Skip to content

Privacy Policy

Effective Date: October 25, 2026

Your privacy is critically important to us. At Zimple (operated by SoloTechAI e.U.), we have a few fundamental principles:

  • We are thoughtful about the personal information we ask you to provide and the information we collect about you through our services.
  • We store personal information for only as long as we have a reason to keep it.
  • We believe in empowering you to control your own data. We utilize privacy-conscious analytics and error tracking solutions (including self-hosted infrastructure where appropriate) specifically to prevent third-party advertising networks from harvesting your data.
  • We aim for full transparency on how we gather, use, and share your personal information.

1. Who We Are

We are the team behind Zimple Tech, offering products including the Zimple Home App, Zimple Money, Zimple Note, and Zimple Hub. Throughout this Privacy Policy we’ll refer to our websites, mobile applications, and other products and services collectively as “Services.” The data controller responsible for your personal information is SoloTechAI e.U., based in Austria.

2. Information We Collect and Our Legal Basis

To ensure maximum transparency and compliance with the GDPR, here is exactly what data we collect, depending on which specific Zimple app you use, and our legal justification for doing so.

Your Zimple Account (Cross-App)

  • Account Credentials: Regardless of which app you use to sign in (Zimple Home, Money, Note or Hub), we collect your name, your email address, a securely hashed password, and, if you sign in with Google or Apple, the basic profile information that provider shares with us (your name, email address and, for Google, your profile picture).
    Legal Basis: Performance of a Contract (Article 6(1)(b) GDPR).
  • Communications: Any support emails, in-app feedback or problem reports, and contact form submissions.
    Legal Basis: Legitimate Interests (Article 6(1)(f) GDPR) to provide customer support.
  • Web contract confirmations: For Zimple Home web purchases and trial signups, we save the plan and allowances, checkout consent wording and terms supplied with the purchase. After successful checkout we add the receipt name and email, price, tax, discount, trial and renewal details and send a complete contract copy through Resend. The saved message and delivery status let us retry failed delivery without changing the contract copy. Successful delivery snapshots are removed 90 days after provider acceptance, within one additional day for cleanup; abandoned checkout and test records are removed after 30 days, within one additional day. Unresolved delivery failures are retained for review. Account deletion removes these operational copies; they are included in your account data export without internal delivery identifiers. Your email copy and payment-provider or statutory accounting records have separate retention.
    Legal Basis: Performance of a Contract (Article 6(1)(b) GDPR) and Legal Obligation (Article 6(1)(c) GDPR).
  • Withdrawal requests: If you use our online withdrawal form, we process your name, email address and the purchase details you provide. We send your declaration and its receipt date and time to you and our support mailbox through Resend, so we can handle your request and document it. We save the original declaration, receipt timestamp, reference and delivery status in our database before attempting email delivery, so a restart or email outage does not lose your request. Failed deliveries are retried automatically and overdue requests are flagged for review. After the email provider accepts the receipt, this operational record is kept for 90 days and removed by automated cleanup within one additional day. Unresolved delivery records are retained until the delivery issue is resolved. A keyed hash of your network address, used to limit automated abuse, is cleared after 24 hours, within one additional day. These records are independent of your account so account deletion does not interrupt a withdrawal request. We keep the email correspondence as long as needed to resolve the request and meet applicable record-keeping obligations.
    Legal Basis: Performance of a Contract and Legal Obligation (Article 6(1)(c) GDPR).
  • Billing Records: If you buy a plan, which plan you have, whether it is a monthly or yearly subscription or a lifetime purchase, its status and the reference Apple, Google or Stripe gave it, so that we can grant the plan and handle cancellations and refunds. Apple, Google or Stripe process your payment details and maintain their own transaction records. Where accounting or tax law requires us to retain invoice or transaction information, we keep the required records for the applicable statutory period. We do not store your full credit card information.
    Legal Basis: Performance of a Contract; for the records tax law requires us to keep, Legal Obligation (Article 6(1)(c) GDPR).

