Who we are
simpledatalogs is run by XKD Labs (OPC) Private Limited, Innov8 Aerocity, Asset 5A, JW Marriott Hotel, IGI Airport, South West Delhi, Delhi 110037, India.
Two roles
For your account (email, password hash, team, billing) we are the controller. For the events your apps send, you are the controller and we are your processor; see Data processing.
Your account data
We keep your email, name, password hash, team and billing records. Card and bank details go to the payment provider; we never see them. We use this data to run the service and bill you (contract), keep it secure (legitimate interest) and meet tax rules (legal duty).
We send sign-in, billing and alert emails. Product news only if you opt in at sign-up; every one has an unsubscribe link.
We measure our own site and dashboard with simpledatalogs itself: page views and actions, tied to your account id, never your email (legitimate interest). Public pages send no identifier, set no cookie and send nothing when your browser asks not to be tracked.
What the SDKs send
Event names, timestamps, the properties you choose and a random install id. No IP address field, no device fingerprint, no advertising id, no cookies.
The client IP is used in memory for rate limiting and a country lookup, then dropped. For web pages on a public key it is also hashed with the browser's User-Agent and a salt that changes daily and is then deleted, to count visitors without cookies; only the hash is kept. Emails, IP addresses, card numbers, tokens and phone numbers in text are masked before storage. An email address sent as a user id is replaced with a pseudonym, unless the project's owner chooses to keep it readable.
Countries come from IP Geolocation by DB-IP (CC BY 4.0).
The Shopify app
Its pixel runs only with the shopper's analytics consent. It sends page, product, cart and checkout events with prices, totals and Shopify's random client id. Never emails, names, phone numbers, addresses, customer ids or IP addresses.
Google Analytics import
With your permission we read your property's daily reports, read-only, and chart them beside your events. The Google token is stored encrypted and deleted when you disconnect. Imported numbers stay until you remove the import.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is never used for ads or sold, and people read it only with your permission, for security, or when the law requires.
The dashboard assistant
It sees your field names and dashboard layout, never your rows. The AI models we use are asked not to train on your data.
Cookies
Retention and erasure
Raw events are kept for your plan's retention (see Pricing), then deleted; counters are kept while the account exists. Data that couldn't be read is kept 7 days so you can fix the format.
Owners can erase one device's data or one event's data from the dashboard. Rows go at once; copies in the recovery log and backups age out, so an erasure is complete within 14 days.
Deleting an account removes its data within 30 days, backups included.
Support emails and contact-form messages are kept 2 years after the ticket closes, then deleted.
Where data lives
Accounts and events are stored in the United States, encrypted in transit and at rest. Events sent from near India may pass through a server in India, held only until they are stored.
Your rights
Under the GDPR, the UK GDPR, India's DPDP Act and the CCPA, you can see, export, correct or delete your account data by writing to us. We don't sell personal data or share it for ads. End users of an app should ask that app's maker, who controls their data. You may also complain to your local data protection authority.
Grievance Officer (India): reach out at privacy@simpledatalogs.com. We reply within 30 days.
Children
simpledatalogs is not for anyone under 18.
Changes
We post changes here with a new date, and email account owners about important ones.
Questions: privacy@simpledatalogs.com.