Privacy Policy

This Privacy Policy explains how simplyBrand K.K. ("Company," "we," "us," or "our") collects, uses, discloses, transfers, and protects personal data in connection with simplyBrand AI Visibility, a business service that shows how AI engines mention, recommend, cite, and describe customer brands.

This Privacy Policy is intended to support compliance with applicable privacy laws, including the GDPR, Japan's Act on the Protection of Personal Information ("APPI"), China's Personal Information Protection Law ("PIPL"), Singapore's Personal Data Protection Act ("PDPA"), and other applicable laws.

1. Scope

This Privacy Policy applies to:

visitors to https://simplybrand.ai;

people who used the request form;

customer account users, including free trial and invite trial users;

business contacts who communicate with us;

personal data processed through the Service where we act as a controller or business operator.

Where we process personal data on behalf of a customer as a processor, service provider, or entrusted processor, the applicable Data Processing Agreement ("DPA") governs that processing.

The Service is intended for business use and is not intended for children, consumers, or household use.

2. Product Overview

simplyBrand AI Visibility helps businesses understand how AI engines, including ChatGPT, Claude, Gemini, Perplexity, DeepSeek, Qwen, Doubao, Kimi and GLM, mention, recommend, cite, or characterize their brands.

The Service collects account and setup information, reads a customer's public website, sends prompts to third-party AI engines, stores prompts, AI answers, cited source domains, metrics and reports, and produces visibility scores and recommendations.

3. Personal Data We Collect

3.1 Account Data

email address, or a mainland China mobile number (+86) used for SMS sign-in codes;

name and basic profile from Google if you sign in with Google;

name, company and contact details if you provide them;

language, time zone and notification choices;

sign-in, session and security records.

3.2 Setup Data

brand name, website URL, market, language;

AI engines, topics, prompts and competitors.

Some of this information may not be personal data by itself, but it may become personal data when associated with an identifiable user, sole proprietor, creator, or small business.

3.3 Website and Usage Data

pages viewed, actions in the app, timestamps and referring pages;

approximate location from IP address, and the country used to show prices;

device, browser and operating system information;

security logs and diagnostic logs.

We use Cloudflare Web Analytics in a cookieless manner for basic website analytics.

3.4 Results

prompts sent to AI engines and the answers received;

cited source domains;

content read from public websites;

computed metrics, reports, scores and recommendations.

Customers should not submit sensitive personal data, regulated health data, government identifiers, children's data, financial account data, or other highly regulated data unless we have expressly agreed in writing.

3.5 Payment Data

Payments are made on the payment page of Stripe. We receive the plan, status, amount, currency, country and invoice details, and the last digits and type of the card where shown. We do not receive or store full card numbers, Alipay or WeChat Pay credentials.

3.6 Messages and Request Form

support messages and feedback, including an optional reason for leaving;

email address, optional brand website, time of submission and an abuse-prevention counter from the request form.

4. Sources of Personal Data

We collect personal data from:

you directly;

your employer or organization;

customer users who configure the Service;

public websites submitted for monitoring;

AI engines and third-party APIs queried by the Service;

service providers that help us operate, secure, analyze, and communicate about the Service.

5. How We Use Personal Data

We use personal data to:

provide, operate, maintain, and secure the Service;

process access requests, free trials and invite trials;

take payments, issue receipts and manage plans;

create and manage accounts;

authenticate users and maintain sessions;

crawl or analyze submitted public websites;

generate prompts and query AI engines;

store AI answers, citations, evidence, metrics, and reports;

deliver dashboards, notifications and service emails;

respond to support requests and customer communications;

improve product quality, reliability, and usability;

detect, prevent, and investigate abuse, fraud, security incidents, and unlawful activity;

comply with legal obligations;

enforce our Terms of Service and other agreements.

We do not sell personal data. We do not use advertising or cross-site tracking cookies.

6. Legal Bases Under GDPR

Where GDPR or similar laws apply, we rely on the following legal bases:

Contract: to provide the Service, manage accounts, process customer configurations, and respond to support requests.

Legitimate interests: to secure, improve, analyze, and operate the Service; prevent abuse; communicate with business contacts; and conduct B2B product development.

Consent: where required for optional communications, non-essential cookies or similar technologies, or specific jurisdictional requirements.

Legal obligation: to comply with applicable law, legal process, tax, accounting, and compliance obligations.