Zimple Home (Mobile & Web)

iOS waitlist credit bonus: At launch, confirmed, unexpired waitlist members qualify for 100 extra Home AI credits. We match a hash of the normalized email to a verified account email. We retain this hash, eligibility and claim dates, and an account reference separately from the notification list to honor later claims and prevent repeat bonuses. The account reference is removed on account deletion; the hash and claim record remain for these purposes. Withdrawing before launch removes eligibility; withdrawing afterward does not revoke an earned bonus.

iOS launch notification: If you request a launch email, we store your email address, consent version and dates, confirmation status, hashed confirmation/removal tokens, and send counters. Resend delivers the confirmation and requested launch email. You can withdraw using the removal link in your confirmation or launch email; this deletes your enrollment and its launch delivery record. Unconfirmed requests expire after 7 days and confirmed requests after 90 days; daily cleanup can take one additional day. Delivery records include the message, sending status and dates. Test-email addresses and records are removed after 7 days, plus up to one day for cleanup. Campaign settings and administrator attribution are retained to prevent a second launch send; administrator attribution is removed on account deletion. These periods describe our database, not copies in email systems. The list is separate from your Zimple account. Aggregate daily send counters contain no contact details and expire after 7 days, plus up to one day for cleanup. Legal basis: Consent (Article 6(1)(a) GDPR); abuse prevention: legitimate interests (Article 6(1)(f) GDPR).

  • Inventory Data & Uploads: Details about your household items, purchase prices, photos, and warranty PDFs.
    Legal Basis: Performance of a Contract.
  • Device Permissions: With your consent, the mobile app accesses your Camera and Photo Library strictly to allow you to scan items and receipts and to upload media. You have the right to withdraw this consent at any time via your device settings.
    Legal Basis: Consent (Article 6(1)(a) GDPR).
  • Email Import (optional): If you create an import address, the order emails you forward to it are received by our email provider, read by our AI (see Section 3) to find the items in them, and their invoice or receipt attachments are saved with those items. Forwarded emails can mention other people, so please only forward emails you are entitled to share. We keep a log of each forwarded email (sender, import address, subject line and outcome) for 90 days. We process the original email body to extract item details but do not save that body in our inventory database. The 90-day period applies to our log; it does not describe how long our email or AI providers retain their copies. If you approve additional sender addresses, each receives a one-time verification code from us.
    Legal Basis: Performance of a Contract.
  • Household safety: Owners can block an account from their home until they unblock it or the home or blocked account is deleted. When you report a person, item or file, we store your account ID, the reported reference, reason, optional details and handling dates. Reports are private to support and are not shown to household members. Authorized support staff may inspect the reported content to investigate. We send a report-reference alert through Resend, without the report text or files. Reports are removed during daily cleanup 90 days after resolution or 180 days after submission, whichever comes first, or when the reporting account is deleted. Cleanup can take up to one additional day.
    Legal Basis: Legitimate Interests (Article 6(1)(f) GDPR) in investigating abuse and protecting users.
  • Household Sharing (optional): When you share a home, its members can see your name, email address and profile picture, everything stored in that home, and a feed of recent changes that is kept for 90 days. To invite someone, we process the email address you enter in order to send them the invitation. If the owner of a home deletes their account, that home is deleted for all of its members; items you added to someone else’s home stay there, without your name, after you delete your own account.
    Legal Basis: Performance of a Contract; for the people you invite, Legitimate Interests (Article 6(1)(f) GDPR) in delivering an invitation you asked us to send.
  • Push Notifications: If you allow notifications, we store a push token for your device and use it for warranty reminders, import results and household updates. You can turn them off in the app or in your device settings at any time.
    Legal Basis: Consent (Article 6(1)(a) GDPR).

