Privacy Policy

For the purposes of the EU General Data Protection Regulation (GDPR), Simuka acts as a data controller for personal data we collect directly and as a data processor for personal data contained within client engagement material.

Our default approach is to hold deal data in our cloud systems only for as long as it is operationally necessary, and to purge it on the windows below.

• Client deal data: permanently deleted from our cloud systems within 7 days of artifact delivery.
• Email correspondence: retained for 30 days post-engagement, then deleted.
• Intake form submissions: retained for 90 days if unconverted, then deleted.

The Deal Director may keep limited internal working notes after the cloud purge. These are held offline on a local device only. They are never stored on our cloud servers, never used to train any model, and never shared with third parties.

We apply technical and organisational measures appropriate to the sensitivity of the data we process, including encryption at rest (AES-256) and in transit (TLS 1.2+).

We use a small number of infrastructure providers to deliver the service: EU-based cloud hosting and database providers, an EU-region email provider, and Anthropic (United States) for AI-assisted analysis, engaged under standard contractual clauses. We do not sell personal data and no client material is used to train models.