Privacy Policy

Who we are

SimEX Pay is a payments platform for small businesses in the UK. We build the point-of-sale, dashboard, QR ordering and accounting tools that merchants use to take card payments. The payments themselves are processed by Stripe.

Our formal legal entity details, and the precise split of data-protection responsibilities between us, our merchants and Stripe, will be confirmed in legal review before launch. We are publishing now, gaps and all, so you can see exactly what we do with your data.

What data we process

We deliberately handle as little personal data as we can. This is the full list of what our platform stores or passes through today:

One thing worth stating plainly: we never receive or store card numbers. Card data goes straight to Stripe, a PCI-DSS Level 1 certified payment processor. There is no card number anywhere in our systems for anyone to lose.

• Account details: your name and email address, managed through Clerk, the service that handles sign-in for us.
• Business details: the information you give us when setting up payments, which we pass to Stripe for onboarding. Identity (know-your-customer) checks are run by Stripe, not by us.
• Transaction records: payment amounts, product line items and tips, plus records of any refunds.
• Accounting data: only if you choose to connect Sage, we sync your transaction records to your Sage account. Never connect Sage, and nothing goes there.
• QR orders: an order placed through a QR menu may carry an optional customer first name and a table label. That is all we ask for.

Why we process it

We use this data for two reasons. First, to run the service: signing you in, showing your sales in the dashboard, taking payments, processing refunds, and syncing to your accounting software if you have connected it.

Second, to meet legal and tax obligations. Transaction records are business records, and UK tax law requires them to be kept.

We do not use your data to build advertising profiles, and we do not process it for anything beyond those two purposes.

Who we share data with

We share data only with the services that make the platform work, our subprocessors:

We do not sell data. To anyone, ever. We have no advertisers, and we have checked the product end to end: there are no advertising or analytics trackers in it.

• Stripe: payment processing, card data, and identity checks.
• Clerk: sign-in and account management.
• Sage: accounting sync, and only if the merchant has connected it.
• Vercel and Railway: the hosting our platform runs on.
• Sentry: error monitoring, so we can find and fix faults.

Your rights under UK GDPR

UK data protection law gives you rights over your personal data, and we intend to honour all of them. You can ask to see the data we hold about you, correct it, erase it, or take it away in a portable format. You can also object to how we process it.

To exercise any of these rights, email info@simuxdefence.com. If you are unhappy with how we handle your data or your request, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

How long we keep data

Transaction records are kept for as long as UK tax law requires. They are business records, and the law sets the floor for how long they must exist.

The precise retention periods for other data, such as account details after an account closes, are still being settled in legal review. Once they are, we will state them here plainly.

Security

The most sensitive data never touches us. Stripe handles all card data and Clerk handles sign-in credentials, so we do not see or store passwords or card numbers.

Where we do hold something sensitive ourselves (the access tokens for the Sage accounting connection), we store it encrypted.

What is not in this draft yet

A finished privacy policy needs sections we cannot honestly write today: our formal legal entity details, governing law, liability, and dispute resolution among them.

They will be completed in legal review before launch. An admitted gap is better than an invented clause.

Changes and how to contact us

This is a draft, so it will change: certainly through legal review, and afterwards whenever the product changes in a way that affects your data. When we update it, we will change the date at the top of this page.

Questions, corrections and requests are genuinely welcome. Email info@simuxdefence.com. Our final contact details will be confirmed before launch.