Privacy Policy

Effective date: 5 May 2026 · Last updated: 15 October 2026

1. Who we are

SiiMii is operated by SiiMii ApS (CVR 46345460, DK46345460), a company registered in Denmark.

Address: Munkesøvej 19, 4000 Roskilde, Denmark. Privacy contact: Andreas Kauders, Founder & Data Protection Lead · privacy@siimii.ai.

If you are in the EU/EEA you have the right to lodge a complaint with the Danish data-protection authority (Datatilsynet) or your local supervisory authority.

2. Scope of this policy

This policy describes how SiiMii collects, uses, stores, and shares personal data when you use our website (https://siimii.ai) and the SiiMii application at https://siimiini.siimii.ai. It also covers the limited set of data we read from connected advertising, video, and social-platform accounts when you authorise SiiMii to plan, publish, moderate, or optimise activity through SiiMii.

This policy does not cover websites you visit via links inside SiiMii (Google, Stripe, etc.). Read those operators' policies for their own handling.

3. What we collect

3.1 Account information you give us

• Your name, work email, and (optional) telephone number.
• Your company name, billing address, country, VAT or Tax ID — only when you save them to your invoice profile.
• Your password, stored as a salted bcrypt hash; we never see the cleartext after registration.
• Preferred display language and currency.

Lawful basis: performance of a contract with you (Art. 6(1)(b) GDPR).

3.2 Data we receive from Google when you connect Google Ads

When you click Connect Google Ads inside SiiMii, you authorise SiiMii via Google's standard OAuth consent flow to access:

• Your Google Ads account ID(s) and metadata (descriptive name, currency, time-zone, manager-flag, test-account-flag).
• Campaign, ad-group, and ad metadata (names, status, keywords, headlines, descriptions, final URL).
• Generated video creatives uploaded to YouTube as unlisted videos when needed for Google Demand Gen or Performance Max ads.
• Performance metrics (impressions, clicks, conversions, cost) for campaigns that SiiMii has launched on your behalf.
• Account billing-setup metadata required to attach a payment account (we do not see card numbers; that's between you and Google).

Connecting Google Ads requests https://www.googleapis.com/auth/adwords. YouTube channel access and upload are separate optional consent using https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/youtube.upload.

We do not request or store your Gmail content, Drive files, Photos, Calendar events, or any other Google product data.

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) and your explicit consent captured in Google's OAuth screen (Art. 6(1)(a) GDPR).

3.3 Data we receive from connected social and advertising accounts

When you connect an advertising or social account, SiiMii may receive the minimum account and asset data needed to provide the features you enable:

• Business, profile, Page, channel, ad-account, and media-library IDs and metadata.
• Permissions, connection status, selected assets, and encrypted access credentials.
• Organic post, comment, message, moderation, and reply metadata when you enable social automation.
• Text of comments or messages that users send to the connected business asset when you ask SiiMii to draft replies, moderate, or escalate them.
• Performance and engagement metrics needed to report results and suggest improvements.

We use this data only to provide the connected features you enable, to keep an audit trail of actions taken on your behalf, and to comply with the relevant platform policies and legal obligations.

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR), your consent through the platform connection flow (Art. 6(1)(a) GDPR), and legitimate interest in security and auditability (Art. 6(1)(f) GDPR).

3.4 Data we generate while you use SiiMii

• Logs of API calls between SiiMii and Google (request IDs, error codes, timestamps) for debugging and audit.
• Records of every action SiiMii takes on your behalf (campaign changes, budget changes, creative launches), visible to platform admins for support and to you in the activity feed.
• Wallet transactions and Stripe invoice references.
• AI usage events (which model, how many tokens, what operation).

Lawful basis: legitimate interest in operating, securing, and improving SiiMii (Art. 6(1)(f) GDPR), balanced against your reasonable expectations.

4. How we use your data

1. Operating SiiMii — running the campaigns you launch, processing wallet top-ups, sending notifications, generating creative copy.
2. Talking to Google on your behalf via the Google Ads API — strictly to provision and operate your campaigns.
3. Publishing approved organic posts, drafting or sending permitted replies, moderating connected social interactions, and escalating conversations where you enable those features.
4. Talking to Stripe on your behalf — strictly to handle wallet top-ups and invoicing in your name.
5. Customer support — looking up activity to help you when you ask.
6. Security — detecting unauthorised access, abuse, or misconfiguration.
7. Legal obligations — VAT compliance, accounting, responding to regulators.

Limited Use disclosure (Google API): SiiMii's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing features in SiiMii.
• We do not use Google user data to serve advertising of our own.
• We do not transfer Google user data to third parties except as necessary to provide and improve user-facing features (e.g. to Google itself when launching ads, or to our cloud-hosting provider for storage).
• We do not allow humans to read Google user data unless you give us explicit support permission, regulators compel us, or the data is needed for security investigation.
• We do not use Google user data to train generalised AI/ML models.

