SimpliWork — Privacy Policy

Last updated: October 16, 2026

Effective: September 19, 2026

SimpliWork, LLC ("SimpliWork", "we", "us") makes business software for tracking time, jobs, expenses and invoices, at app.simpliwork.io.

This policy explains what we collect, why, who we share it with, and what you can do about it. It covers the SimpliWork application and the Client Portal. It does not cover our public marketing website, which is described separately in Section 12.

1. Two different roles, and why it matters

SimpliWork handles two kinds of information, and our responsibility is different for each.

Information about our own customers — we are the controller. When a business signs up, we collect what we need to run the account: who the owner is, who their users are, what they bought. We decide how that information is used, and this policy governs it.

Information inside a customer's workspace — we are a service provider. A restoration company using SimpliWork stores records about its clients, its employees, and its jobs. We hold and process that information on that company's instructions, to provide the Service, and for no purpose of our own.

If you are a homeowner, property manager or business who received an invoice or an estimate through SimpliWork: we are not the company you hired. We host the software your contractor uses. To see, correct or delete what is held about you, contact the contractor directly — they control that record. If you cannot reach them, write to privacy@simpliwork.io and we will pass your request on and tell you we have.

2. What we collect

2.1 Account information (we are the controller)

Identity and contact. Name, email address, and any phone number or job title you enter. Your business name and address.
Authentication. A hashed password — never the password itself. If you enable multi-factor authentication, the secret used to verify your codes, held encrypted. If you sign in with Google or Microsoft, the identifier and email address that provider returns; we never receive your password for those accounts.
Subscription and billing. Your plan, seat counts, invoice history and payment status. We do not collect or store card numbers. Card details go directly to Stripe, our payment processor.
Support. What you send us when you ask for help, including anything you attach.
Your acceptance of these terms. When a workspace is created we record that the Terms of Service and this Privacy Policy were accepted: the date and time, which published version, which user accepted, and the IP address it came from. This is kept for as long as the workspace exists, because it is the record of what was agreed.

2.2 Workspace content (we are a service provider)

Whatever you and your users put into the Service. In practice this includes:

Your clients' records — names, contacts, addresses, job locations, tax details, and notes about them.
Jobs — descriptions, schedules, budgets, documents, photographs and files.
Time and expenses — who worked, when, for how long, on what; expense amounts, categories and receipt images.
Estimates and invoices — line items, rates, totals, tax, payment records.
Messages and notes exchanged with your clients through the portal.
Electronic signatures and the evidence recorded with them, described in 2.4.
Field documentation pulled from a connected account of yours — moisture and atmospheric readings, site notes and photographs — if you connect one. See 2.6.

2.3 Technical and security information

Log data. We record requests to the Service, including IP address, timestamp and what was requested, to operate the Service, diagnose faults, and protect against abuse. IP addresses are used to enforce rate limits on sign-in and password reset — without that, those pages could be used to send mail to anyone.
Audit trail. The Service records changes to records in a workspace — who changed what, when, and the before and after values. This exists so a business can answer "who changed this invoice". It is available to that workspace's administrators.
Bot protection. Our signup and password-reset pages use Cloudflare Turnstile to distinguish people from automated scripts.

2.4 Electronic signature evidence

When a client signs an estimate or agreement, we record their name, email address, the IP address they signed from, the time, and their explicit agreement to sign electronically. This exists to make the signature evidentially useful, and it is retained with the signed document.

2.5 Credentials you give us for other systems

If you connect QuickBooks Online or Encircle, we hold the access credential that connection produces so the integration can keep working. Those credentials are encrypted before they are written to the database, separately from the storage-layer encryption described in Section 7, and they can be revoked by you at any time from the settings screen or from the other provider's own console.

When you disconnect QuickBooks Online, whether from SimpliWork or from QuickBooks, we revoke the connection and delete what we hold from QuickBooks within 30 days: the credential, the links between your records and theirs, and the record of what was synced. Payments that came in from QuickBooks become part of your own invoice history and stay with it.

