Version 1.0 ยท 26th October 2026
Simplish AI Terms and Data Processing Agreement
1. Who this agreement is between, and how it is accepted
This agreement sets out how Simplish AI protects your data. It is part of your contract with us for the Simplish AI Assessment and the AI Concierge, including the January Head Start.
Us: Rodwellbeing Ltd, trading as Simplish AI, company number 09285215, registered with the Information Commissioner's Office under reference ZC180359. Contact: our contact form. "We", "us" and "Simplish AI" mean this business.
You: the business named at checkout, or in any order or email in which you accept these terms. "You" means that business.
How you accept it: you accept this agreement by ticking the box at checkout before you pay, or by confirming in writing (including by email) that you agree. The person who accepts confirms they have authority to do so for the business. Stripe records the acceptance with the date and time, and we keep that record with your file.
Version: 1.0, dated 26th October 2026. The version you accepted is the one that applies to you, unless you agree to a later one.
2. Our roles under data protection law
We play two different roles depending on the service, and this agreement covers both. Part A (sections 1 to 6 and 8) applies to every client. Part B (section 7) adds the formal processor terms for the AI Concierge.
| Service | Our role | What that means |
|---|---|---|
| The Simplish AI Assessment | Independent controller | We decide what information we need to write your report and how we handle it, using our own professional judgement. Part A applies. |
| AI Concierge, including the January Head Start | Processor | When we work inside your systems, we handle the personal data held there only on your instructions. You remain the controller. Parts A and B apply. |
| Free Mini Assessment | Independent controller | Covered by our privacy notice at simplish.ai. This agreement is not needed for it. |
You are always the controller of your own customer, supplier and staff data. Nothing in this agreement changes that.
The law we work to is the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. If you are based in the EU, Part B is also written to meet Article 28 of the EU GDPR.
3. What data we handle, and what we use it for
We use your information only to deliver the service you bought. We never sell it, never use your contacts for our own marketing, and never publish anything about you without your written permission.
| Data | Where it comes from | Why we hold it |
|---|---|---|
| Your name, email, phone and business details | Checkout, booking and our emails | To run the service, invoice you and stay in touch |
| Discovery call audio and transcript | Your call with Danni, our AI business analyst | To write your report |
| How your business works: tasks, tools, time spent, team roles | The discovery call and our calls with you | To find and cost the hours you could get back |
| Notes from video calls with Christian | Our note taker on those calls | To keep an accurate record of what we agreed |
| Data inside your systems (AI Concierge only) | Access you grant us | To build the fix we agreed that month |
Please keep it lean. We do not need health information, financial account details or other sensitive personal data to do this work. Please do not share it on calls or give us access to it unless a fix genuinely requires it and we have agreed that in writing first.
Anonymised learning. We may use anonymised, combined findings (for example, how many hours a typical practice spends chasing documents) to improve our method. These can never identify you or anyone in your business. Named case studies and testimonials only ever happen with your written permission.
4. AI tools and the other providers we use
Your data is never used to train anyone's AI models. On every AI tool below we either work under the provider's business terms, which exclude training, or we have switched off the setting that allows it.
We use a small set of established providers ("sub-processors") to run calls, write reports and store records. Each one handles only what its job needs and is bound by its own data processing terms with us.
| Provider | What it does for us | What it sees |
|---|---|---|
| Anthropic (Claude) | Analyses call transcripts and drafts your report and prompts | Transcripts, notes, report drafts |
| ElevenLabs | Runs Danni, our AI business analyst, and produces the call transcript | Call audio and transcript |
| Twilio | Connects Danni's phone call | Your phone number, call audio in transit |
| Zapier | Moves information between our booking, payment and storage tools | Contact details, booking and call references |
| Google Workspace | Email, calendar, video calls and file storage for reports and transcripts | Emails, transcripts, reports |
| Spark (Readdle) | Our email app | Emails |
| Granola | Notes from video calls with Christian | Call transcript and notes |
| OnePageCRM | Our client records | Contact details and engagement notes |
| Cal.com | Booking calls | Name, email, booking times |
| Stripe | Taking payment | Billing and payment details. We never see your full card or bank account number |
This list is current at the date of this version. We will give you at least 14 days' notice by email before adding a provider that handles your data. You can object, and section 8 explains what happens if you do.
International transfers. Some providers process data outside the UK, mainly in the US. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or UK Addendum, as set out in that provider's terms.
Inside your systems. When a Concierge fix uses an AI tool on your data, we tell you which tool before we build it, and we set it up under your account or business terms wherever we can, so the data stays under your control.