Connected platform data disclosure: for any connected advertising, video, or social platform, we use data received from that platform only to provide and improve user-facing SiiMii features. We do not sell it, use it to serve our own advertising, or train generalised AI models on it.

5. Use of AI

SiiMii uses OpenAI for text, images, claims analysis and speech transcription; Google Gemini for supported image/video generation; and optionally Anthropic for planning. Depending on the feature you request, prompts can include product facts, brand guidance, campaign copy, performance summaries and relevant conversation history. Supervised reply drafting includes customer comments or messages and prior business replies. Those texts can contain personal information; SiiMii does not promise that all personal data is removed before AI processing. Avoid supplying unnecessary sensitive information.

Selecting reference images for generation shares their pixels with the chosen provider. Optional visual claims analysis shares the selected images and sampled video frames after separate sharing/cost consent. Optional speech transcription shares the selected video's extracted audio after its own consent. Accepted transcripts can enter a later, separately requested claims check. Local video finishing does not make a new AI request. Review the sharing information before confirming.

Provider access credentials and payment instruments are not included in generation prompts. Billing-profile fields are not intentionally added to those prompts, but the text or media supplied by you or a customer may independently contain names, addresses or other personal information. Saved AI responses and transcripts are workspace content used for review and interruption recovery. Financial records retain usage and identity evidence separately from those saved outputs.

AI processing follows the applicable business/API terms and data controls, including OpenAI's business terms, Gemini's paid-service terms and, when enabled, Anthropic's commercial terms. Standard API access does not mean that a provider retains no data or processes it only in the EU. Retention depends on the service and applicable account settings.

6. How we share your data

We do not sell your personal data. We share it only with the following providers for the purposes below. Their roles and data handling depend on the service: some act as processors, while payment and connected-platform providers may also act as independent controllers under their own terms and privacy notices.

We may also share data when legally required — court order, regulator request, or in response to a verified data-subject request from you.

Requesting workspace erasure disables new work and scheduled billing. We confirm that connected advertising campaigns have stopped before removing stored connection credentials. You can also revoke SiiMii's access in each provider's account settings. Permanent workspace removal can start after the 30-day grace period once advertising and outstanding financial transactions are resolved. Required accounting evidence is retained separately with restricted access.

7. Where your data is stored

SiiMii uses Hetzner servers for application and database hosting. External payment, AI and connected-platform services may process data internationally. The applicable provider agreements describe transfer safeguards, including Standard Contractual Clauses where applicable; a provider's European contracting entity does not mean all processing stays in the EU. Contact our privacy team for the hosting location and transfer information applicable to your data.

8. How long we keep your data

We preserve work evidence without routine automatic expiry. This includes accounting records, campaign media and operational logs. Personal data is kept only while necessary for the relevant purpose; valid deletion requests, provider rules and legal obligations still apply. Retention for accounting or a legal claim is limited to the evidence needed for that purpose.

9. Your rights under GDPR

If you are in the EU/EEA you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectify — correct inaccurate data.
• Erase ("right to be forgotten") — delete your workspace and the personal data tied to it.
• Restrict processing — pause some uses of your data while a dispute is resolved.
• Object — to processing based on legitimate interest.
• Portability — receive a structured, commonly-used, machine-readable copy of your data.
• Withdraw consent at any time, where we relied on consent.

You can exercise Erase and Portability directly in the SiiMii app as a workspace owner under Settings → Privacy & data; erasure also requires an emailed verification code. For the rest, email privacy@siimii.ai. We respond within 30 days and never charge for this.

10. Cookies and similar technologies

SiiMii sets a small number of strictly-necessary cookies and local-storage entries:

We do not currently set analytics or advertising cookies. If we add any in the future we will update this policy and present an explicit opt-in before activating them.

11. Security

• All traffic uses HTTPS.
• Refresh tokens and OAuth credentials are encrypted at rest with a key separate from database backups.
• Passwords are stored as bcrypt hashes (12 rounds).
• Access to production infrastructure is restricted to authorised SiiMii operators.
• We log all platform-admin actions for audit.

If we ever detect a breach involving your personal data we will notify the Danish DPA within 72 hours and you without undue delay (GDPR Art. 33–34).

12. Changes to this policy

We will update this page when our practices change. The effective date at the top is authoritative. Material changes will be announced inside SiiMii at least 14 days before they take effect.

13. Contact us

• Privacy questions or rights requests: privacy@siimii.ai
• General enquiries: info@siimii.ai
• Postal: SiiMii ApS, Munkesøvej 19, 4000 Roskilde, Denmark