Privacy Policy.

Simple4u builds AI systems for small and mid-size businesses, working under the client's team. This Privacy Policy describes how Simple4u (Very Simple Solutions Inc., "we", "us") handles personal data in two contexts: (1) visitors to simple4u.io, and (2) personal data we process on behalf of clients during retainer engagements.

For engagement-specific processing, the binding terms are in your Master Service Agreement (MSA) and our Data Processing Agreement (DPA). This Privacy Policy provides the public-facing summary.

1. Who we are

Simple4u is the trade name of Very Simple Solutions Inc., a New York corporation based in Brooklyn, NY. Simple4u builds AI systems for small and mid-size businesses: software development, AI infrastructure, creative production, SEO, and ongoing technical operations, delivered by the team under a monthly retainer.

The point of contact for privacy questions is office@simple4u.io.

2. Information we collect

Website (simple4u.io)

When you visit the website, we and the services below collect:

• Analytics: Google Analytics 4 collects standard metrics (pages viewed, referrer, approximate location at city level, device type) tied to a pseudonymous client identifier. With the advertising tags on, Google may also link these visits to your Google account if you are signed in to Google and allow ad personalization (Google signals).
• Advertising tags (Google Ads, Meta Pixel): These tags tell Google and Meta that a browser visited our site. We use them to measure our ads and to show our ads to people who have visited. Google and Meta receive the page address, your IP address, browser details and their own cookie identifiers, and may connect this with your Google or Meta account under their own policies. When you book a call on the site, Google Ads and Meta record that a call was booked; when you send us a request through the form or the chat, Meta records a lead. Neither receives your name, email or messages. These tags stay off when your browser sends a Global Privacy Control signal, when you turn them off on this site, or when your device is set to a European time zone (see Cookies).
• Search Console: Aggregate keyword data, no individual identification.
• Discovery calls (Calendly): Name, email address, and any notes you choose to provide when booking a call.
• Online purchases (Stripe): Name, email, phone, billing address, business name and website, which you enter at checkout. Stripe handles the card; we never see or store the card number.
• AI chat: If you use the AI front desk on our sites: your messages and its replies, the page you were on, how you arrived (the campaign tag on the link that brought you, the first page you opened and the domain of the site you came from), which next step you clicked in the chat, and a hashed version of your IP address, used for rate limits. Anthropic, our AI provider, processes the messages to write the replies. We keep conversations on our server for 90 days to review and improve the answers. If you give your email in the chat, it is sent to us with your messages through Telegram, where we receive leads, and kept with our business correspondence so we can reply.
• Email correspondence: If you email us, we retain the message and any contact details you include.

Retainer engagements

If your business engages Simple4u under a Master Service Agreement, we may process personal data within the scope of the engagement. The categories depend on which capabilities are in scope (software development, marketing operations, AI infrastructure, etc.) and are documented in the engagement-specific DPA. Typical categories include:

• Business communications you direct us to ingest (emails, messages, docs in workspaces you grant access to)
• Analytics data from instrumentation we operate on your behalf (GA4, Search Console, Google Ads, Meta Ads)
• Customer or contact data within tools we manage as part of the engagement (CRM, project management, support systems)

We do not process this data for our own purposes. We process it only on documented instructions from the Client, as a Data Processor under GDPR Article 28 / CCPA terms.

3. How we use information

Website data

• Understand how the site is used and which pages convert
• Improve content based on what visitors actually search for and read
• Schedule and prepare for discovery calls you book
• Bill a plan you bought, send receipts, and schedule its kickoff
• Respond to messages you send us
• Answer your questions in the AI chat, and review conversations to fix wrong answers

Engagement data

• Deliver the services scoped in the MSA
• Operate analytics, marketing, and engineering infrastructure on the Client's behalf
• Generate reports and recommendations for the Client

We do not sell personal data for money. We do not use Client data to train models shared across clients. We do not repurpose engagement data for marketing back to the Client's customers.

4. Data storage and security

Website analytics and advertising data live with their respective providers (Google Analytics, Google Ads, Meta). Discovery call bookings live in Calendly. Purchases and billing records live in Stripe. AI chat conversations live on our own server for 90 days. Email correspondence lives in our corporate Gmail.

For retainer engagements, infrastructure choices are agreed in the MSA. Default posture: Client data stays on infrastructure under the Client's control or under VSS Inc-controlled infrastructure provisioned per engagement (DigitalOcean droplets, Vercel deployments, etc.). Access is restricted to authorized VSS Inc personnel via SSH key and OAuth, with no shared databases between clients.

Security measures include SSH-key-only authentication, credential isolation per engagement, daily backups, and quarterly access review. Specific measures for an engagement are documented in the DPA.

