Skip to content

Commit 00b036f

Browse files
authored
chore(legal): update privacy and cookie policies (#9005)
1 parent a0e5f46 commit 00b036f

2 files changed

Lines changed: 59 additions & 23 deletions

File tree

‎apps/sim/app/(landing)/cookie-policy/cookie-policy-content.tsx‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
4444
title: 'Cookie Policy',
4545
description:
4646
'What cookies Sim sets, why, how long they last, and how to change your choice at any time.',
47-
lastUpdated: 'October 8, 2026',
47+
lastUpdated: 'October 13, 2026',
4848
intro: [
4949
{
5050
kind: 'paragraph',
@@ -92,7 +92,7 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
9292
},
9393
{
9494
kind: 'paragraph',
95-
content: `We also use technologies that behave like cookies without being one. Local storage and session storage keep data in your browser rather than sending it with each request; pixels (also called web beacons or tags) are tiny images or scripts that record that a page or email was opened. Where this policy says "cookies", it means all of these.`,
95+
content: `We also use technologies that work like cookies. Local storage and session storage keep data in your browser rather than sending it with each request; pixels (also called web beacons or tags) are tiny images or scripts that record that a page or email was opened. Where this policy says "cookies", it means all of these.`,
9696
},
9797
],
9898
},
@@ -102,7 +102,7 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
102102
blocks: [
103103
{
104104
kind: 'paragraph',
105-
content: `We group cookies into the three categories the consent banner offers. Necessary cookies are always on because the service cannot run without them. The other two are off until you turn them on.`,
105+
content: `We group cookies into the three categories the consent banner offers. Necessary cookies are always on because the service cannot run without them. Analytics and Marketing cookies are off until you allow their category.`,
106106
},
107107
{
108108
kind: 'list',
@@ -117,7 +117,9 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
117117
reach, and where errors happen, so we can improve the product. Measurement only; we do
118118
not use these to target advertising. Google Analytics loads with analytics storage
119119
denied and cannot set analytics cookies until this category is allowed; before then,
120-
it may send limited cookieless consent and measurement signals.
120+
it may send limited cookieless consent and measurement signals. Ahrefs Web Analytics
121+
is cookieless; it loads only after this category is allowed and is removed if consent
122+
is withdrawn.
121123
</>,
122124
<>
123125
<strong>Marketing</strong> — measuring which campaigns bring builders to Sim and
@@ -236,6 +238,12 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
236238
],
237239
['personalization_id', 'X (Twitter)', 'Personalizes the ads shown on X.', '13 months'],
238240
['muc_ads', 'X (Twitter)', 'Measures ad conversions across X domains.', '13 months'],
241+
[
242+
'bfcid',
243+
'Freebuff',
244+
'Stores the click identifier from a Freebuff ad that brought you to sim.ai, so a sign-up can be credited to that ad. Deleted if you withdraw Marketing consent.',
245+
'30 days',
246+
],
239247
]),
240248
],
241249
},
@@ -272,7 +280,8 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
272280
</ProseLink>
273281
, <ProseLink href='https://adssettings.google.com'>Google Ads</ProseLink>,{' '}
274282
<ProseLink href='https://x.com/settings/privacy_and_safety'>X (Twitter)</ProseLink>,
275-
and <ProseLink href='https://posthog.com/privacy'>PostHog</ProseLink>.
283+
and <ProseLink href='https://posthog.com/privacy'>PostHog</ProseLink>. For Freebuff,{' '}
284+
{CHANGE_CHOICES} to withdraw Marketing consent.
276285
</>
277286
),
278287
},
@@ -294,6 +303,7 @@ export const COOKIE_POLICY_CONFIG: LegalPageConfig = {
294303
<ProseLink href='https://policies.google.com/technologies/cookies'>Google</ProseLink>{' '}
295304
(Analytics and Ads),{' '}
296305
<ProseLink href='https://x.com/en/privacy'>X (Twitter)</ProseLink>,{' '}
306+
<ProseLink href='https://freebuff.com/privacy-policy'>Freebuff</ProseLink>,{' '}
297307
<ProseLink href='https://ahrefs.com/legal/privacy-policy'>Ahrefs</ProseLink>,{' '}
298308
<ProseLink href='https://posthog.com/privacy'>PostHog</ProseLink>, and{' '}
299309
<ProseLink href='https://www.cloudflare.com/privacypolicy/'>Cloudflare</ProseLink>.

