Privacy Policy

This Privacy Policy applies to personal data processed by SimplyBoost through our website, lead capture forms, communication channels, customer onboarding, and related services.

Data controller details: SimplyBoost, 3438 Utrecht, Netherlands. Contact us at hello@simplyboost.io for privacy requests.

We follow a data-minimization approach and collect only the information reasonably needed to respond, qualify leads, and deliver our services.

Depending on your interaction, we may collect:

• Basic contact and identity data: name, public profile name/handle, work email, phone number, company, and message history.
• Website interaction data: page URL, form submission details, event timestamps, browser type, and IP address.
• Channel conversation data from integrations such as WhatsApp, Instagram, and Facebook Messenger (for example message text, date and time, and profile metadata you choose to share on those platforms).
• Service and operational data such as support tickets, onboarding notes, and account-level configuration details.
• Cookie preference and strictly necessary cookie data (see Cookie section and Cookie Policy).

We do not intentionally collect special-category personal data, and we ask users not to share highly sensitive information in routine conversations.

Integration-specific examples:

• Website: form fields you submit (such as name, email, phone), page URL, and timestamp.
• WhatsApp: phone number, profile name, message content, and message timestamps.
• Instagram: public username/display name, direct-message content, and message timestamps.
• Facebook Messenger: public profile name, message content, and message timestamps.

We collect personal data directly and indirectly from:

• Website interactions, including contact forms, demo requests, and chat widgets integrated on your site.
• WhatsApp conversations where our automation is used to respond, qualify, or route inquiries.
• Instagram and Facebook Messenger conversations when those channels are connected for customer engagement or lead capture.
• Emails, calls, and meetings with you or your authorized team.
• Essential infrastructure logs and security telemetry required to keep our services reliable.

We process personal data for legitimate business and legal purposes:

• To provide, configure, operate, and improve our services and automations.
• To respond to inquiries, demos, and customer support requests.
• To enable secure sign-in, account linking, and session management where Google authentication is used.
• To process and route conversations coming from integrated channels such as WhatsApp, Instagram, Facebook, and website widgets.
• To process contracts, invoices, and compliance obligations.
• To monitor platform performance, security, and abuse prevention.
• To send relevant product updates, insights, and marketing messages where lawful.
• To enforce our legal terms and protect business interests.

For individuals in the EEA/UK and similar jurisdictions, we rely on one or more of these legal bases:

• Performance of a contract or pre-contractual steps.
• Legitimate interests, balanced against your privacy rights.
• Consent, where required by law (which you may withdraw).
• Compliance with legal obligations.

We use a consent dialog on our website to let you choose cookie preferences. At present, we primarily use strictly necessary cookies (such as storing your cookie consent choice) and security-related infrastructure signals.

We do not currently rely on advertising cookies for personalized ads on this site. If optional analytics or marketing cookies are introduced in the future, they will be controlled through the same consent mechanism.

We measure page views with Ahrefs Web Analytics, a cookieless script that records the page, the referrer and the country of a visit without storing an identifier in your browser or building a profile of you.

See our Cookie Policy for detailed cookie categories, duration, and controls.

We may share personal data with:

• Trusted vendors and subprocessors (hosting, analytics, CRM, support, payment, and communication tools).
• Platform providers for integrated channels (including Meta services such as WhatsApp, Instagram, and Facebook) when messages are processed through those channels.
• Professional advisers such as legal and accounting partners.
• Authorities or regulators where required by law, court order, or to protect rights and safety.
• A successor entity in case of merger, acquisition, or asset transfer.

We do not sell personal data for money. Where "sale" or "sharing" is legally defined (for example under certain U.S. state laws), you may request to opt out where applicable.

Your personal data may be processed in countries outside your place of residence. Where required, we use appropriate safeguards such as contractual clauses and vendor due diligence to protect transferred personal data.

Sign in with Google. If you sign in with Google, we receive your name, email address and profile picture and use them only to create your account and sign you in. We do not keep a Google access token after sign-in.

Google Calendar. When a customer connects Google Calendar so their assistant can book meetings, we access:

• Free/busy times (calendar.freebusy), to offer visitors open times within the working hours you set. We do not read the titles, descriptions or attendees of your events.
• Events on calendars you own (calendar.events.owned), to create, move or cancel the meetings booked through your assistant. We do not change any other event.
• Your Google email address (userinfo.email), to show which account is connected.