Zimple Money

  • Financial Data: What you enter in the app: your accounts and their balances and interest rates, your transactions, your savings pots and payday rules, your recurring income and bills, and your net worth over time (which, if you use Zimple Home, includes the purchase prices of your items there). Zimple Money never connects to your bank; it only knows what you type, say or import. So that the app works without a connection, it keeps your recent accounts, pots and transactions on your phone for up to seven days and holds transactions saved offline until it is back online; signing out removes both.
    Legal Basis: Performance of a Contract.
  • Your Goal (optional): When you set up Zimple Money, it asks what matters most to you right now and offers five fixed answers (save for something, see where my money goes, stay ahead of bills, grow what I have, or just looking). The answer you tap is stored with your account so that every device shows the same first steps and tile order; it hides nothing, and you can change it any time in the app’s Settings. It is not shared, except that when you explicitly ask the app for AI highlights the fixed answer (never your own words) is sent with those facts so the highlights fit your goal (see section 3). It is included in “Download my data” and deleted with your account.
    Legal Basis: Performance of a Contract.
  • Statement Import (optional): When you import a bank statement (a CSV file, or a PDF on the web), the file is read on your device and is never uploaded. Only the rows you confirm are stored as transactions, together with the file’s name, size, type, statement period and row count, so that importing the same statement twice is recognised.
    Legal Basis: Performance of a Contract.
  • Microphone & Speech (optional): With your consent, the app uses your Microphone only while you use “Speak” on the add-transaction screen. Your phone’s own speech service (Apple’s on iPhone, Google’s on Android) turns what you say into text — on the device where the phone supports it, otherwise through that provider’s service under its own privacy terms. We receive neither the audio nor the text: the words are turned into a transaction on your phone, and only that transaction reaches us. You can withdraw this consent at any time in your device settings.
    Legal Basis: Consent (Article 6(1)(a) GDPR).
  • Capture Links & Shortcuts (optional): If you set up the iOS Shortcuts automation or open a capture link, the amount and merchant that the link carries are entered like a typed transaction. The Shortcuts app and Apple Pay are Apple’s services; we receive only what the link contains.
    Legal Basis: Performance of a Contract.

Zimple Note

  • Notes & Recordings (optional sync): Zimple Note keeps your notes and voice recordings on your phone. Only if you sign in and turn on sync do we store a copy of that library on our servers: your notes (title, text, collection, whether they are pinned or in the trash), the transcripts you made, and your recordings as audio files, so your other devices can show them. A note you delete permanently is kept as an empty marker for up to 30 days so your other devices learn about the deletion, then removed.
    Legal Basis: Performance of a Contract.
  • Device Permissions: With your consent, the app uses your Microphone only while you record a note. Recordings stay on your phone unless sync is on. You can withdraw this consent at any time via your device settings.
    Legal Basis: Consent (Article 6(1)(a) GDPR).
  • Transcription & Appointment Search (optional): When you ask for a transcript of a recording, or for the appointments mentioned in a note, that one recording or note text is sent to our AI provider (see Section 3) and the result is returned to your phone; we keep none of it on our servers. To keep these features within their allowance we count how many seconds you transcribed this month and how many appointment searches you ran today, and delete those counts after 92 days.
    Legal Basis: Performance of a Contract.

Information Collected Automatically (All Apps)