‎apps/sim/app/(landing)/privacy/privacy-content.tsx‎

Lines changed: 44 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ function richText(content: string): ReactNode {
4444
export const PRIVACY_CONFIG: LegalPageConfig = {
4545
title: 'Privacy Policy',
4646
description: 'Sim Studio, Inc. · Operating the Sim platform (sim.ai)',
47-
lastUpdated: 'September 2, 2026',
47+
lastUpdated: 'October 13, 2026',
4848
intro: [
4949
{
5050
kind: 'paragraph',
@@ -62,7 +62,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
6262
{
6363
kind: 'paragraph',
6464
content: richText(
65-
'Under the following conditions, the meanings of words with capitalized first letters are defined. The following definitions have the same meaning whether they are written in singular or plural form.'
65+
'Words with capitalized initial letters have the meanings defined below. These definitions apply whether the terms appear in singular or plural form.'
6666
),
6767
},
6868
{ kind: 'subheading', text: 'Definitions' },
@@ -263,7 +263,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
263263
],
264264
[
265265
'Behavioral remarketing',
266-
'Cookie and pixel identifiers, browser and Device data, campaign attribution, and website interaction data',
266+
'Cookie and pixel identifiers, ad click identifiers, browser and Device data, campaign attribution, website interaction data, and, for Freebuff sign-up conversions, a pseudonymous Sim Account identifier and the sign-up time',
267267
'Consent — Article 6(1)(a)',
268268
'Marketing cookies and ad personalization require Marketing consent. Google Ads may load earlier with ad storage denied and send limited cookieless consent signals. Consent may be changed or withdrawn through the cookie preferences link.',
269269
],
@@ -296,7 +296,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
296296
{
297297
kind: 'paragraph',
298298
content: richText(
299-
"Where Sim processes customer content on behalf of a customer, Sim acts as a processor, the customer is the controller, and the customer determines the applicable legal basis. That processing is governed by the Data Processing Addendum and the customer's documented instructions."
299+
"Where Sim processes customer content on behalf of a customer, Sim acts as a processor, the customer is the controller, and the customer determines the applicable legal basis. That processing is governed by the customer's agreement with Sim, including any data processing addendum in force between them, and the customer's documented instructions."
300300
),
301301
},
302302
],
@@ -343,12 +343,12 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
343343
},
344344
{
345345
id: 'transfer-of-data',
346-
heading: '3. Transfer Of Data',
346+
heading: '3. Transfer of Data',
347347
blocks: [
348348
{
349349
kind: 'paragraph',
350350
content: richText(
351-
"Your information, including Personal Data, may be transferred to and maintained on computers outside Your state, province, country, or other governmental jurisdiction, where data protection laws may differ. If You are outside the United States and provide information to us, we transfer the data to the United States and process it there. Sim's primary hosting region is AWS us-east-1 in the United States. The current Service Provider list is maintained on the Sub-processors page."
351+
"Your information, including Personal Data, may be transferred to and maintained on computers outside Your state, province, country, or other governmental jurisdiction, where data protection laws may differ. If You are outside the United States and provide information to us, we transfer the data to the United States and process it there. Sim's primary hosting region is AWS us-east-1 in the United States. The current list of sub-processors is published at [trust.sim.ai/subprocessors](https://trust.sim.ai/subprocessors)."
352352
),
353353
},
354354
{
@@ -473,7 +473,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
473473
},
474474
{
475475
id: 'disclosure-of-data',
476-
heading: '4. Disclosure Of Data',
476+
heading: '4. Disclosure of Data',
477477
blocks: [
478478
{ kind: 'subheading', text: 'Business Transactions' },
479479
{
@@ -510,7 +510,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
510510
},
511511
{
512512
