SimForge Privacy Policy

Account information. When you create an account we collect your email address, your name, and a password (stored only as a salted hash). If you sign in with Google or GitHub, we receive the name, email address, and profile image the provider makes available under the openid, email, and profile scopes; we do not request access to your files, repositories, contacts, or calendar.

Session and device information. To keep you signed in and let you review active sessions, we record a session identifier, the device label you choose (for SimForge Studio), your browser or application user agent, an approximate IP address, and sign-in timestamps.

Content you provide. Scenarios, datasets, uploaded assets, project settings, and any other material you submit to the Services (Customer Inputs) are stored so that we can provide the Services to you and your workspace.

Billing information. If you purchase a subscription, payment is processed by Stripe. We receive your billing name, address, the last four digits of your card, and transaction records; full card numbers never reach our servers.

Usage and diagnostic data. We log requests to the Services, feature usage, render and evaluation job metadata, errors, and performance measurements to operate, secure, and improve the Services.

We use the information we collect to provide, maintain, and secure the Services; authenticate you and your devices; process payments and manage subscriptions; deliver transactional email such as verification codes, password resets, and workspace invitations; respond to support requests; monitor and improve performance and reliability; and comply with legal obligations.

We do not sell personal information, and we do not use Customer Inputs to train models that are made available to other customers.

We share information only with service providers who process it on our behalf under contractual confidentiality obligations, including cloud infrastructure and storage providers, Stripe for payments, and transactional email providers; with members of a workspace you belong to, as needed for collaboration; when required by law, subpoena, or legal process; to protect the rights, property, or safety of SimForge, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

Sign-in with Google or GitHub is optional. When you choose it, the provider authenticates you and shares the basic profile information described above. SimForge's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect a linked provider or delete your account at any time from your account settings.

We use strictly necessary cookies to maintain your signed-in session and protect against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies.

Analytics. We use Vercel Web Analytics, which does not use cookies, to count page views on our public website and in the hosted SimForge Studio, and clicks on key links of our public website. Identifiers such as workspace, scenario and render IDs are removed from page addresses before they are recorded, and query strings are never recorded.

Business information we derive and record

• Your organisation, from your email address. When you create an account, we record the domain of your email address and whether it belongs to a free or disposable mail provider. A subdomain is reduced to the organisation's domain, so an address at eng.example.com is recorded as example.com. SimForge staff may label a domain with the organisation's name. We use this to understand which organisations use SimForge. We collect nothing new for this: it comes from the email address you sign up with.
• How you found us. When you create an account, we record:
  • the campaign tags in the link that brought you to our website (utm_source, utm_medium and utm_campaign);
  • the domain of the website that linked to us (never the full address of that page);
  • the path of the first page you viewed on our website (without any query string).

  Our website keeps these in your browser's session storage, which is cleared when you close the tab, and sends them only to our own servers, when you create an account. We use no third-party advertising or analytics trackers for this.

• Installer downloads. When the SimForge CLI installer or the CLI itself is downloaded, we count the download per day, by CLI version, operating system, processor architecture and type of client (for example curl or a web browser). These come from the download's name and the request's user agent. The counts are not linked to any account, and we do not store the IP address of the request.
• From sign-up to active use. We use records we already keep to measure how accounts progress from sign-up to active use, in total and per organisation: when you sign in from the CLI, accept the runtime licence, install the runtime, and when your runtime first reports usage.

The email domain and sign-up information are kept with your account and deleted when you delete it. The download counts contain no personal data.

We retain account information for as long as your account is active. Sessions expire automatically and are removed after expiry. When you delete your account, we delete or de-identify your personal information within 30 days, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Backups are rotated on a fixed schedule and may retain copies for a limited additional period.

We implement administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, encrypted storage of credentials, short-lived access tokens with rotating refresh tokens for desktop sessions, and access controls limited to personnel who need access to operate the Services. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. You can update your profile, change your password, review and revoke device sessions, and delete your account from your account settings. For any other request, contact us using the details in Section 12.

SimForge is based in the United States and the Services are hosted there. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the revised policy on this page with a new effective date and, for material changes, notify you by email or through the Services before the changes take effect.

If you have questions about this Privacy Policy or our data practices, please contact SimForge, Inc. at contact@simforge.ai, or by mail at 1301 S 46th St Building 196, Richmond, CA 94804.