Legal
Privacy policy
What we collect, why, and what you can ask us to do with it.
Updated
In short
This privacy policy explains how SimpleERP handles personal data. We collect what is needed to run your account and your business records, never sell it, store it in Singapore, and you can access, correct, export or delete your data.
Who is responsible
SimpleERP is run by SimpleERP, operated from India, for businesses in any country. For your account, sign-in and our website, we decide how personal data is used (we are the controller). For the business records you enter, such as customers, suppliers and employees, your business decides and we process that data on your instructions to provide SimpleERP (we are the processor).
What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, email address, password hash, optional phone number, and the page you first landed on | To create your login and keep it secure; the landing page tells us which pages bring people to SimpleERP |
| Business records | Customers, products, invoices, employees, payslips, attachments | To provide the service you use; this is your data |
| Session and security | IP address, browser, sign-in times, audit history | To keep sessions secure, limit abuse and show who changed what |
| Analytics | Pages viewed, clicks and recordings of sessions on our production site, tied to your account once you sign in; anonymous page-view counts | To see where the site and product are hard to use and fix them |
| Contact form | Name, business name, phone, optional email, your message, and the IP address and browser it was sent from | To reply to you and to keep spam out |
We use account, security and contact data to provide the service you signed up for and to keep it secure. Analytics are optional, as described below.
Cookies and analytics
| Cookie or tool | What it does | When |
|---|---|---|
| Session cookie | Keeps you signed in (httpOnly, so page scripts cannot read it) | Always; essential |
| Last business | Remembers the business you opened last | Always; essential |
| erp_country, erp_country_chosen | Remember your country, and whether you chose it, so prices show in your currency | Always; essential |
| erp_consent | Remembers your answer to the analytics question, for one year | When you answer |
| erp_landing | Remembers the first page you visited, for 90 days; stored with your account when you sign up | On your first visit |
| PostHog | Product analytics and session recordings, with an identifier in a cookie and local storage | On our production site, after you accept if you are in the EEA, the UK or Switzerland; otherwise unless you decline |
| Vercel Web Analytics | Anonymous page-view statistics, without cookies | On the marketing site, on the same terms as PostHog |
If you are in the European Economic Area, the United Kingdom or Switzerland, a bar asks before any analytics run, and nothing runs until you accept. You can change your answer by clearing the erp_consent cookie, or by writing to us. There are no advertising cookies.
Where your data is stored, and who processes it
| Provider | What it does | Where |
|---|---|---|
| Vercel | Runs the application and the website; Web Analytics | Singapore region |
| Supabase | Hosts the PostgreSQL database with your account and business records | Singapore |
| Cloudflare R2 | Stores files you attach, such as receipts and bills | Not pinned to a region or jurisdiction (Cloudflare's default placement) |
| Resend | Sends invitations, password resets and replies by email | United States |
| PostHog | Product analytics and session recordings | United States |
Professional advisers or authorities receive personal data only where the law requires it. We do not sell personal data or share it for advertising. We will update this list before we add a provider that processes your personal data.
International transfers
Your data is stored outside your country unless you are in Singapore, and some of it is processed in the United States. Where the law where you are requires safeguards for such transfers, such as the GDPR or UK GDPR, we rely on the safeguards our providers offer, such as standard contractual clauses. Ask us for details.
Data processing agreement
If your business is subject to the GDPR, UK GDPR or a similar law and needs a data processing agreement for the records you keep in SimpleERP, write to simpleerpsoftware@gmail.com and we will send one.
How long we keep it
We keep account and business data while your account is open. When you close it, we delete or anonymise it within a reasonable period, except records we must keep by law, such as tax records. Analytics data is kept for as long as our analytics provider's retention allows and no longer than we need it. Contact form messages are kept for as long as needed to deal with your request.
How we protect it
Each business's data is isolated by database row-level security, passwords are hashed with scrypt, sessions can be revoked, and every change to documents and masters is recorded. The security page explains what is enforced today and what depends on hosting.
Your rights
Wherever you are, you can ask us to:
- Tell you what personal data we hold about you and how we use it, and give you a copy
- Correct or complete it; most of it you can edit yourself in the product
- Delete it, subject to what the law requires us to keep
- Restrict or object to how we use it, and decline or withdraw consent to analytics
- Give you your data in a format another service can read; every report exports to CSV
- Withdraw consent where we rely on it
Write to simpleerpsoftware@gmail.com. We reply within one month. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority, such as the Information Commissioner's Office in the UK. If your employer or another business entered your data in SimpleERP, ask them first; we will help them answer you.
If you are in India
We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. You can nominate someone to exercise your rights for you. Our grievance officer can be reached at simpleerpsoftware@gmail.com; we acknowledge complaints within 24 hours and aim to resolve them within 15 days. If we do not resolve your complaint, you can approach the Data Protection Board of India.
Changes to this policy
We will tell you about material changes to this policy by email or in the product before they apply.
Related
Keep reading
Terms
The terms for using SimpleERP: your account, your data, fees, availability and Indian jurisdiction.
Read moreRefund policy
The trial is free, so there is nothing to refund; Premium follows the refund rules on this page and your written agreement.
Read moreSecurity
How SimpleERP protects your data today: row-level security, scrypt passwords, revocable sessions, audit history and CSV export.
Read moreContact
Send a message to the SimpleERP team about pricing, moving your data or anything else, and a person replies.
Read more
Run your whole business from one simple place.
Seven days free. No card. Your first invoice in minutes.