For card payments from your clients we hold no credential of yours at all — the connection returns an account identifier, and that is all we keep.

2.6 What we do not collect

No advertising or behavioural tracking inside the application. No Google Analytics, no advertising pixels, no third-party trackers, no session recording.
No card numbers.
No location tracking. We do not collect device GPS. Job addresses are what you type in, and readings pulled from a connected field-documentation account carry whatever that account recorded.
No purchased or enriched data. We do not buy information about you from anyone.
No third-party fonts or scripts in the application. Everything the application loads is served from our own domain, so opening a page does not tell anybody else that you did.

3. What we do with it

Purpose	What we use
Provide the Service	Account information and workspace content
Authenticate you and keep accounts secure	Credentials, MFA, log data, IP address
Bill you and manage your subscription	Account and billing information
Send transactional email — invitations, invoices, estimates, password resets, portal codes, alerts	Name and email address
Support	What you send us, and account information
Detect, prevent and investigate abuse and fraud	Log data, IP address
Comply with law, and enforce our Terms	As required

We do not use workspace content to advertise to anyone, and we do not use it to train machine-learning models.

We never sell personal information, and we never share it for cross-context behavioural advertising — as those terms are defined under California law and equivalent state laws.

If we ever send you a marketing email about SimpliWork itself, every one will have a one-click unsubscribe, and unsubscribing never affects the transactional email you need to run your business.

We share personal information only with the service providers below, each of which is contractually limited to processing it for us. We do not share it with anyone else except as described in 4.2.

4.1 Subprocessors

Provider	What it does	What it receives
Microsoft Azure	Hosting, database and file storage. All workspace content lives here.	Everything in the Service
Stripe	Payment processing — both your subscription to us, and card payments your clients make to you	Billing contact details, amounts, card data entered directly into Stripe
Resend	Sending transactional email	Recipient name and email address, and the message content
Cloudflare	Bot protection on signup and password reset	IP address and a browser challenge

4.2 Connections you choose to make

These are not subprocessors. They are your accounts with other companies, connected by you, and nothing is exchanged with any of them unless you connect it.

Provider	What it does	What is exchanged
Intuit (QuickBooks Online)	Keeps your QuickBooks company in step with SimpliWork: sends the customers, invoices and payments you choose to sync; reads your products and services so invoice lines are booked to the right one; reads customers when you link or import one; and reads payments recorded in QuickBooks against invoices we sent, so those invoices show as paid here	Customer names and contact details, invoice lines, totals, payment amounts and dates. Nothing from your QuickBooks company is shared with anyone else or used for any other purpose.
Encircle	Pulls field documentation onto your jobs	We read readings, notes and photographs from your Encircle account. Nothing is written back to it.
Xactimate	You upload an export; nothing is sent to Verisk	Nothing leaves SimpliWork
Google / Microsoft	Sign-in, if you choose to use it	Your email address and account identifier, returned to us by them

We will update the table in 4.1 before adding a new subprocessor, and material additions will be notified as described in Section 11.

4.3 Other disclosures

Legal. If we are legally required to — by subpoena, court order or law. Where we are permitted to tell you, we will, so that you can object.
Safety. To protect the rights, property or safety of SimpliWork, our customers or the public.
Business transfer. If SimpliWork is acquired or merged, information may transfer as part of that transaction. You will be notified, and the acquirer will be bound by this policy or one no less protective.

5. Where data is stored

The Service runs in Microsoft Azure's West US 3 region, in the United States. Workspace content is stored there. Some subprocessors listed above may process data elsewhere; each maintains its own safeguards for international transfer.

6. How long we keep it

Data	Retention
Active workspace content	For as long as the workspace exists
A workspace that lapses	Retained through read-only and closure, so you can recover it by subscribing again
After you ask us to delete	Removed from live systems within 30 days
Backups	Rolling 7-day point-in-time retention; deleted content ages out with it
Audit trail	Kept with the workspace; it is the record of who changed what
Billing records	Kept as long as tax and accounting law requires, typically seven years
QuickBooks Online connection data	Deleted within 30 days of disconnecting
Server logs and diagnostics	90 days. They hold no QuickBooks data, passwords or payment card details.