  • Device & Log Information: Our servers log each request (time, path, result and, when you are signed in, your account ID), and every sign-in session stores the IP address and the browser or device type it came from, to keep accounts secure. Error and performance reports from our servers and mobile apps go to Sentry, an error-monitoring service in the United States; where the web app reports errors, it sends them to a GlitchTip instance on our own servers. Reports from the apps carry your account ID and email address only if you have turned on “Share usage data”. With it off, the app discards its reports, except that a crash of the app itself may still be reported, without any account information. Reports from our servers carry your account ID.
    Legal Basis: Legitimate Interests (Article 6(1)(f) GDPR) to maintain the security and stability of our apps.
  • Abuse Prevention: To protect the service from abuse, we look at how accounts use it — for example the number and pace of AI requests, sign-ups from the same address, and storage use — based on our legitimate interest (Art. 6(1)(f) GDPR). We don’t analyse the content of your items for this.
  • In-App Usage Analytics (optional): Only if you turn on Profile → Privacy → “Share usage data”, which is off by default, the mobile apps record product events to help us understand which features are actually useful and to measure our own marketing — for example that a sign-in happened, an item was added, a scan was run, or the subscription screen was opened. Each event carries your account ID, a random identifier generated for your installation (not your device’s advertising ID), the app version and platform, and — if you installed the app through one of our marketing links — a campaign tag. These events are stored exclusively on our own servers: no third-party analytics provider is involved, and nothing is ever shared with advertising networks. Analytics events are automatically deleted after 13 months, or from our live systems when account deletion is completed (see Section 6 for backups). You can turn the switch off again at any time; it takes effect immediately and nothing further is recorded.
    Legal Basis: Consent (Article 6(1)(a) GDPR), which you can withdraw at any time with the same switch.
  • Website Statistics: On zimple.tech and in our web apps (such as home.zimple.tech) we count page views and clicks on our download buttons with Umami, an open-source statistics tool that runs on our own servers at stats.zimple.tech; no third-party analytics provider receives this data. It sets no cookies and stores nothing in your browser. For each page view it records the page address, the referring website, the browser, operating system, device type, screen size and language, and the country, region and city derived from your IP address. In the web apps, the page address is reduced before it leaves your browser: search terms, record identifiers and invitation links are removed, and the page title is not sent. Your IP address itself is not stored: together with your browser’s user agent and a secret value that changes every day, it is turned into a one-way hash, so that visits on the same day count as one visitor, but you cannot be recognised on another day or on another of our sites. These statistics are not linked to your Zimple account and do not depend on the in-app “Share usage data” setting. If your browser sends a Do Not Track signal, nothing is recorded. The statistics are deleted after 13 months.
    Legal Basis: Legitimate Interests (Article 6(1)(f) GDPR) in understanding how our websites are used and which of our marketing works. You can object at any time by turning on Do Not Track in your browser or by writing to privacy@zimple.tech.

3. How We Process Data with AI (Vertex AI)

To provide advanced features, such as recognizing the items in a photo or receipt, reading an order email you forwarded, matching the columns of a spreadsheet you import, looking up a product’s usual warranty, transcribing a voice note or finding the appointments mentioned in a note, we use Google Cloud’s Vertex AI (Gemini models), operated in the United States.

  • Depending on the feature, we send the photos you scan; the text and attachments of an order email you forwarded; the header row and the first rows of a CSV file you import; a product’s brand, model and category together with your country; or, in Zimple Note, a voice recording you asked to transcribe or the text of a note you asked to search for appointments, together with your time zone. For warranty look-ups the AI may consult Google Search about that product.
  • The content is securely transmitted to Vertex AI solely to be analyzed and to return the result to your Zimple account. Apart from what the content itself contains, we do not add your name, email address or account ID to these requests.
  • Under Google Cloud’s strict enterprise privacy terms, your data and images are NOT used to train Google’s foundational AI models. You can verify Google’s official commitment to this policy in Google Cloud’s generative AI data governance documentation.
  • Provider retention: The training restriction does not mean that Google retains nothing. Our project uses memory-only AI caching, which expires within 24 hours. For warranty searches, Google may retain search queries derived from your request and related context for up to three days. Where Google’s abuse-monitoring terms apply, flagged prompts may be retained for up to 90 days and reviewed by authorized staff. Application diagnostic logs in our Google Cloud project are retained for 30 days; Google’s required audit logs have a separate 400-day retention period. These periods are separate from the inventory data and backups described elsewhere in this policy.
  • Legal Basis: Performance of a Contract (Article 6(1)(b) GDPR). Each of these features runs only when you use it.

