Privacy Policy

Simulithic (“Simulithic,” “we,” “us”) builds a monitoring product that runs simulated users through your production software and tells you when something breaks.

This policy explains what information we collect when you visit simulithic.com (the “Site”) or use the Simulithic product (the “Service”), how we use it, and the choices you have. If you have a question this policy does not answer, write to us at hello@simulithic.com.

Early access. The early-access section of the Site is an email form. When you submit it, we store the address you entered and the time you signed up, and we use it to follow up about early access as described below.

Usage and session data. We use our own capture script on the Site, the same one the Service uses, so we can see how the Site is used and test our product against real traffic. It records page views, clicks, scrolling, and other interactions, together with technical details such as your browser, device type, screen size, approximate location derived from your IP address, and the page that referred you. It also records a replay of your session: a reconstruction of what was on screen and how you moved through it.

Aggregate analytics. The Site uses Vercel Web Analytics, which reports page views and referrers in aggregate. It does not set cookies and does not build a profile of you across sites.

Server logs. Like every website, our hosting provider records the IP address, request path, and user agent of each request for security and reliability.

Local storage. If you signed up through an earlier version of the email form, the Site may have left a small marker in your browser (simulithic:waitlist) containing the email you entered and when. It never left your browser, nothing reads it any more, and you can clear it through your browser’s site-data settings.

We use the information above to:

• Follow up about early access and, once you have it, contact you about your account.
• Understand how people read and move through the Site so we can improve it.
• Develop and test the Service. The Site’s traffic is a real workload we use to exercise our own capture and simulation pipeline.
• Keep the Site secure and diagnose faults.
• Comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising or share it with advertisers.

Where the GDPR or UK GDPR applies, we rely on your consent when you sign up for early access; on our legitimate interest in operating, securing, and improving the Site and the Service for the usage, session, analytics, and log data described above; and on legal obligation where the law requires us to keep or disclose information.

The Service connects to a customer’s product and runs simulated users through it. In doing so we process information about how the customer’s own end users behave, which the customer provides or authorizes us to collect, and we run automated agents against the customer’s production systems.

That capture happens in the visitor’s browser before anything is sent. By default the snippet masks passwords, emails, phone numbers, payment cards, government IDs, and other sensitive fields. Workspace owners can tighten this to mask every text node and input, or leave the snippet’s own setting in place. Recordings already stored keep the masking they were captured with. We do not collect keystrokes as typed values.

For that data we act as a processor (or “service provider”) on the customer’s instructions. What we may do with it is set out in our agreement with the customer, including a data processing addendum where required. If you are an end user of a product that is monitored with Simulithic and have a question about your data, contact the operator of that product; they control it.

We also collect account information from people who use the Service directly: work email, a hashed password, workspace membership and role, and the activity of the account. We use it to provide the Service, support you, and bill for it.

We share personal information only with the providers we need to run the Site and the Service, and only for that purpose:

• Vercel, which hosts the Site and the Service and provides analytics.
• Neon, which hosts our database, including early-access signups and account data.
• The email provider we use to reach people who have signed up.
• Anthropic, which runs the models that power simulated users and analysis, on our instructions.
• Amazon Web Services, which hosts compute used to run simulations.

Each of these processes data on our behalf under a contract that restricts what they can do with it. Beyond that, we disclose information only if the law requires it, to protect our rights or someone’s safety, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to it.

Early-access signups are kept until you ask us to remove them or we close the list, whichever is first. Session recordings and usage data from the Site are kept for up to twelve months and then deleted or aggregated so they no longer identify anyone.

Server logs are kept for thirty days. Account information for the Service is kept for the life of the account and for a short period afterwards as our agreement and the law require.

Wherever you are, you can ask us what personal information we hold about you, ask us to correct it, ask us to delete it, or ask us to stop using it. Email hello@simulithic.com and we will respond within thirty days. We may need to verify your identity before acting.

If you are in the EEA, the UK, or Switzerland you also have the right to data portability, to object to processing based on legitimate interest, to withdraw consent at any time without affecting what came before, and to complain to your local supervisory authority.

If you are a California resident, the California Consumer Privacy Act gives you the right to know, delete, and correct, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

You can also stop the Site from recording your session by using a content blocker that prevents the script from loading, or by not using the Site. Signing up for early access does not depend on it. Customers of the Service can change masking, exclude paths, and remove a workspace’s data from Account.

The Site does not set advertising or cross-site tracking cookies. Our capture script may set a first-party identifier so that pages you view in one visit are recorded as one session; Vercel Analytics uses none.

The Service uses an httpOnly session cookie to keep you signed in. Beyond the local-storage marker described above, we keep nothing else in your browser.

Our providers store and process data in the United States. If you visit from elsewhere, your information will be transferred there. For transfers from the EEA, the UK, and Switzerland we rely on Standard Contractual Clauses, the UK Addendum, or another mechanism recognized under the applicable law.

Data moves between your browser and our systems over TLS and is stored with providers that encrypt it at rest. Access inside Simulithic is limited to the people who need it.

No system is perfectly secure. We do not warrant that information will never be accessed without authorization. If a breach of personal information we hold requires notice under applicable law, we will tell the people affected and the authorities as that law requires.

The Site and the Service are for businesses and are not directed at anyone under sixteen. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

When we change this policy we will post the new version here and update the date at the bottom. If a change materially affects how we use information you have already given us, we will tell people on the early-access list, and account holders, by email before it takes effect.

Questions, requests, and complaints all go to hello@simulithic.com. We read every message.

This policy describes how we handle information. It is not a contract of insurance, a warranty, or a promise that a particular result will occur. It does not create a right to sue us, to recover damages, or to proceed as a class, except where a law gives you a right that cannot be waived.

Any dispute about this policy, our handling of information, the Site, or the Service is governed by the Disputes section of our Terms of Service, including California law, a thirty-day attempt to resolve the issue by email, binding individual arbitration, a waiver of class and jury proceedings, exclusive California courts if arbitration cannot apply, and a one-year limit on claims. You may not bring that kind of claim in any other forum.

That does not affect a right you have to complain to a supervisory authority, or any other right the law does not let you waive.