Privacy notice

Updated 13 October 2026.

Who we are

Simple & Tidy is provided by Duck & Dough Ltd, company number 16454504, registered in England and Wales. Our registered office is 37 Marlborough Road, Brynmill, Swansea, SA2 0DZ, United Kingdom. Contact simplendtidy@gmail.com or +44 7757 116730 about privacy.

What we collect and why

We use your account and contact details to provide access, operate your subscription and respond to requests. This is necessary to provide our contract with you or take steps you request before entering it. When a business contact acts for a company, our legitimate interest is administering that company's service. We use subscription and billing records to meet accounting and legal duties. Our legitimate interests in protecting accounts and resolving faults support proportionate technical and security logs.

You supply business records, customer and supplier contact details, documents, images and support messages. The business using the workspace controls the purposes of its customers' data and is responsible for its lawful basis and notices. We process those records on its instructions under our data-processing terms. Do not enter passwords, full card details or unnecessary sensitive information in notes. Providing an email address is necessary to create a login; optional images, voice and mailbox connections are your choice. We do not sell workspace data or use it for advertising, and do not make legally significant automated decisions about you.

Service providers and locations

Supabase provides authentication, the database and private file storage. The current database project is in London. OpenAI Sites and Cloudflare host the website and public application files and process connection information needed to serve and protect them. Stripe processes subscription payments and maintains its own regulated payment records; the app receives customer and subscription identifiers and status, not your full card number. Ordinary customer bank transfers are outside Stripe and are recorded manually by the business.

Providers and their support teams may process information outside the UK, including in the United States. Relevant safeguards are described in the providers' agreements, including the Supabase data-processing addendum and its UK transfer addendum, Cloudflare data-processing terms, and Stripe transfer terms. These cover standard contractual clauses and applicable UK addenda for restricted transfers. Contact us for information or a copy of the safeguards relevant to your data.

Voice, email and customer links

Your device or browser's speech provider may process audio and catalogue hints when you use voice input. Simple & Tidy does not save microphone recordings. You can stop voice input or withdraw microphone permission in your device settings. The speech provider's own privacy terms also apply.

You can prepare an invoice in your own email app. An optional authorised Gmail or Microsoft connection can send reviewed invoices from your mailbox where configured. We request identification and sending permission, not inbox-reading permission. Refresh tokens are encrypted on the server and removed on disconnection or account deletion. Provider acceptance does not guarantee delivery. Disconnect in the app or revoke the connection with the email provider to stop future sending.

A shared link reveals the selected document, including relevant business, customer and payment details, to anyone holding the link. Choose its expiry and revoke it when no longer needed. A quote response records the entered name, decision, date and link reference; it is not independent identity verification. Revocation cannot remove a recipient's downloaded copy.

Cookies, local storage and the demo

The app stores session information, language choices and recoverable drafts in your browser. A separately chosen encrypted offline copy holds records and images on your trusted device, protected by a passphrase we cannot recover. Edits remain local until synchronised. Public application files are cached for offline opening. Clearing browser data can remove local copies. Exported backup files are not encrypted. The public demo uses fictional records held only in the open page and resets when you leave or reload. It does not create an account. We do not add advertising or behavioural analytics scripts.

How long we keep information

Account and workspace records remain while you retain the account, including during a cancelled subscription so that you can read and export them. You can delete individual records where the app permits or request account deletion. Account deletion removes active records, images and mailbox credentials. Support and security information is retained only while needed to handle the request, investigate an incident, maintain an audit trail or resolve a dispute; we assess that need when a matter closes and when you request deletion.

Our company accounting records are kept for six years from the end of the financial year they concern, or longer when law, an HMRC enquiry or an unresolved claim requires it. This does not require us to keep the contents of your customers' workspace indefinitely. Payment providers may keep their separate transaction records under their own legal obligations. Residual infrastructure recovery copies follow the relevant provider's retention and deletion arrangements and are not an active workspace; contact us for the arrangements applicable to a deletion request. Documents you export or send remain with their holders.

Your rights and choices

You may request access, correction, deletion, restriction or a portable copy, subject to applicable conditions. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Email us to exercise these rights; we may verify your identity. If another business entered your information, contact that business first and we will assist it with relevant requests. You can complain to the UK Information Commissioner's Office. We will update this notice when processing changes and communicate material changes where appropriate.