We store the connected email address, Google’s access and refresh tokens (encrypted at rest), your working hours, and for each booking the event ID, time, and the visitor’s name and email address.

SimplyBoost’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI or machine-learning models, and no person at SimplyBoost reads it unless you ask us to, it is needed for security, or the law requires it.

Disconnecting Google Calendar in SimplyBoost revokes our access and deletes the stored tokens. You can also remove access in your Google account.

When Meta integrations are enabled, we process message and profile metadata made available through WhatsApp, Instagram, and Facebook APIs to support lead capture, support automation, and conversation routing.

Meta platform data is processed only for service functionality requested by our customers and authorized users. We do not sell this data.

For user data deletion requests related to Meta-connected interactions, use our public data deletion instructions at /data-deletion or contact us at hello@simplyboost.io.

A SimplyBoost customer can connect a Slack workspace so their team handles conversations from Slack. When they do, we process the following Slack data, only to provide this integration:

• Workspace details: the workspace ID and name, the ID of our app in the workspace, the ID of the person who installed it, and the channel chosen for conversations. The app's access token is stored encrypted.
• Channel list: the names of public channels, read when the customer picks a channel. Only the chosen channel is stored.
• Replies: when a team member replies in a thread that SimplyBoost created, we store the reply as part of that conversation, send it to the customer's end user, and show the team member's first name with it. Button clicks in those threads (Resolve, Resume bot) record who clicked.
• Other messages: Slack also sends us other messages in the chosen channel. We do not use or store them; they are discarded on receipt.

SimplyBoost posts to the chosen channel the conversations the customer routes to Slack: the end user's messages, contact details the end user shared (name, email, phone), the reason for a handover, and replies sent from the SimplyBoost dashboard.

We do not sell Slack data or use it for advertising, and we never use Slack data to train AI or large language models. When the customer disconnects Slack in SimplyBoost, we revoke and delete the access token; when the app is removed from the workspace, we delete the token as well. Replies sent from Slack stay in the conversation history until the customer deletes the conversation or their account. To access, export or delete Slack-related data, email hello@simplyboost.io. Workspace admins can also remove the app in Slack at any time. See SimplyBoost for Slack for how the app works.

We retain personal data only as long as needed for the purposes described in this policy, including contractual, operational, legal, accounting, and dispute-resolution requirements.

Retention periods vary by data type and legal obligations. When data is no longer required, we delete or anonymize it.

We implement reasonable technical and organizational safeguards to protect personal data, including access controls, encryption measures where appropriate, monitoring, and secure service provider practices.

No system is completely secure. We encourage secure communication practices when sharing sensitive information.

Depending on your location, you may have rights to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data.
• Restrict or object to certain processing activities.
• Request portability of eligible personal data.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority where applicable.

You can request deletion of your personal data by emailing hello@simplyboost.io with the subject line "Data Deletion Request" and sufficient details to identify your record.

Our deletion process includes:

• Identity verification to prevent unauthorized deletions.
• Review and deletion/anonymization of applicable records across active systems.
• Notification when the request is completed, denied, or requires clarification.

Typical response time is within 30 days, subject to legal and operational constraints. In complex cases, this may be extended where permitted by law.

Data may be retained where required for:

• Legal, regulatory, or tax obligations.
• Security, fraud prevention, and abuse mitigation.
• Establishing, exercising, or defending legal claims.
• Backup systems until secure rotation schedules complete.

A dedicated deletion instructions page is available at /data-deletion.

Our services are not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from children. If you believe a child submitted personal data, contact us so we can take appropriate action.

Our website and communications may include links to external websites, integrations, or services that are not operated by us. Their privacy practices are governed by their own policies, and we encourage you to review those policies before sharing personal data.

We may update this Privacy Policy from time to time. Material updates will be posted on this page with a revised "Last Updated" date and, if required, additional notice.

Privacy requests and inquiries can be sent to hello@simplyboost.io.

Mailing address: SimplyBoost, 3438 Utrecht, Netherlands. Phone: +31 6 44384676.

For related legal terms, visit Contact and Cookie Policy.