id: 'security-of-data',
513-
heading: '5. Security Of Data',
513+
heading: '5. Security of Data',
514514
blocks: [
515515
{
516516
kind: 'paragraph',
@@ -553,7 +553,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
553553
{
554554
kind: 'paragraph',
555555
content: richText(
556-
"Every Service Provider that processes Personal Data on Sim's behalf is engaged under a written data processing agreement that imposes confidentiality, purpose limitation, security, and sub-processor controls. Each provider is security-reviewed before onboarding and periodically thereafter and acts only on Sim's documented instructions. The current provider list is maintained on the Sub-processors page."
556+
"Every Service Provider that processes Personal Data on Sim's behalf is engaged under a written data processing agreement that imposes confidentiality, purpose limitation, security, and sub-processor controls. Each provider is security-reviewed before onboarding and periodically thereafter and acts only on Sim's documented instructions. The current list of sub-processors is published at [trust.sim.ai/subprocessors](https://trust.sim.ai/subprocessors)."
557557
),
558558
},
559559
],
@@ -577,7 +577,31 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
577577
{
578578
kind: 'paragraph',
579579
content: richText(
580-
'The Company uses Google Ads, Twitter, and Facebook remarketing services to advertise on third-party websites after You visit the Service. These services operate through non-essential Cookies and similar technologies. Marketing Cookies and ad personalization are enabled only after You give consent to the Marketing category in the cookie banner. Google Ads may load before that consent with ad storage denied and send limited cookieless consent signals, as described in the Cookie Policy.'
580+
'Sim advertises through Google Ads, X, and Freebuff, and measures which ads lead to sign-ups and demo bookings. These services use non-essential Cookies, pixels, and similar technologies. Marketing Cookies and ad personalization are enabled only after You consent to the Marketing category in the cookie banner.'
581+
),
582+
},
583+
{
584+
kind: 'paragraph',
585+
content: richText(
586+
'**Google Ads.** The Google tag loads before a consent choice under Google Consent Mode v2, with ad storage denied, and may send limited cookieless signals, as described in the Cookie Policy. After Marketing consent, Sim reports demo bookings to Google Ads.'
587+
),
588+
},
589+
{
590+
kind: 'paragraph',
591+
content: richText(
592+
"**X.** The X pixel loads on Sim's marketing pages only after Marketing consent. It reports page views and demo bookings."
593+
),
594+
},
595+
{
596+
kind: 'paragraph',
597+
content: richText(
598+
'**Freebuff.** After Marketing consent, the Freebuff tag stores the click identifier from a Freebuff ad. When You sign up, Sim sends Freebuff that click identifier, the event type, a pseudonymous Sim Account identifier, and the sign-up time so the sign-up can be credited to the ad. Sim does not send Your name or email address.'
599+
),
600+
},
601+
{
602+
kind: 'paragraph',
603+
content: richText(
604+
'Where the GDPR applies, Sim and each of these platforms are joint controllers for collecting this data on sim.ai and sending it to the platform. Sim is responsible for this notice and for obtaining and recording consent. Each platform is an independent controller for its own later processing, including ad delivery, measurement, and profiling, as described in its privacy policy. You may exercise Your rights with Sim under section 14 or with the platform directly.'
581605
),
582606
},
583607
{
@@ -595,9 +619,11 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
595619
items: [
596620
richText('Google Ads: [Google Ads Settings](https://adssettings.google.com/)'),
597621
richText(
598-
'Twitter: [Personalization and data settings](https://twitter.com/settings/account/personalization)'
622+
'X: [Personalization and data settings](https://x.com/settings/privacy_and_safety)'
623+
),
624+
richText(
625+
'Freebuff: withdraw Marketing consent through the cookie preferences link; Sim then deletes the Freebuff click identifier cookie'
599626
),
600-
richText('Facebook: [Ad preferences](https://www.facebook.com/adpreferences/)'),
