SIMANALYTICA LTD

Privacy Policy

Last updated: February 2026

1. Introduction

SimAnalytica Ltd (“we”, “us”, “our”) is committed to protecting the privacy of users of the Compass: Engine™ software (and product configurations of, together, the “Service”). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights. SimAnalytica Ltd is a company registered in England and Wales (Company Number 11996161) with its registered office at Platform, New Station Street, Leeds, LS1 4JB, UK. For data protection purposes, we are the data controller. If you have questions about this policy or your personal data, contact us at info@simanalytica.com.

2. What Data We Collect

2.1 Account Information

When you register for the Service, we may collect:

• Full name
• Email address
• Company name and job title (if provided)
• Password (stored in hashed form only)
• Country of residence

2.2 Data You Upload to the Service

The Service allows you to upload and process data, including:

• Data files in a range of formats (including PDF, Excel, CSV, CAD, GIS)
• Photographs and documents
• Project notes and annotations

This data may contain location coordinates, site addresses, and references to third-party organisations. We process this data solely to provide the Service to you.

2.3 Usage Data

We automatically collect information about how you interact with the Service, including:

• Pages viewed and features used
• Session duration and frequency
• Browser type, operating system, and device information
• IP address and approximate geographic location. IP address data powered by IPinfo

2.4 Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. See Section 9 (Cookies) for full details.

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide the Service: processing your uploaded data, generating reports, maps, and AI-assisted analysis.
• Account management: creating and maintaining your account, authenticating access, and communicating service-related information.
• To improve the Service: analysing usage patterns to fix bugs, improve performance, and develop new features. We do not use your uploaded project data for model training (see Section 5).
• Compliance: complying with legal obligations, responding to lawful requests from authorities, and enforcing our Terms and Conditions.
• Marketing: sending product updates and news, but only where you have given separate, explicit consent (see Section 6).

4. Legal Bases for Processing

Under UK GDPR and the Data Protection Act 2018, we rely on the following legal bases:

• Contract: processing necessary to perform our contract with you (providing the Service).
• Legitimate interests: improving the Service, preventing fraud, and ensuring security, where these interests are not overridden by your rights.
• Consent: marketing communications. You may withdraw consent at any time.
• Legal obligation: where we are required to process data by law.

5. AI Processing and Third-Party Sub-Processors

The Service uses artificial intelligence to analyse your uploaded data (for example, extracting information from borehole logs and generating summaries). To provide these features, your data may be transmitted to third-party AI providers for processing within a private execution environment that is opted out of third-party model training and data sharing. Current AI sub-processors:

• Google
• OpenAI

We require all AI sub-processors to:

• Process your data solely on our instructions and for the purpose of providing the Service.
• Not use your data to train or improve their general-purpose models.
• Maintain appropriate technical and organisational security measures.
• Delete or return your data on termination of the processing relationship.

We do not use your uploaded project data to train SimAnalytica’s own AI models. Your data is processed only to return results to you.

6. Marketing Communications

We will only send you marketing emails (product updates, news, offers) if you have given separate, explicit consent at sign-up or subsequently. This consent is collected via a separate, unchecked-by-default checkbox. You can withdraw consent at any time by clicking the unsubscribe link in any marketing email, or by contacting us at info@simanalytica.com. Withdrawal of marketing consent does not affect service-related communications (for example, notifications about changes to the Service or your account).

7. Who We Share Your Data With

• AI sub-processors (see Section 5) to deliver AI-powered features.
• Hosting and infrastructure providers (AWS) who store and serve the Service.
• Payment processors (Stripe) for Professional and Enterprise subscriptions.
• Law enforcement or regulatory authorities where required by law.

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

8. International Data Transfers

SimAnalytica is based in the United Kingdom. If you access the Service from outside the UK, your data will be transferred to the UK for processing. Where we use sub-processors based outside the UK (including AI providers based in the United States), we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreement (IDTA) or addendum
• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office
• Adequacy decisions where applicable

9. Cookies

• Strictly necessary cookies: required for the Service to function (authentication, session management). These cannot be disabled.
• Functional cookies: remember your preferences and settings.
• Analytics cookies: help us understand how the Service is used. These are only set with your consent.

You can manage cookie preferences through your browser settings or through the cookie consent banner displayed when you first visit the site.

10. Data Retention

• Active accounts: we retain your account information and uploaded data for as long as your account remains active.
• Free tier accounts: if your account is inactive for 90 consecutive days, we may delete your uploaded data and project files. We will notify you by email before doing so.
• Account closure: upon account deletion, we will delete your personal data and uploaded files within 30 days, except where we are required by law to retain certain records.
• Backups: data may persist in encrypted backups for up to 90 days after deletion.

11. Your Rights

11.1 UK and EEA Users (GDPR)

• Access your personal data and receive a copy of it.
• Rectify inaccurate or incomplete personal data.
• Erase your personal data (“right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent for marketing at any time.

To exercise any of these rights, email info@simanalytica.com. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

11.2 US Users

• Right to know what personal data we collect, use, and share.
• Right to delete your personal data.
• Right to opt out of sale: we do not sell your personal data.
• Right to non-discrimination: we will not treat you differently for exercising your privacy rights.

To exercise these rights, email us at info@simanalytica.com. We will verify your identity before processing your request. We do not sell personal data as defined under the California Consumer Privacy Act (CCPA) or any other US state privacy law.

12. Data Security

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication
• Regular security assessments

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

13. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service at least 14 days before the changes take effect. The “Last updated” date at the top of this policy indicates when it was last revised.

15. Contact Us

SimAnalytica Ltd Platform New Station Street Leeds LS1 4JB UK Email: info@simanalytica.com