Effective 12 September 2026
Privacy Notice
How Simodyn Ltd handles personal information across the ApplyAIs website, licence portal, desktop products, support, and billing.
1. Controller and contact
Simodyn Ltd (company number SC861258), trading as ApplyAIs, is the controller for the personal information described here. Our registered office is Summit House, 4–5 Mitchell Street, Edinburgh, United Kingdom, EH6 7BD. Email privacy requests to support@applyais.com.
2. Information we handle
| Category | Examples | Why we use it |
|---|---|---|
| Account and access | Email address, user and organisation identifiers, role, seat status, one-time sign-in records, session and licence-token claims | Authenticate users, issue licences, enforce plans and seats, and secure the service |
| Subscription and transaction | Plan, seat quantity, currency, billing interval, trial and renewal dates, Stripe customer/subscription references, payment status | Create and administer subscriptions, reconcile payment, invoice, cancel, and support customers |
| Reusable organisation information | Applicant name and legal details, address, website, activities, Markdown sections, document-source labels and path templates | Provide organisation reuse and local snapshot configuration selected by your account |
| Service and device records | IP address, request time, route, browser/user agent, security and error logs, product/version details supplied in support | Deliver, protect, diagnose, and improve reliability of the service |
| Communications | Support email, complaint or privacy request, and diagnostic details you choose to send | Respond to you and maintain an appropriate support record |
Stripe collects payment-card, billing, fraud-prevention, and tax information directly under its own privacy terms. Simodyn does not receive or store your full card number.
3. Local and hosted data boundaries
Grant application documents, extracted Markdown answers, local answer snapshots, and documents selected from organisation source folders are processed and stored on your computer during the normal ApplyAIs desktop or VS Code workflow. Path templates may be stored in the hosted portal, but the extension expands them locally. Resolved paths, per-machine folder selections, and the bytes of documents copied into a local project snapshot are not sent to ApplyAIs services by that workflow.
The extension connects to ApplyAIs endpoints for licence validation, published grant templates, and reusable organisation metadata. It sends the licence token needed to authorize those requests and downloads the selected hosted records. If you use a separate AI agent, extension, cloud-sync folder, source-control host, or other integration with the workspace, that provider may process local content under its own terms. Review its settings before granting access to confidential material.
4. Legal bases
We process account, licence, subscription, seat, and requested organisation data to perform our contract or take steps you request before a contract. We use necessary service logs, fraud prevention, security, and limited service administration for our legitimate interests in running a reliable and secure product. We retain transaction and compliance records where required by law. Where law requires consent for a specific optional activity, we will ask before it begins and you may withdraw consent.
5. Service providers, subprocessors, and locations
| Provider | Purpose and data | Primary location / transfer position |
|---|---|---|
| Microsoft Azure | Website hosting, PostgreSQL database, security/operational logs, backups, secret management, and release downloads | Core production resources are deployed in UK South. Microsoft may provide support or ancillary processing from other locations under its contractual safeguards. |
| Stripe | Checkout, payment method, subscription, invoice, tax/billing and fraud-prevention processing | Stripe processes globally, including in the EEA and United States, using its Data Processing Agreement and transfer safeguards. |
| Zoho Corporation / ZeptoMail | Delivery of magic links, invitations, and service emails, including recipient address and message content | Processed in the data centre and support locations associated with Simodyn's ZeptoMail service, which may be outside the UK; applicable contractual transfer safeguards are used. |
| Cloudflare | Domain name service and, if enabled for the production domain, edge security and delivery involving IP and request metadata | Global network; international transfers are protected under Cloudflare's data-processing terms. |
Providers may use their own subprocessors. We disclose information to professional advisers, regulators, courts, or law enforcement where necessary and lawful, and to a buyer or successor if the business is reorganised or sold subject to appropriate protection. We do not sell personal information.
6. Retention
Account, seat, subscription, and hosted organisation information is kept while the account or service relationship is active. You can permanently delete individual reusable organisation records in the portal. For account closure or a full export/deletion request, contact support.
After closure, we retain only information reasonably needed for legal, tax, accounting, fraud-prevention, dispute, and security purposes, then delete or anonymise it. Transaction and invoice records may be retained for up to seven years. Production database backups are retained for seven days and expire through the backup cycle; operational logs are configured for 30 days. Support and complaint records are normally retained for up to 24 months after the matter closes unless a longer period is needed for a legal claim or obligation.
Local workspace files and locally stored extension data are controlled by you and are not deleted when a hosted account closes. Remove them through your operating system, VS Code/ApplyAIs storage, cloud-sync service, or source-control provider as applicable.
7. Cookies and analytics
The website currently uses only essential first-party cookies:
- sessionid maintains an authenticated portal session;
- csrftoken protects forms against cross-site request forgery; and
- temporary message and security state may be associated with the server-side session.
These cookies are required to provide a secure service and are not used for advertising or cross-site tracking. We do not currently load non-essential analytics, advertising pixels, or social-media tracking on the ApplyAIs website. Because there are no optional cookies to choose, we do not show a consent banner. If optional analytics or similar technology is introduced, this notice and the consent controls will be updated before it is enabled.
You can block cookies in your browser, but blocking essential cookies will prevent sign-in and portal features from working.
8. Security
We use HTTPS, secure session and CSRF cookies in production, access controls, private database networking, restricted production identities, managed secret storage, and signed short-lived licence tokens. No internet service is completely secure, so protect your email account and licence tokens and tell us promptly if you suspect unauthorized access.
9. Your rights
Depending on applicable law, you may ask for access, correction, deletion, restriction, objection, or portability of your personal information, and may withdraw consent where processing relies on it. Email support@applyais.com. We may need to verify your identity and authority for an organisation account.
You may complain to the UK Information Commissioner's Office or your local supervisory authority. We would appreciate the opportunity to address your concern first.
10. Changes
We may update this notice as the service or law changes. We will post the new effective date here and give reasonable notice of material changes where appropriate.