Privacy policy

Status: August 22, 2026

1. Responsible person

General contact and data protection inquiries: info@simadoo.com
Technical support: support@simadoo.com

2. Accessing the website and IONOS web hosting

This website is hosted by IONOS SE. When you access the website, the hosting service processes the technically necessary connection data so that the requested content can be transferred to your device and secure, stable operation can be guaranteed. According to IONOS, the referrer, requested website or file, browser type and browser version, operating system, device type, access time and an anonymized IP address are recorded.

The processing is carried out on the basis of Article 6 Paragraph 1 Letter f GDPR. Our legitimate interest lies in the secure, stable and error-free provision of this website. IONOS specifies a storage period of eight weeks for visitor data. According to IONOS, this visitor data will not be passed on to third parties and will not be transferred to countries outside the European Union.

Information from IONOS on data processing through web hosting products

3. IONOS WebAnalytics

IONOS WebAnalytics is taken into account for the IONOS web hosting used. IONOS states that tracking and logging are activated by default and the determination takes place either via a log file or a pixel. No client-side analytics script or external analytics pixel was detected during the technical review of this website; Server-side access logs are in place.

According to IONOS, WebAnalytics does not use cookies. The IP address transmitted when you access the page is immediately anonymized after transmission and then processed without any personal reference. The referrer, requested page or file, browser type and browser version, operating system, device type, access time and the anonymized IP address are recorded. The data is used exclusively for statistical evaluation and technical optimization of the website. IONOS states that it does not store any personal visitor data in WebAnalytics and does not pass on any data to third parties.

If the short-term processing of the IP address until anonymization is personal, it is carried out on the basis of Art. 6 Para. 1 Letter f GDPR. Our legitimate interest lies in the technical optimization and needs-based design of the website.

Information from IONOS about WebAnalytics

4. WordPress and IONOS system components

The website is powered by WordPress. IONOS components for hosting integration, security, performance, cache and administrative login as well as technically necessary must-use components are also active. They support the operation and security of the WordPress installation. When checking the publicly accessible pages, no additional requests to third-party providers, no publicly set cookies and no entries in local storage or session storage were triggered.

5. Cookies and storage in the browser

According to the current state of technology, the publicly accessible pages do not set cookies and do not store any information in local storage or session storage. No analysis, advertising, newsletter, shop or payment functions are used. Therefore, no consent banner is currently displayed.

WordPress can set technically necessary login and session cookies when you log in to the non-public administration area. These do not affect regular visitors to the public website.

6. Local media and external content

Logo, symbols and SiMaDoo screenshots are loaded locally from this web server. The screenshots contain only fictitious sample data. External fonts, embedded videos, maps, social media plugins or comparable third-party content are not integrated.

The data protection declaration contains normal links to IONOS information pages and to the responsible data protection supervisory authority. Only when you access such an external link does your browser establish a connection to the respective provider. The respective provider is responsible for the processing there.

7. Contact via email

If you contact us by email, we process the information you provide, in particular your email address, the content of the message and the associated communication data, in order to process and respond to your request.

If your request relates to a contract or pre-contractual measures, Art. 6 Paragraph 1 Letter b GDPR is the legal basis. For other inquiries, processing is carried out on the basis of Article 6 Paragraph 1 Letter f GDPR; Our legitimate interest lies in properly answering inquiries about SiMaDoo. Email service providers involved in email transmission can process the data to the extent this is technically necessary.

We delete the data when the request has been finally processed and there are no legal retention obligations or other legal reasons for further storage.

8. Encrypted transmission

The website is transmitted via HTTPS. This means that the content transmitted between your browser and the web server is encrypted during transport.

9. Your Privacy Rights

In accordance with the legal requirements, you have the right to information about your personal data (Article 15 GDPR), correction of incorrect data (Article 16 GDPR), deletion (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR). You can revoke your consent at any time with future effect. To exercise your rights, simply send a message to info@simadoo.com.

10. Objection to processing based on legitimate interests

You can object to processing based on Article 6 Paragraph 1 Letter f of the GDPR at any time for reasons relating to your particular situation. We will then no longer process the data concerned unless there are compelling legitimate reasons or the processing serves to assert, exercise or defend legal claims.

11. Right to complain

You have the right to complain to a data protection supervisory authority. The Hessian Commissioner for Data Protection and Freedom of Information is particularly responsible for the location of the person responsible. Information and the complaint form can be found at datenschutz.hessen.de/service/beschwerde-uebermittel.

12. Automated decisions

There is no automated decision-making or profiling on this website.

13. Changes to this Privacy Policy

This data protection declaration will be adjusted if the technology used, the website domain or the legal requirements change.

14. Voluntary SiMaDoo AI assistant

14.1 Purpose and deliberate activation

The assistant, clearly identified as AI, is an optional help feature for general questions about using SiMaDoo. Before a question is transmitted, the user must explicitly confirm in the chat window that it may be sent for processing by the AI service. No question is sent without this confirmation. Consent may be withheld or withdrawn for future questions by closing the assistant or clearing the confirmation; all other functions remain available.