601627
],
602628
},
603629
],
@@ -744,7 +770,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
744770
{
745771
kind: 'paragraph',
746772
content: richText(
747-
'Model providers are engaged as sub-processors under Data Processing Addenda and are identified on the Sub-processors page. Customer content sent to a model provider is not used by Sim or by that provider to train or improve generalized or shared models. This commitment applies to customer content generally and restates the Google Data Limited Use commitment in section 10 for Google Data.'
773+
'Model providers are engaged as sub-processors under Data Processing Addenda and are listed at [trust.sim.ai/subprocessors](https://trust.sim.ai/subprocessors). Customer content sent to a model provider is not used by Sim or by that provider to train or improve generalized or shared models. This commitment applies to customer content generally and restates the Google Data Limited Use commitment in section 10 for Google Data.'
748774
),
749775
},
750776
{
@@ -775,7 +801,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
775801
},
776802
{
777803
id: 'links-to-other-sites',
778-
heading: '11. Links To Other Sites',
804+
heading: '11. Links to Other Sites',
779805
blocks: [
780806
{
781807
kind: 'paragraph',
@@ -792,14 +818,14 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
792818
{
793819
kind: 'paragraph',
794820
content: richText(
795-
"The Service is not directed at anyone under the age of 18, and Sim does not knowingly collect or process children's Personal Data. If children's Personal Data has been collected inadvertently without appropriate parental consent, Sim will take the necessary steps to erase it from its records. Anyone who believes that Sim has collected children's Personal Data should contact privacy@sim.ai so the matter can be addressed promptly."
821+
"The Service is not directed at anyone under the age of 18, and Sim does not knowingly collect or process children's Personal Data. If Sim learns that it has collected Personal Data from anyone under 18, it will delete that data. Anyone who believes that Sim has collected children's Personal Data should contact privacy@sim.ai so the matter can be addressed promptly."
796822
),
797823
},
798824
],
799825
},
800826
{
801827
id: 'changes-to-policy',
802-
heading: '13. Changes To This Privacy Policy',
828+
heading: '13. Changes to This Privacy Policy',
803829
blocks: [
804830
{
805831
kind: 'paragraph',
@@ -897,7 +923,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
897923
{
898924
kind: 'paragraph',
899925
content: richText(
900-
'We do not sell Personal Information for monetary consideration. Some analytics or advertising disclosures may be considered a "sale" or "share" under California law. You may opt out by contacting privacy@sim.ai or by using the cookie preferences link.'
926+
'We do not sell Personal Information for money. When Marketing Cookies are enabled, Sim makes identifiers and internet activity on sim.ai available to Google, X, and Freebuff for advertising and ad measurement. This includes cookie and click identifiers, pages visited, and conversion events. California law may treat this as a "sale" or "sharing" of Personal Information. You may opt out at any time through the cookie preferences link, by sending a Global Privacy Control signal, or by emailing privacy@sim.ai. Sim does not knowingly sell or share the Personal Information of consumers under 16.'
901927
),
902928
},
903929
{ kind: 'subheading', text: 'Global Privacy Control' },
@@ -1004,7 +1030,7 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
10041030
{
10051031
kind: 'paragraph',
10061032
content: richText(
1007-
'Reports should be provided in English where possible. If You provide contact information, we will communicate in a transparent and timely manner. We will acknowledge receipt within three business days and will keep You informed about validation and remediation to the extent possible.'
1033+
'Reports should be provided in English where possible. If You provide contact information, we will communicate in a transparent and timely manner. We will keep You informed about validation and remediation to the extent possible.'
10081034
),
10091035
},
10101036
],

0 commit comments

Comments
 (0)