4. How and Why We Share Information

We do not sell your private personal information. We share information about you in limited circumstances with service providers who need the information to provide their services to us:

  • Hosting & Storage: Our primary servers are hosted by DigitalOcean, and we use Cloudflare R2 to securely store your uploaded images and media files, and the voice recordings you chose to sync.
  • Email: We use Resend to send system emails (such as sign-in codes, household invitations and internal subscription notifications) and to receive the order emails you forward to your import address, and Zoho for customer support communications. Internal subscription notifications include your name, email address, plan, payment provider, billing interval and subscription status so we can administer the service. Our database keeps the notification and its delivery record for 90 days, or until your account is deleted. This period applies to our database record, not copies held by email providers or in the operational mailbox.
  • Payments: Transactions are processed securely through the Apple App Store, the Google Play Store, or Stripe (for web transactions). We do not store your full credit card information; the checkout and billing pages for web purchases are hosted by Stripe and subject to Stripe’s own privacy policy.
  • AI Processing: Google Cloud (as described above).
  • Error Monitoring: Sentry (as described in Section 2).
  • Push Notifications & App Updates: Expo delivers our push notifications to Apple’s and Google’s notification services and serves updates to the mobile apps. Like any download, an update check reveals your IP address and app version to Expo.
  • Sign-in: If you sign in with Google or Apple, that provider learns that you use Zimple. Some versions of the mobile app also register your account ID, and nothing else, with Google’s Firebase Authentication.

5. International Data Transfers & Hosting

Our primary databases and servers are hosted by DigitalOcean in the United States. Uploaded files are stored with Cloudflare R2; our production bucket is located in Eastern North America and is not restricted to a single-country storage jurisdiction. We do not promise US-only or EU-only storage for those files. The providers described in Section 4 may also process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA to a country that has not been recognised as providing an adequate level of protection, we use an applicable transfer mechanism, such as the European Commission’s Standard Contractual Clauses. Where applicable, we may rely on an adequacy decision, including the EU-U.S. Data Privacy Framework for participating U.S. organisations. The mechanism depends on the recipient and the transfer; the Framework does not cover every U.S. provider. You can contact privacy@zimple.tech for information about the safeguards applicable to a provider or to request a copy of them.

6. Data Retention

We generally discard information about you when it is no longer needed for the purposes for which we collect and use it.

  • Account deletion: When account deletion is completed, we remove your profile, the homes you own with everything in them, your files and the records tied to your account from our live systems, subject to the retention exceptions described here. We retain a one-way cryptographic hash of your email address, which does not let us contact you, to prevent abuse of free trials (for 90 days) and of welcome credits (for 24 months) — Legal Basis: Legitimate Interests (Article 6(1)(f) GDPR). We also retain minimal audit entries (such as that an account was deleted, or a subscription reference) without your name or email address, and any invoice or transaction records we are legally required to keep for the applicable statutory period — Legal Basis: Legal Obligation (Article 6(1)(c) GDPR). Payment records held by Apple, Google or Stripe are kept by them as the law requires. Backup retention is described below.
  • External deletion retries: If a storage or identity provider is temporarily unavailable, external cleanup can remain pending after your account or app data is removed from our database. We retain a minimal cleanup record containing the file reference or account identifier, destination, attempt dates and status until deletion succeeds. Cleanup is attempted promptly and retried automatically with backoff; overdue work is flagged for investigation. Successful cleanup records are removed. These records contain no file contents or provider error messages. Legal Basis: Legal Obligation (Article 6(1)(c) GDPR) in fulfilling deletion requests, and Legitimate Interests (Article 6(1)(f) GDPR) in reliably enforcing retention.
  • Fixed periods: items in the trash are deleted after 30 days; notifications after 30 days; the log of forwarded emails and the household activity feed after 90 days; household invitations and join links 90 days after they expire; expired sign-in sessions and email codes within two days; the empty marker of a permanently deleted Zimple Note note after 30 days, and its transcription and appointment-search counts after 92 days; in-app usage analytics after 13 months, regardless of account status; website statistics after 13 months; and a “Download my data” file within about a day of its creation.
  • Backups: to protect against accidental data loss, backups of our databases are kept for up to 30 days before being permanently destroyed.
  • Backup retention correction, October 20, 2026: we shortened local backup retention after finding that older database copies inside weekly recovery images could remain longer than our stated 30-day limit, for up to about 45 days in total. New backups now follow the shorter schedule. Existing recovery images from before this correction are scheduled to expire no later than November 11, 2026. They are retained for recovery only and are not used to restore deleted accounts to active service.

