) to comply with applicable law, regulation, court order or other legal process; (2) to enforce your agreements with us, including this Privacy Policy; or (3) to respond to claims that your use of the Service violates any third-party rights. If the Service or our company is merged or acquired with another company, your information will be one of the assets that is transferred to the new owner.
-
Retention Of Your Information:
We will retain your personal information with us for 90 days to 2 years after user accounts remain idle or for as long as we need it to fulfill the purposes for which it was collected as detailed in this Privacy Policy. We may need to retain certain information for longer periods such as record-keeping / reporting in accordance with applicable law or for other legitimate reasons like enforcement of legal rights, fraud prevention, etc. Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely.
-
Your Rights:
Depending on the law that applies, you may have a right to access and rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (port) your personal information to another entity, withdraw any consent you provided to us to process your data, a right to lodge a complaint with a statutory authority and such other rights as may be relevant under applicable laws. To exercise these rights, you can write to us at [email protected]. We will respond to your request in accordance with applicable law.
You may opt-out of direct marketing communications or the profiling we carry out for marketing purposes by writing to us at Contact us.
Do note that if you do not allow us to collect or process the required personal information or withdraw the consent to process the same for the required purposes, you may not be able to access or use the services for which your information was sought.
-
Cookies Etc.
To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookie Policy.
-
Security:
The security of your information is important to us and we will use reasonable security measures to prevent the loss, misuse or unauthorized alteration of your information under our control. However, given the inherent risks, we cannot guarantee absolute security and consequently, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk.
-
Grievance / Data Protection Officer:
If you have any queries or concerns about the processing of your information that is available with us, you may email our Grievance Officer at Digital Artflow SRL, Calea Mosilor, nr.88, Bucharest, Romania or contact us directly from here Contact us. We will address your concerns in accordance with applicable law.
Business contacts and prospecting
Added 8 October 2026; updated 13 October 2026. This section explains how Digital Artflow SRL (Simplio3D) handles the details of people we contact about our products in their professional role. Where it differs from the rest of this policy, this section applies to that processing.
What we hold. Your name, job title, work email address, the company you work for, its website and country, information the company publishes about itself (such as its products and the technology its website uses), and our correspondence with you.
Where it comes from. Your company’s public website and other public business sources, and the business contact data providers we use (currently Hunter and GetProspect). If you ask, we will tell you which source supplied your details.
Why we use it, and on what basis. To contact you about Simplio3D where it is relevant to your role, to handle your replies and any meetings or quotes that follow, and to keep a do-not-contact record. Our legal basis is our legitimate interest in offering our products to businesses (GDPR Article 6(1)(f)). We write only to work addresses, in your professional capacity, and a person reviews and approves every message before it is sent. For contacts outside the UK and the European Economic Area, an email may contain a tiny image and links that pass through our website, which show us whether it was opened or a link in it was followed. We use this only to judge how our emails perform and whether to follow up; we never do it for contacts in the UK or the EEA, and it stops when you unsubscribe.
Your right to object. You can object at any time, free of charge: use the unsubscribe link in any of our emails, or reply “unsubscribe”. We stop straight away and keep a minimal do-not-contact record so that we never contact you again. If you also ask us to erase your details, that record is reduced to a one-way hash of your email address.
Who receives it. Service providers that process it for us: Google (email), Supabase and DigitalOcean (hosting and storage), Firecrawl and BuiltWith (reading public company websites), OpenAI and Anthropic (AI services that help us research, draft and sort messages; a person, not the AI, decides whom we contact and what we send), and the data providers named above. Some of these providers are in the United States. Where data leaves the EEA, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.
How long we keep it. If you do not reply, we delete your contact details 12 months after our last message. If we start working together, our normal customer retention applies. The do-not-contact record is kept for as long as we contact businesses.
Your other rights. You can ask us for access to your details, or for their correction, erasure or restricted use, through our contact form. You can also complain to a data protection authority: in Romania the ANSPDCP (dataprotection.ro), or the authority where you live or work.
AI connections (ChatGPT, Codex, Claude and other AI apps)
Added 14 October 2026. This section explains what happens to your data when you connect an AI application, such as ChatGPT, Codex or Claude, to your Simplio3D account through the Model Context Protocol (MCP). Where it differs from the rest of this policy, this section applies to that processing.
How a connection works. You connect an AI application by signing in to Simplio3D from it and approving the connection. You choose the workspace it may use and the permissions it receives; read-only access is selected by default. The application can then request data, or ask for changes, only in that workspace and within those permissions. Price changes, deletions and other high-risk changes are only proposed: they take effect after you approve them in your Simplio3D dashboard. You can see and revoke your connections at any time in Dashboard → Integrations → AI Connections; a revoked connection stops working immediately. Removing Simplio3D inside the AI application does not revoke the connection by itself.
What the AI application can receive. Only data from the workspace you chose, within the permissions you granted, and only when the application requests it to carry out what you asked:
- the setup of your projects, such as options, materials, rules, pricing, forms and 3D model structure, and the history of changes AI applications made or proposed;
- your own profile: name, email address, company, phone number, website, preferred language and when your account was created;
- the names, email addresses, roles and invitation status of your team members;
- configurations your shoppers saved: their selections only, without their name or email address;
- only if you grant the separate permission to read quote requests (quotes:read): your customers’ quote and form submissions, including the contact details and answers they entered, and the log of emails your projects sent (recipient, subject and delivery status, never the message itself);
- only if you grant the separate store permission (commerce:read): whether your online store is connected, and its products.
An AI connection never receives passwords, email-server or store credentials, webhook secrets, payment details, or data from another customer’s workspace.
Why we use it, and on what basis. Only to carry out the request you made in the AI application. For your own account data, our legal basis is the performance of our contract with you (GDPR Article 6(1)(b)). For the personal data of your team members and your customers, you decide whether an AI application may read it, and we process it on your behalf and on your instructions.
Who receives it. The AI application you connected and the company that provides it, for example OpenAI (ChatGPT, Codex) or Anthropic (Claude). They process what Simplio3D returns under their own terms and privacy policies, which also cover your conversations with them. Some of these providers are located outside the European Economic Area, for example in the United States. Simplio3D does not receive your conversation: it receives only the requests the application sends, such as which tool to use and the project it concerns.
What we keep, and for how long. Simplio3D does not keep the data it returns to the AI application. We keep:
- the connection: the application’s name, the workspace, the permissions, when it was created and last used, and the IP address it was created from (access tokens are stored only as a one-way hash). We keep this record for as long as your account exists; when you revoke a connection, it stops working and the record is kept, marked as revoked, as part of your account’s security history;
- a log of each tool the application used (tool name, account, workspace, project, time, duration and outcome; never the values sent or the results), for 30 days;
- security records of connection approvals, refused requests and changes made by AI applications, including the IP address where available, for 180 days;
- a snapshot of what each change made by an AI application replaced, so that you can undo it, for 7 days.
Your choices and rights. You can revoke a connection at any time, and the rights described in this policy apply to this data. To exercise them, use our contact form. Technical details for developers: AI connections: privacy and data handling.