Privacy Policy

This Privacy Policy explains how Simulations4All, Calgary, Alberta, Canada ("Simulations4All," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you use our website, accounts, simulations, calculators, courses, SimLab, AI Tutor, professional tools, and related services (collectively, the "Service").

Simulations4All is the organization responsible for this personal information and, where applicable, its controller. Our Privacy Officer is the contact responsible for privacy questions and requests. Contact details are in section 15.

1. Scope

This Policy applies to personal information we control through the Service, licensing and custom-development enquiries, support, newsletters, and related business interactions. It does not apply to a third-party website or service that has its own privacy policy. A commercial customer agreement may include additional privacy or data-processing terms; those additional terms control for that customer where they conflict with this Policy.

2. Personal information we collect

2.1 Information you provide

• Account information: name, email address, nickname, account credentials, authentication details, and the date and versions of the Terms and Privacy Policy accepted or acknowledged during registration. We may keep a hashed IP-derived identifier and user-agent string with that acceptance record to preserve evidence of the transaction. Passwords for credential accounts are stored in hashed form.
• Profile and learning information: optional role, industry or domain, organization, education or skill level, interests, country or timezone, preferences, saved items, progress, quiz results, feedback, ratings, and survey responses.
• Licensing and business information: your name, title, organization, business contact details, intended users and audience, requested simulations or tools, access and delivery needs, internal or external purpose, proposed reuse of Outputs or screenshots, technical requirements, and the content of licensing, sponsorship, custom-work, or support enquiries. Where relevant, we may ask whether the proposed use involves SOPs or training materials, sensitive information, production activity, regulated work, or another high-risk context.
• Billing and transaction information: if you purchase a licence or paid service, billing contact details, transaction records, tax information, and payment status. A payment processor may collect payment-card or bank details directly; we generally do not receive or store full card numbers.
• Communications and contributions: messages, support requests, newsletter preferences, proposals, votes, comments, reports, and any other information you choose to submit.

2.2 Information collected automatically

When you use the Service, we and service providers may collect the following, depending on your browser, device, settings, consent choices, and features used:

• Network and technical information: IP address, coarse location inferred from IP, browser and operating-system type, device and screen category, language, timezone, network and capability information, and server request headers.
• Visit and attribution information: pages viewed, referring page or domain, landing page, search or campaign links, UTM and similar attribution parameters, visit counts, and navigation paths.
• Service activity: searches, filters, clicks, form progress, downloads, favorites, course and quiz activity, simulation or tool opened, interaction type, selected controls or panels, exports, shares, saves, and similar engagement events.
• Performance, quality, and security information: page speed, Web Vitals, API timing and status, resource loading, errors, crash or stack summaries, compatibility information, session duration, bot and abuse indicators, failed sign-in events, and security logs.
• Identifiers: account ID when signed in and pseudonymous browser, device, session, or event identifiers used for authentication, preferences, analytics, security, and fraud prevention.

We prefer aggregated, summarized, bucketed, truncated, or pseudonymous analytics where practical and do not use product analytics to intentionally collect passwords, authentication tokens, or sensitive personal information.

2.3 Tool Inputs, SimLab, and AI Tutor

Many simulations and calculators run locally in your browser. AI Tutor model files are downloaded to your browser and its inference and message content ordinarily remain on your device. AI Tutor analytics may record an anonymous session identifier, event type, selected model, simulation identifier, device category, browser capability, mode, timing, and error metadata, but are not designed to record your AI Tutor message text.

Most SimLab computations run locally. When you use server acceleration, our application may send the requested function name and numeric arguments to our primary compute service or optional failover compute service and receive the result. This information is processed to perform the calculation and is not intended to be retained as content, although operational and security logs may contain request metadata. SimLab product analytics may record an account ID when signed in, a hashed IP-derived identifier, coarse country, user agent, function or module name, timing, server used, success or truncated error information, file size or format, and other usage metadata. It is not designed to record SimLab source code, dataset contents, private files, or raw solver values.

If you choose to save, share, submit, or request support for content, we process the content necessary to perform that action. Do not enter personal, confidential, regulated, or sensitive information into a tool unless its instructions or a written commercial agreement expressly authorizes that processing.

