Privacy in the application

This notice covers the applications you sign in to on show.simplidigita.ai: the sign-in, what you enter and upload, and where that data is kept. The website around them has its own notice, at simplidigita.ai/privacy.

The organization that runs an application on digita platform, the tenant, is responsible for the personal data in it and for the sign-in to it (the controller). simplidigita AI GmbH operates digita platform and processes this data on the tenant's behalf (the processor).

The tenant of the applications on show.simplidigita.ai is simplidigita AI GmbH itself, Inseli 4, 6415 Arth, Switzerland. Email: hello@simplidigita.ai

You sign in through the platform's sign-in service. For an account, it keeps your email address, your name, a hash of your password (never the password itself), your language, your roles, the time of your last sign-in and of failed attempts, and, once you turn it on, the secret of your second factor.

When you start a demo, the sign-in service creates a demo identity for you alone. It has a random address that names no person, no name and no password, and it is deleted automatically after seven days.

After you sign in, your browser holds three cookies for seven days: digita_at_<tenant> holds the sign-in, digita_rt_<tenant> renews it, and digita_csrf_<tenant> protects the forms against requests from other sites. The applications do not work without them.

The sign-in service keeps a sign-in log of sign-ins, failed attempts, sign-outs and changes to a password or a second factor, with the email address of the account, the network address the request came from and your browser's identification (user agent). The log is kept 90 days, then deleted automatically.

What you enter in an application is stored in the tenant's database. Every record keeps who created it and who last changed it, and when. An activity log records each change with who made it and which fields changed; it is kept 90 days, then deleted automatically. Records of some kinds also keep their earlier versions, each with who saved it, and note who opened them, and when. Both are kept until the record is removed for good.

When you delete a record, it is marked as deleted and kept until an administrator of the tenant removes deleted records for good. This notice sets no retention period for records: the tenant decides how long it keeps them.

In the demo applications, every visitor works on the same demo data. Whatever you enter, every other visitor of the demo can see it, and so can the administrators of simplidigita AI GmbH. Each record you create names the address of your demo identity as its author, also after the identity is deleted. The companies, people and records in the demos are invented. Please enter no real personal data. What you enter stays until simplidigita deletes it or resets the demo.

The applications, their databases and the sign-in service run on servers in Germany, on infrastructure of Hetzner Online GmbH, Gunzenhausen, Germany, a sub-processor of simplidigita AI GmbH.

Files you upload are stored by Cloudflare R2 in the EU. Cloudflare, Inc. is a sub-processor of simplidigita AI GmbH for these files.

The operational logs of the applications and of the sign-in service are collected on a server that simplidigita AI GmbH operates in Switzerland, and deleted there after 14 days. A copy stays on the application servers in Germany until newer logs replace it.

Switzerland recognizes the member states of the European Union as countries with adequate data protection. For residents of the EU and the EEA, the European Commission recognizes Switzerland as a country with adequate data protection.

You have the right to access your data, to have it corrected or deleted, to restrict its processing, and to receive a copy of the data you gave in a portable format. You may object to the processing of your data at any time.

To use a right, write to the tenant of the application. For the applications on show.simplidigita.ai, write to hello@simplidigita.ai.

You may complain to the Federal Data Protection and Information Commissioner (FDPIC) in Bern. Residents of the EU and the EEA may also complain to their own supervisory authority.

We change this notice when the applications change. Last change: 5 October 2026.