14.2 Data, services and recipients

A request sends the entered question, selected language and internal name of the currently visible SiMaDoo area through a protected Firebase Cloud Function to the OpenAI Responses API. For authentication and protection, Firebase Authentication, App Check (reCAPTCHA Enterprise on web, Play Integrity on Android, and App Attest with DeviceCheck fallback on iOS), Cloud Functions, Cloud Firestore, Secret Manager and Cloud Logging also process the signed-in session's user ID, App Check attestations, timestamps and usage counters, and technically necessary connection, status and error data. Recipients or processors are Google Ireland Limited and affiliated Google companies, and OpenAI Ireland Limited and their subprocessors.

Cashbox, event, member, booking, receipt, contact or other user data is not automatically read from SiMaDoo or sent to OpenAI. Previous chat history is not automatically attached again. Personal or confidential information may nevertheless be transmitted if the user writes it into the input field.

14.3 Legal basis and international transfers

The voluntary question is processed on the basis of consent under Article 6(1)(a) GDPR. Security, abuse-prevention and rate-limit data is also processed on the basis of our legitimate interest in a safe and stable service under Article 6(1)(f) GDPR. Google and OpenAI may process data outside the EEA, particularly in the United States. Depending on the processing, transfers rely on an adequacy decision including the EU-US Data Privacy Framework or appropriate safeguards such as the EU Standard Contractual Clauses.

14.4 Storage and deletion

SiMaDoo does not store the question or answer in cashbox, event or user data and does not log their content in server logs. The displayed chat remains only in the running browser page and is not stored as chat history in local storage. Cloud Firestore stores only user-linked counters and timestamps for rate limiting. There is currently no separate automatic deletion period for this counter; it is updated during later use and deleted when no longer required for protection and rate limiting or following a justified deletion request unless a retention duty applies. Technical Cloud logs contain request ID, model, token counts, status and error codes, but not the question or answer, and are deleted under the retention settings configured for the Google Cloud project.

The OpenAI request uses store: false. This means that the response is not stored as application state for later retrieval through the API. It does not exclude all technical processing or logging: under OpenAI's standard data controls, safety and abuse-monitoring logs may generally contain inputs, outputs and technical metadata for up to 30 days, with longer retention where legally required or necessary to prevent abuse. OpenAI does not use API data to train its models by default unless the account holder explicitly opts in.

14.5 Safeguards and sensitive information

Transmission is encrypted. The OpenAI key is held only server-side in Google Secret Manager. An active SiMaDoo session and a valid App Check attestation are required. Inputs are screened for typical email addresses, API keys, invitation codes, IBANs and payment-card numbers; current limits are five requests per minute and 30 per day. Filters cannot identify every sensitive item. Do not enter passwords, credentials, bank or card details, invitation codes, receipts, names or other confidential information.

14.6 Public AI product advisor on simadoo.com

The public language pages allow use without a manually created app account. Only after explicit consent does the page load Firebase and App Check with reCAPTCHA Enterprise, automatically establish an anonymous Firebase session and transmit the current question, selected language and up to four earlier questions entered on that open page. Assistant answers, app data, cashboxes, events, bookings, contacts and invitation codes are not read as conversation context. reCAPTCHA Enterprise and Firebase process the anonymous session identifier, App Check evidence and necessary technical connection, device and risk signals, including the IP address.

The public path is restricted to simadoo.com, requires App Check and anonymous authentication, filters typical sensitive details and permits up to three AI requests per minute and twelve per anonymous session and UTC day. A binding global up to of 100 AI requests per UTC day, 600 characters per question and 500 output tokens also applies. No OpenAI request is made after the global limit is reached. Questions and answers are not stored in Firestore or content logs; the chat remains only in the memory of the open page. Pseudonymous session and global usage counters carry a deletion time after 35 days and are removed by the configured Firestore TTL policy. Sections 14.2 to 14.5 concerning OpenAI, legal bases, international transfers, technical logs and store: false apply accordingly.

For privacy matters concerning the AI assistant, contact info@simadoo.com. Further information is available in the OpenAI data controls, the OpenAI Data Processing Addendum and the Firebase privacy and security information.

15. SiMaDoo app, shared data and store purchases

15.1 App identity and shared content

The SiMaDoo app uses Firebase Authentication for a personal account with an email address and password. Email verification protects the clear assignment of cashboxes, events, roles and invitations and enables sign-in on another device. Depending on use, the app processes cashbox and event names, roles and display names, invitations, income, deposits, expenses, notes, categories, settlements, optional receipt images, device and push identifiers, and technical security and error data. Authorised members or participants in the same cashbox or event can see the content required for shared use. SiMaDoo does not execute bank transfers and does not receive bank-account or payment-card details.

15.2 App Store and Google Play

Digital purchases are processed by Apple App Store/StoreKit or Google Play Billing. To verify purchases and provide access, SiMaDoo processes the store product identifier, a hashed or platform transaction reference, purchase, restoration and refund status, and the start and end of free and paid entitlements. This data is linked to the pseudonymous app identity and used for app functionality, fraud prevention, restoration and refund handling. Time-limited purchases do not renew automatically; a twelve-month period already purchased starts only after the individual free introductory period ends.

15.3 Retention and account deletion

Full account deletion can be initiated in the app under “Secure access and manage devices” → “Delete account and data”. The server records the deletion request and revokes all associated device sessions. Personal data is deleted or, where shared settlements, other participants’ rights or legal retention duties prevent deletion, restricted or anonymised to the necessary extent. Further details are available on the Delete account and data page.