2.4 Cookies and similar technologies

We use cookies, local storage, session storage, scripts, pixels, and browser APIs for authentication, security, preferences, analytics, performance, attribution, and, when enabled, advertising. See section 7 and our Cookie Policy.

3. How and why we use personal information

We use personal information to:

• provide, operate, authenticate, personalize, and maintain the Service;
• create and manage accounts, saved items, learning progress, and preferences;
• evaluate and respond to licensing, sponsorship, support, and custom-development enquiries and administer commercial relationships;
• process transactions, deliver licences, invoice, collect fees, and keep records;
• communicate service, account, security, legal, and support notices and send marketing only where permitted;
• understand how visitors find and use the Service, measure feature quality and learning engagement, improve content and tools, and plan infrastructure;
• diagnose errors, maintain reliability, and prevent fraud, abuse, and security incidents;
• display and measure advertising when advertising is enabled; and
• comply with law, enforce agreements, and establish, exercise, or defend legal claims.

3.1 Commercial-licensing context

For transparency, a commercial licence is intended to document and authorize a defined organizational use that is not included in the personal, non-commercial, classroom, or expressly approved evaluation permissions in our Terms of Service. It can apply even where no separate fee is charged to the end user and no immediate revenue is earned—for example, internal employee education or training, internal research or method development, or incorporating screenshots or Outputs into internal SOP drafts, training materials, documentation, reports, or presentations. The Terms, not this Privacy Policy, determine what permission is required and granted.

We use licensing and business information to understand the proposed workflow; determine whether written commercial permission is required; distinguish internal hosted use from broader external, automated, embedded, production, or redistribution use; identify the users, tools, audience, and permitted reuse; assess data-protection or high-risk-use concerns; prepare and administer an appropriate licence; respond to support and compliance questions; and keep records of the permission requested and granted.

A licensing enquiry does not itself grant permission. Do not include personal, patient, health, confidential, regulated, export-controlled, or other sensitive information in an enquiry or in the Service unless we expressly request it through an appropriate channel and the necessary safeguards and written terms are in place. We aim to request only information reasonably needed to assess and administer the proposed use.

3.2 Consent and legal bases

Under Canadian privacy law, we obtain consent where required and may collect, use, or disclose information without consent where law permits. We limit processing to purposes a reasonable person would consider appropriate in the circumstances and provide choices for non-essential processing where required.

Where European Economic Area or United Kingdom data-protection law applies, our legal bases include performance of a contract or steps requested before a contract (accounts, the Service, licensing, and support); compliance with legal obligations (tax, accounting, and lawful requests); our legitimate interests or those of others (security, fraud prevention, essential service operation and debugging, and legal claims), balanced against your rights; and consent (optional product analytics, browser monitoring, advertising technologies, and marketing where consent is required). You may withdraw consent at any time without affecting earlier lawful processing.

4. When we disclose personal information

We do not disclose personal information except as described in this Policy, at your direction, with your consent, or as permitted or required by law. Recipients may include:

• Infrastructure and security providers: hosting, database, content-delivery, storage, network, bot-detection, and security providers, including OVHcloud for primary application and database infrastructure, Cloudflare for network, security, content delivery, and model-file storage, and Oracle Cloud for optional compute failover, where those services are configured. Requests for third-party code or other public assets may also be sent to content delivery providers such as jsDelivr.
• Analytics and advertising providers: Google Analytics and, when enabled, Google AdSense, together with related measurement and advertising partners.
• Authentication providers: Google or GitHub if you choose and we enable the relevant social sign-in option. Those providers receive information about the sign-in transaction and process it under their own policies.
• Communications providers: email and delivery providers, including Resend where used, and infrastructure that sends authentication, support, newsletter, and licence-related messages.
• Monitoring providers: error and performance monitoring providers, including Sentry if that optional service is enabled. Sentry may receive error, trace, device, network-request, and interaction metadata. If session replay is enabled, it may also receive a representation of page state and interactions; text and media are configured to be masked or blocked, but masking does not make replay data anonymous.
• Payment and professional-service providers: a payment processor if online payments are offered, and accountants, auditors, insurers, lawyers, and other professional advisers where used.
• Authorities and affected parties: where we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, users, or the public, or to investigate misuse.
• Business successors: a buyer, investor, lender, or successor in a proposed or completed financing, merger, reorganization, acquisition, or sale of assets, where disclosure is permitted by applicable law and the terms actually in place.