7. Your Privacy Rights

For US Users (CCPA and State Privacy Laws)

If you are a resident of California, Virginia, Colorado, or other US states with applicable privacy laws, you have specific rights regarding your personal information:

  • Right to Know & Access: You can request details about the personal information we collect and how we use it.
  • Right to Delete: You can request the deletion of your personal information.
  • Right to Opt-Out of Sales: We do not sell your personal information. If this ever changes, you will have the right to opt out.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Rights under the GDPR and applicable data protection law

As an Austrian business, we process personal data under the GDPR. Subject to its conditions and exceptions, Articles 15 to 21 GDPR give you the following rights. Other applicable data protection laws, including UK law where applicable, may give you additional rights:

  • Right to Access: Request a copy of your personal data.
  • Right to Rectification or Erasure: Request correction of inaccurate data or deletion of your data (the “right to be forgotten”).
  • Right to Object & Restrict: Where we rely on legitimate interests, you have the right to object to that processing on grounds relating to your particular situation, as provided by Article 21 GDPR. You may also request restriction of processing in the circumstances provided by Article 18 GDPR.
  • Right to Data Portability: Request a machine-readable copy of your data to transfer to another service.

If you believe that the processing of your data violates data protection law or that your data protection claims have been violated in any other way, you can lodge a complaint with the competent supervisory authority. In Austria, this is the:

Austrian Data Protection Authority (DSB)
Barichgasse 40-42
1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at

You can exercise most of these rights yourself in the settings of the Zimple Apps: download a copy of what we store about you, correct your profile and your items, switch the sharing of usage data on or off, and delete your account. For anything else, contact us at privacy@zimple.tech; we answer within one month.

8. Cookies and Tracking Technologies

Zimple respects your privacy and is committed to minimal tracking. We only use Strictly Necessary Cookies (such as session cookies and CSRF tokens). These are technically essential for our Services to function securely (for example, keeping you logged in and preventing unauthorized cross-site requests). In addition, the sign-in page remembers which sign-in method you last used (a cookie kept for 30 days, so that you don’t accidentally create a second account with a different method), and the web app keeps your display preferences, such as the light or dark theme and hints you have dismissed, in your browser’s local storage. None of this is used to track you, and none of it is shared with anyone.

We do not use cookies for advertising or cross-site tracking. Our websites do not run advertising scripts or third-party analytics. The only statistics script is the cookieless one described in Section 2 (“Website Statistics”), served from our own server; it stores nothing on your device. The in-app usage analytics described in Section 2 rely on a single random installation identifier stored inside the app, which is created only once you turn on the in-app “Share usage data” setting.

9. Children’s Privacy

Our Services are not directed to children under 16, and our Terms require you to be at least 16 years old to create an account or use them. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete it promptly. If you believe this has happened, contact privacy@zimple.tech.

10. Contact Us

If you have a question about this Privacy Policy, or you would like to contact us about any of your privacy rights, please reach out to us at:

Email: privacy@zimple.tech
Data Controller:
SoloTechAI e.U.
Owner: Yijie Liu
Hirschstettner Straße 19 / Stiege P / P0406
1220 Vienna
Austria