Privacy Policy

0. About this policy

This service is operated by Dorel Ciprian Nafornita, trading as SIMPLionEX, operating from 71 Cotesheath Street, Stoke-on-Trent, ST1 3JB, United Kingdom ('SIMPLionEX', 'we', 'us'). SIMPLionEX acts as a data processor for the fire-safety records described below. The organisation that operates a workspace on this system (the 'Customer') is the data controller for the personal data of its own employees and visitors, and is responsible for determining retention periods, lawful basis, and responding to data subject requests from its own staff and visitors under this policy. For account, billing, and enquiry data submitted directly to SIMPLionEX (e.g. via the contact form or subscription signup), SIMPLionEX is the data controller.

1. Data we collect

Name of staff and visitors
Check-in and check-out timestamps
Visitor details (including host, company and assembly-point acknowledgement)
Fire-drill attendance and roll-call outcomes
Session and login data for account holders
Contact form submissions — name, email, category and message, when you contact us directly
Subscription and workspace signup details — company name, owner name and email, when a workspace is created
Locally cached session role — your verified role and user ID, stored on-device to keep the app usable during a connectivity drop

2. Why we process it

Fire-safety compliance
Evacuation roll-call
Site-attendance tracking
Visitor management
Audit logging

3. Legal basis (UK GDPR / EU GDPR)

Legitimate interest — keeping people safe on site and maintaining an accurate roll-call
Legal obligation — health-and-safety and fire-safety duties on the site operator
Contractual necessity — providing accounts and access to authorised users

4. Retention

Each Customer configures its own retention period via Site Settings. Records are automatically retained only for that configured period (or, if unset, the minimum period needed for fire-safety compliance and audit purposes) and are then deleted. Upon subscription cancellation, Customer data is deleted within 30 days unless a longer legal retention duty applies.

4a. Third-party processors & data location

We use the following subprocessors to operate the service: Supabase (database hosting, EU region) and Lovable's built-in email service (transactional email delivery from our verified domain notify.safetrack.simplionex.com). We do not sell personal data or share it with third parties for marketing.

5. Cookie notice

SIMPLionEX uses only essential cookies for secure login sessions, role permissions, and navigation. No analytics or tracking cookies are used.

6. Your rights

Access — request a copy of the personal data we hold about you
Rectification — have inaccurate data corrected
Erasure — request deletion where no legal retention duty applies
Restriction — ask us to limit processing of your data
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interest

7. Making a request

To exercise any of these rights, or to ask a question about this policy, email support@simplionex.com. We respond to data requests within one month.