Privacy Policy

1. Who we are

Sirplix is operated by Ayman Ellaimouni, its founder, based in the United Arab Emirates. Sirplix is not yet a registered company; when it is, these pages will name the company and its registered address.

We are an online business. We do not have an office open to the public; please contact us by email.

• Customer support: support@sirplix.com
• Privacy and data requests: privacy@sirplix.com

2. Two different roles

For our website visitors and for people who create a Sirplix account, we decide how their data is used: we are the “controller”.

Businesses that use Sirplix put their own data into it — for example an institute’s students and parents, a gym’s members, a shop’s customers. For that data the business is the controller and Sirplix only processes it on the business’s instructions, as described in our Data Processing Agreement (sirplix.com/dpa). If you are a customer of a business that uses Sirplix, please contact that business first; we will help it answer you.

3. What we collect

• Website: if you send our contact or waitlist form, the details you type (name, business, phone, email, message). The form is emailed to us; the website keeps no copy. Our server keeps short technical logs (IP address, browser, time) for security. The website uses no cookies, no analytics and no advertising tools.
• Your account: your name, email address or username, and your password — stored only as a scrambled hash (scrypt), never in readable form. Sign-in codes we email you. A sign-in cookie that keeps you signed in. Your preferences (look, language) are stored on your own device.
• Business content: what you and your team put into Sirplix — records, files and pictures, messages, comments, and the history of changes.
• Connected accounts: when a business or person connects Google, Zoom or WhatsApp Business, the access the provider grants (stored encrypted) and the information needed for the actions you choose, such as creating a calendar event or sending a message.
• Payments: a business that connects its own Stripe account takes payments through Stripe; card numbers go to Stripe, never to us. When we bill for our paid plans, payment details are handled by a payment provider; we do not store card numbers.
• Support and error reports: emails you send us, and, when a screen fails in your browser, a short report of what broke and on which page (record identifiers and email addresses are removed).
• AI assistant: when a business uses the assistant with Claude, the request you type and the names of the boards and fields involved are sent to Anthropic to prepare a suggestion. Nothing is changed until you approve it.

4. Why we use it

• To provide the service you signed up for: your account, your business’s workspace, its automations and connected accounts.
• To keep it secure: sign-in protection, rate limits, preventing abuse, investigating problems.
• To answer you and support you.
• To meet legal obligations.
• With your consent where we ask for it — for example when you connect a Google, Zoom or WhatsApp account. You can withdraw it at any time by disconnecting.

We do not sell personal data, we do not use it for advertising, and we do not use your business’s content to train AI models.

5. Google user data

Sirplix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to provide the features you switch on (calendar events and Meet links, the Sheets you choose to sync or add rows to, files Sirplix saves to your Drive, emails you send from Gmail). Sirplix can only send email through Gmail; it cannot read your mailbox. We do not let humans read this data except with your agreement for support, for security, or where the law requires it, and we do not use it for advertising or to train AI models.

6. Who we share it with

Only service providers that help us run Sirplix, under contracts that require them to protect it, and only as needed:

• Namecheap, Inc. (USA): our server (data centre in San Jose, California), our domain and DNS, and our business email.
• Google LLC (USA): only when a business connects its own Google account (Calendar, Meet, Sheets, Drive, Gmail).
• Zoom Communications, Inc. (USA): only when a business or person connects their Zoom account.
• Meta Platforms, Inc. / WhatsApp (USA / Ireland): only when a business connects its WhatsApp Business account.
• Stripe, Inc. (USA): only when a business connects its own Stripe account to take payments.
• Anthropic, PBC (USA): only when the AI assistant is used with Claude; under Anthropic’s commercial terms, API data is not used to train its models.

We may also disclose data where the law requires it, or to protect the rights and safety of our users or others. We will tell you before we add a new provider that handles business content.

7. Where it is stored

Sirplix runs on a server in the United States (San Jose, California). If you are in the UAE, the EU or elsewhere, your data is transferred there. We protect it with encryption in transit (HTTPS) and the safeguards in section 9, and we use providers bound by data-protection terms.

8. How long we keep it

• Your account: while you have it. When you ask us to delete it, your name, email and password are erased within 30 days.
• A business’s workspace: while the business uses Sirplix. When its owner closes it, everything in it is erased within 30 days.
• Backup copies: kept for a limited time for disaster recovery (at most 90 days), then removed.
• Error reports: at most 90 days. Server logs: a short time, then overwritten.
• Emails with us: as long as needed to help you, and as required by law.

9. How we protect it

• HTTPS everywhere; passwords stored only as scrypt hashes; sign-in sessions and API keys stored only as hashes.
• Keys and access to connected accounts encrypted with AES-256-GCM; they never reach the browser.
• Every business is sealed off from the others in the database itself (row-level security).
• Least access: only the founder can reach the server, with personal security keys.
• A backup before every update, and automated tests of the separation between businesses.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority without undue delay, as the law requires.

10. Your rights

Depending on where you live — including under the UAE Personal Data Protection Law and, for people in the European Union, the GDPR — you can ask to access your data, correct it, delete it, receive a copy in a common format, restrict or object to some uses, and withdraw consent.

• In Sirplix: your account menu → Privacy & data (download a copy of your data, delete your account).
• A business owner: Settings → Business → Close this business.
• Anything else: write to privacy@sirplix.com. We answer within 30 days.

You can also complain to your data-protection authority (in the UAE, the UAE Data Office).

11. Children

Sirplix accounts are for adults acting for a business. Businesses such as tutoring centres may store information about children who are their students; they are responsible for having the right to do so (for example a parent’s consent) and we process it only on their instructions.

12. Changes

We may update this policy. We will change the date at the top, and tell account holders by email or in the app before important changes take effect.