5. Security, confidentiality and how long we keep things
Security. We protect your data with measures that fit a small, founder-led business handling business information:
- Two-factor sign-in on every account that holds client data
- Encrypted, password-locked devices, with data stored in the providers above rather than on loose files
- Access to your systems through a user account you create for us, never a shared password, and removed when the work ends
- Only the people who need your data to deliver the work can see it, and each is bound by confidentiality
Confidentiality. Everything you tell us about your business is confidential, whether or not it is personal data. We will not share it with anyone except the providers in section 4, or where the law requires it.
How long we keep things.
| Record | How long | Why |
|---|---|---|
| Call recordings and transcripts, from your call with Danni and video calls with Christian | 90 days | Long enough to write your report and check it against what was said, then deleted |
| Your report and our written notes | 24 months after our last work together | So your six-monthly re-assessment can compare like with like |
| Contact details in our client records | 24 months after our last contact, or sooner if you ask | To stay in touch about your service |
| Invoices and payment records | 6 years | Required for tax |
After these periods we delete the data, or anonymise it so it can no longer identify anyone. Your six-monthly re-assessment compares against your report and our notes, so we do not keep recordings or transcripts for it.
6. If something goes wrong, requests and complaints, and when we finish
Data breaches. If we become aware of a breach affecting your data, we will tell you without undue delay and within 48 hours, with what we know, what we are doing about it and what you may need to do. That gives you time to meet your own 72 hour duty to report to the ICO where it applies.
Requests from individuals. If someone asks to see, correct or delete data we hold about them in connection with your service, we will tell you promptly and help you respond within the legal time limits.
Complaints. You, or anyone whose data we hold, can complain to us about how we handle personal data through our contact form. We will acknowledge a complaint within 30 days and tell you the outcome without undue delay. You can also complain to the ICO at ico.org.uk.
When we finish. When our work together ends, we remove our access to your systems straight away. Within 30 days, at your choice, we will return or delete the data we hold for you under Part B. Records we must keep by law (such as invoices) are kept only for as long as the law requires.
7. Part B: processor terms for the AI Concierge
These terms apply whenever we process personal data on your behalf, which in practice means Concierge work inside your systems. They meet Article 28(3) of the UK GDPR.
- Your instructions. We process your personal data only on your documented instructions. The fix agreed on each month's first Concierge call, or the scope of a fixed programme such as the January Head Start, confirmed by email, is your instruction. We will tell you straight away if we believe an instruction breaks data protection law.
- Confidentiality. Everyone who handles your data for us is under a duty of confidentiality.
- Security. We apply the security measures in section 5 and any further measures appropriate to the risk, as Article 32 requires.
- Sub-processors. You give general authorisation for the providers in section 4. We will notify you of changes as section 4 describes, and every provider is bound by terms that protect your data to an equivalent standard. We remain responsible to you for them.
- Individuals' rights. We will help you respond to requests from individuals, as section 6 describes.
- Helping you comply. We will help you with security, breach notification, data protection impact assessments and consultation with the ICO, as far as the nature of our work and the information we have allows.
- End of service. At your choice, we will delete or return your personal data within 30 days of the service ending, unless the law requires us to keep it.
- Information and audits. We will give you the information you reasonably need to show that these terms are met. You may audit our compliance on 30 days' written notice, no more than once a year, at your own cost, normally by written questions first.
Your responsibilities. You confirm you have a lawful basis to share the data with us, that your own privacy notice covers our role, and that you will give us access only to the data a fix needs.
Schedule 1: processing details
| Item | Detail |
|---|---|
| Subject matter | Building and maintaining the automations agreed under the AI Concierge |
| Duration | For as long as your Concierge work runs, whether a monthly subscription or a fixed programme, plus up to 30 days for return or deletion |
| Nature and purpose | Accessing, reading, organising and moving data within your systems to build, test and run agreed automations |
| Types of personal data | Names, contact details, correspondence and records held in the systems you give us access to |
| Categories of people | Your customers, clients, suppliers, staff and enquirers |
| Special category data | None, unless agreed in writing in advance for a specific fix |
8. Liability, changes and governing law
Liability. Each of us is responsible for our own compliance with data protection law. Our total liability under this agreement is limited to the fees you paid us in the 12 months before the claim, except where the law does not allow liability to be limited. Nothing here removes our direct legal duties as a processor.
Objecting to a new provider. If you object to a new provider on reasonable data protection grounds and we cannot resolve it, you may end the Concierge without penalty and we will refund any fees paid for the period after it ends.
Changes. We may update this agreement to reflect changes in the law or in the providers we use. We will email you at least 14 days before a change that affects you, and publish each version with its date at simplish.ai/terms.
If terms conflict. Where this agreement and any other terms between us conflict on data protection, this agreement wins, unless a separate signed agreement with you says otherwise.
Governing law. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.