5. Third-party services and sub-processors

The website uses the following third-party services:

• Google LLC: Analytics, Ads, Fonts
• Meta Platforms, Inc.: Ad measurement and audiences (Meta Pixel)
• Calendly LLC: Discovery call booking
• Stripe, Inc.: Payments for plans bought online
• Anthropic, PBC: The AI model behind the chat on our sites
• DigitalOcean, LLC: Hosting for the AI chat
• Telegram Messenger Inc.: Delivery of website form and chat leads to our team
• Vercel Inc.: Site hosting
• Cloudflare Inc.: DNS

For retainer engagements, sub-processors depend on which services are in scope. Common sub-processors include Anthropic (Claude API), Google (Workspace integrations, Ads), Stripe (payments), and DigitalOcean / Vercel (hosting). The full sub-processor list applicable to your engagement is in your DPA, with at least 30 days' notice before adding a new sub-processor.

6. Data sharing

We do not sell or rent personal data for money. We disclose data only:

• To sub-processors strictly to deliver the services described above
• To Google and Meta through the advertising tags described in section 2, which stay off under Global Privacy Control, when you turn them off on this site, or in a European time zone (see your choices)
• To comply with valid legal process (subpoena, court order)
• To protect against fraud or abuse of our infrastructure
• In a corporate transaction (acquisition, asset sale), with notice to affected parties

7. Your rights

Depending on your jurisdiction, you have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to processing or withdraw consent.

For website data, contact office@simple4u.io. For engagement data where Simple4u is a Processor, please direct your request to the Client (Data Controller); we will assist the Client in fulfilling the request, as required by GDPR Article 28.

California residents can opt out of our advertising tags. We do not sell personal data for money. The tags (Google Ads, Meta Pixel) share information about your visit with Google and Meta so we can show our ads to people who have visited the site, which California law can treat as a “sale” or “sharing” of personal information. To opt out, use the switch below or turn on Global Privacy Control in your browser. If neither works for you, email office@simple4u.io and we will help. The site does not respond to the browser “Do Not Track” setting, which has no common standard; it does honor Global Privacy Control.

Advertising tags on simple4u.io in this browser: on. Turn them off. Cookies already set stay until they expire or you clear them. simple4u.ai has its own switch.

8. Cookies

The site uses a small set of cookies:

• Google Analytics (_ga, _ga_J6MJTV7XN1): Pseudonymous analytics. Expires after 24 months.
• Google Ads (_gcl_au, and _gcl_aw after a click on one of our Google ads): Conversion attribution from Google Ads. Expire after 90 days.
• Meta Pixel (_fbp, and _fbc after you follow a link from Facebook or Instagram): Lets Meta recognize this browser for ad measurement and audiences. Expire after 90 days.
• Cookie notice (cookieNoticeDismissed): Remembers that you closed our cookie notice. Kept in your browser’s local storage and never sent to us.
• Advertising switch (s4uAdsOff): Remembers that you turned the advertising tags off on this site. Kept in your browser’s local storage and never sent to us.

The Google Ads and Meta cookies are not set when your browser sends a Global Privacy Control signal, when you turn the advertising tags off on this site, or when your device is set to a European time zone, including EU territories outside Europe. We go by the time zone set on your device, not by where you are. With the advertising tags off, Google Analytics still counts visits, and Google may use these visits and bookings to measure our ads, without advertising cookies or ad personalization. You can also block cookies in your browser settings, and turn off personalized ads in your Google and Meta ad settings.

9. Google API Services User Data Policy: Limited Use

When a retainer engagement involves Google Workspace data (Gmail, Drive, Calendar) or Google Ads data, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data accessed during an engagement is used only to provide the services agreed in the MSA
• We do not transfer Google user data to third parties except as necessary to provide those services, comply with legal process, or upon explicit Client instruction
• We do not use Google user data for serving advertisements or for any model training across clients
• We do not allow humans to read Google user data unless required for security, debugging, or support, with Client consent

10. Data Processing Agreement (DPA)

For Clients in regulated jurisdictions (EEA, UK, California, etc.), our DPA is incorporated by reference into the MSA. The DPA covers GDPR Article 28 obligations, sub-processor management, security commitments, breach notification, and Standard Contractual Clauses for international transfers.

11. Children's privacy

The site is intended for businesses, not for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data through the site, contact us and we will delete it.

12. Changes

We may update this Privacy Policy as our practices evolve. The "Effective" date at the top reflects the latest version. Material changes affecting active engagements will be notified to Clients directly per the MSA.

13. Contact

For privacy questions, data requests, or DPA inquiries:

• Email: office@simple4u.io
• Mail: Very Simple Solutions Inc., Brooklyn, NY, USA; postal address on request by email