7. APPI, PIPL, PDPA, and Other Local Laws

simplyBrand K.K. is a Japanese company, and the APPI is our main privacy law. We process personal information within the stated purposes of use and implement security controls appropriate to the nature of the information.

Where China PIPL applies, processing may require separate consent, cross-border transfer mechanisms, personal information protection impact assessments, local representative details, standard contracts, certification, security assessment, or local storage depending on the circumstances.

Where Singapore PDPA applies, we process personal data for notified purposes, use reasonable protection measures, and provide access and correction rights as required by law.

Other APAC jurisdictions may require additional notices, consent wording, transfer terms, or data subject procedures.

8. Third Parties and Service Providers

We use these providers to operate the Service (as of 2026-11-01):

We may also disclose personal data:

to comply with law or legal process;

to protect rights, safety, security, and integrity;

in connection with a merger, acquisition, financing, reorganization, or sale of assets;

with your instructions or consent.

9. AI Engine Processing

The Service sends prompts to third-party AI engines. Prompts can contain your brand name, market, topics and competitors. For setup and analysis, the Service also sends content from your public website and the AI answers to AI providers. We store the prompts sent, answers received, and cited source domains to show results.

We do not send your account email, phone number or payment data to AI engines.

During a free trial or an invite trial, Claude is not used as an AI engine; it starts with your paid plan. Anthropic models can still be used for setup and analysis.

Customers should write topics and prompts in a way that avoids unnecessary personal data. The Service is not intended for sensitive personal data or unlawful profiling.

AI engines and providers may process prompts and responses according to their own terms, privacy policies, retention settings, and security practices.

10. International Transfers

The application and its database are hosted on Fly.io in Tokyo, Japan. Our service providers may process personal data in Japan, the United States, the European Economic Area, mainland China, or other jurisdictions, as listed in section 8. Provision of personal data to third parties in foreign countries, including mainland China, follows the APPI rules on provision to third parties in foreign countries.

Where required, we use appropriate transfer safeguards, which may include data processing agreements, contractual protections, consent, or other lawful mechanisms.

11. Retention

The same periods apply when a plan or trial ends for any reason: cancellation, a failed renewal, or a trial that ends without payment. A project you do not pick when you return follows the same dates, counted from the end of the plan it belonged to.

We send one reminder email 7 days before results are deleted. If you return within 30 days and keep a project, its results stay. If you return within 365 days, its setup is restored, new first results are prepared and earlier results are not restored.

Deleting your account. You can delete your account in Settings after any active plan or card trial has ended. Your account, projects and results are then deleted at once, except billing records, the Stripe customer record, cost records, the security log, events that do not name you, and backups until they are replaced.

You can also ask us to delete your data earlier by writing to support@simplybrand.ai, subject to what the law requires us to keep.

12. Security

We use encrypted connections (HTTPS), sign-in by one-time code or Google, and access limits on production systems.

No method of transmission or storage is completely secure. If you believe your account or data has been compromised, contact us at support@simplybrand.ai.

13. Cookies and Analytics

We use essential cookies only: a sign-in session cookie and short-lived security cookies. We do not use advertising cookies or cross-site tracking cookies.

We use Cloudflare Web Analytics in a cookieless manner to understand website performance and basic usage. For more information, see our Cookie & Consent Notice.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

access personal data;

correct inaccurate personal data;

delete personal data;

restrict or object to processing;

receive a portable copy of personal data;

withdraw consent where processing is based on consent;

opt out of certain communications;

lodge a complaint with a data protection authority.

To exercise rights, contact us at support@simplybrand.ai. We respond without delay. There is no download of project data in the product at launch; you can ask for a copy by email.

We may need to verify your identity and authority before responding. If your data is processed on behalf of a customer, we may refer your request to that customer.

15. Business Communications

We send service emails about sign-in, your plan, payments, first results, security, support and legal updates. Stripe sends payment emails such as receipts, failed payments and the end of a free trial. We send one reminder email 7 days before results are deleted, which can include an offer. You can turn daily and weekly emails on or off in Settings.

16. Children's Privacy

The Service is not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take appropriate steps.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice by email, website notice, dashboard notice, or another reasonable method.

The updated Privacy Policy will be effective as of the date stated at the top of the page.

18. Contact

For privacy questions or requests, contact:

Email: support@simplybrand.ai

Privacy Contact: support@simplybrand.ai

Company: simplyBrand K.K.

Address: DF Building 6F, Room 615H, 2-2-8 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan

Effective date: 2026-11-13