We do not delete a closed workspace without warning you first. You will get an email at the account address and at least 30 days to respond. This is deliberate: a contractor's job history is their evidence in a dispute years later, and losing it to an expired card would be the worst thing this software could do to someone.

7. Security

We use safeguards appropriate to the information we hold. In summary:

Encryption in transit and at rest.
Passwords are hashed, never stored or recoverable in readable form.
Credentials you give us for other systems are separately encrypted, so a copy of the database is not a working key to your QuickBooks or Encircle account.
Each workspace's records are isolated from every other workspace.
Access control, with multi-factor authentication available and enforceable across a workspace.
Audit logging of changes to records.
Staff access is limited to what is needed to operate and support the Service.

If you need more detail than this — a security questionnaire, a vendor review, an insurer asking — write to security@simpliwork.io and we will answer it properly.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you without undue delay and as required by law.

To report a vulnerability, write to security@simpliwork.io. We will not pursue good-faith security research that respects our customers' data and gives us reasonable time to respond.

8. Cookies and browser storage

We use no advertising or analytics cookies. There is nothing to consent to, so we do not show a cookie banner.

What the application stores in your browser:

What	Why	Lasts
Sign-in tokens	To keep you signed in	Until you sign out or they expire
Which client you are, in the portal	To show you your own records	Until you sign out
Theme preference	To remember light or dark	Until you clear it
Multi-factor setup token	To complete MFA enrolment	The browser tab only
Shared-document session	So reloading a document you were sent does not ask for the code again	The browser tab only

Clearing your browser storage signs you out. It has no other effect.

9. Your choices and rights

If you are our customer, you can see and change most of your information in the Service, and you can export your time entries, invoices and expenses to CSV from the Service at any time. To request a fuller export or deletion of your workspace, or to ask a question, write to privacy@simpliwork.io.

Depending on where you live, you may have the right to know what we hold, to get a copy, to correct it, to delete it, to limit how it is used, and not to be discriminated against for exercising those rights. To exercise them, write to privacy@simpliwork.io. We will verify your identity against the account before acting, and respond within the time the law allows — generally 45 days under California law.

You may use an authorised agent, with proof of authorisation.

If you are a client of one of our customers, see the note in Section 1: the business you hired controls that record, and your request should go to them.

California

We do not sell personal information and do not share it for cross-context behavioural advertising. In the last 12 months we collected the categories described in Section 2, for the purposes in Section 3, and disclosed them to the subprocessors in Section 4.1 for business purposes only.

Outside the United States

SimpliWork is operated from the United States and intended for businesses in the United States. We do not offer the Service in the European Economic Area or the United Kingdom, and we do not target it at people there. If you use it from outside the United States, your information will be processed in the United States, and you should not use the Service if that is not acceptable to you.

10. Children

The Service is business software and not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to privacy@simpliwork.io and we will delete it.

11. Changes to this policy

We may update this policy. The "Last updated" date at the top always reflects the current version. For a material change, we will give notice by email to the account address and in the Service at least 30 days before it takes effect.

12. Our marketing website

Our public website at https://simpliwork.io is separate from the application.

It sets no advertising or analytics cookies, and carries no tracker.
Its pages load typefaces from Google Fonts, which means your browser makes a request to Google and Google sees your IP address. Google's use of that is governed by its own policies.
The contact form on our consulting page uses Google reCAPTCHA to tell people from scripts, and sends what you type in it to us by email. Nothing else.

No advertising or tracking of any kind operates inside the application, and no workspace content is ever shared with an advertising network.

If we ever place advertising on the marketing site, this section will say so before it happens.

13. Contact

SimpliWork, LLC, a Florida limited liability company.