Privacy Policy

1. Introduction

Simulask.com ("we", "us", "our") is a Simulation-as-a-Service platform operated in the United Kingdom. This Privacy Policy describes how we collect, use, and protect personal data. We are committed to the highest standards of data sovereignty and transparency, particularly regarding our use of Artificial Intelligence.

2. Roles and Responsibilities

• Data Controller: We act as a Controller for the information related to your account (e.g., email, billing).
• Data Processor: We act as a Processor for the data you upload into our simulation engine ("Simulation Inputs"). Our processing is governed by our Terms of Service and this Policy.

3. Data We Collect and Why

We adhere to the principle of Data Minimisation. We only collect:

• Account Information: Name, professional email, and password (encrypted) to provide access to the platform.
• Billing Information: Processed securely via our third-party payment provider (e.g., Stripe). We do not store full credit card details on our servers.
• Technical Data: IP addresses and browser types for security logging and fraud prevention.
• Simulation Inputs: Any data or prompts you provide to generate a simulation.

4. AI Processing & The "No-Training" Guarantee

Our Service utilizes Large Language Model (LLM) wrappers to generate synthetic panels.

• No Model Training: We do not use your proprietary simulation inputs or generated outputs to train our internal models or those of our third-party AI providers.
• Privacy by Design: Data sent to AI providers is transmitted via secure APIs where data retention for training is explicitly disabled.

5. Automated Decision-Making

Under the UK DUA Act 2026, we must disclose automated processing. Simulask provides predictive simulations for research and strategy. Our platform does not make "solely automated decisions" that produce legal or similarly significant effects on individuals. All simulation results are intended to be reviewed and interpreted by a human user.

6. International Data Transfers

While we are a UK-based company, we utilize AI infrastructure located in the United States. These transfers are conducted under the UK-US Data Bridge (the UK Extension to the Data Privacy Framework), ensuring that your data receives a level of protection essentially equivalent to that in the UK.

7. Data Retention

• Retention Period: We retain your account information and simulation data for as long as your account is active. If you choose to close your account, we will retain your data for a period of 60 days to allow for account recovery, after which it is permanently deleted or anonymised, unless we are required to keep it for legal or tax purposes (typically 6 years for billing records).
• Manual Deletion Requests: While we do not currently offer a self-service deletion tool within the dashboard, you may exercise your "Right to Erasure" at any time by emailing privacy@simulask.com. We will process your request and permanently delete your simulation data within 30 days of verification.
• Anonymisation: We may retain "Simulation Metadata" (e.g., the fact that a simulation was run and its high-level accuracy score) indefinitely for our own internal research and product improvement. This data is fully anonymised and cannot be linked back to you or your proprietary inputs.

8. Data Security

We implement industry-standard technical and organisational measures, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.3).
• Strict access controls limited to essential personnel.
• Regular security audits of our AI pipeline.

9. Your Rights

Under the UK GDPR, you have the right to:

• Access the data we hold about you.
• Rectify any inaccuracies.
• Erase your data ("Right to be Forgotten").
• Object to or restrict certain processing activities.

10. Statutory Complaints Process (UK DUA Act 2026)

If you have a concern about how we handle your data, please contact us at privacy@simulask.com. In accordance with our statutory duty:

• We will acknowledge your complaint within 30 days.
• We will conduct a thorough investigation and provide a resolution without undue delay.
• If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

11. Changes to this Policy

We may update this policy to reflect changes in our Service or legal requirements. We will notify you of any material changes via email or through a prominent notice on our platform.