Providers, features, and configurations may change. Where a provider acts on our behalf, its processing is governed by the terms and account configuration actually in place and applicable law. Specific contractual safeguards, subprocessors, storage regions, retention settings, and backup arrangements vary by enabled provider and account configuration. This Policy does not state that one mechanism or region applies to every provider; you may contact our Privacy Officer for information relevant to a particular service.

5. Advertising and no sale of personal information

We do not sell or rent personal information for money, and we do not provide your account email address to advertisers for their own email marketing. If Google AdSense is enabled, Google and its advertising partners may collect or receive cookie identifiers, IP address, device information, page and ad interactions, and similar information to select, deliver, limit, secure, and measure ads. Depending on your location, settings, and consent choices, advertising may be contextual or personalized. Advertising providers may act as independent controllers for some of their processing under their own policies.

6. International processing and transfers

We are based in Canada. If a listed provider is enabled, it may process information in Canada or in other countries where it or its subprocessors operate. Actual storage and processing locations depend on the provider, feature, and account configuration. Cloudflare and public content-delivery networks may route requests through distributed locations. A country where information is processed may have privacy laws different from the laws where you live, and its courts, law-enforcement agencies, or regulators may lawfully access information. Contact our Privacy Officer for current information about a particular enabled provider.

Where applicable law requires a transfer mechanism, we will identify and document the mechanism before relying on the transfer. Depending on the law and facts, possible mechanisms can include an adequacy decision, contractual safeguards, or an authorized exception. This paragraph does not state that a particular mechanism is currently in place for every provider or transfer. You may contact our Privacy Officer for information about safeguards relevant to your information.

7. Cookies, analytics, advertising, and your choices

Strictly necessary technologies support authentication, security, load balancing, and core functionality. Other technologies support preferences, first-party product analytics, Google Analytics, attribution, performance measurement, and, if enabled, Google AdSense. Applicable law may require prior consent before certain non-essential technologies are activated.

Google Analytics audience measurement operates by default where permitted. For visitors in the EEA, United Kingdom, and Switzerland who have not saved a choice, Google's regional consent defaults deny analytics storage; the Google tag may send limited cookieless consent and measurement signals instead of using analytics cookies. Advertising storage, ad user data, and ad personalization remain denied unless advertising is configured and you explicitly enable it.

The settings below apply to Google Analytics, Simulations4All product analytics, AI Tutor and SimLab analytics, optional browser monitoring and masked Sentry session replay, and Google AdSense when configured. Turning optional tools off records the choice for this browser, sends Google denial signals, stops participating first-party clients from creating new optional events, and attempts to remove accessible analytics and advertising cookies. Provider code already loaded in another tab may not receive the change immediately; reload or close other Simulations4All tabs after changing it. The setting cannot guarantee that no provider or network signal is sent, erase data already received, or disable necessary security, account, fraud-prevention, operational, or legal logs. Browser-stored choices apply only to that browser and device.

Our Cookie Policy provides more information about the technologies used and their typical retention.

8. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security, comply with legal, tax, accounting, and reporting obligations, resolve disputes, and enforce agreements. Retention depends on the type and sensitivity of the information, the context in which it was collected, and legal requirements.

• Account and profile information is generally kept while the account is active and for a reasonable period after closure, subject to fraud-prevention and legal requirements and, where backups are configured, the applicable backup lifecycle.
• Raw first-party product-activity records, including general activity, AI Tutor analytics, SimLab events, server-call metrics, and SimLab session analytics, have a target retention period of 90 days. Operational delays, backups, legal holds, or technical recovery needs may extend actual deletion. Aggregated, de-identified, or summary analytics may be kept longer.
• Licensing, transaction, tax, contract, and business records are kept for the applicable relationship and the period required or permitted by law.
• Legal-acceptance records may be retained for the life of the account and a reasonable limitation period afterward to establish which terms applied.
• Security logs, support records, and provider data are retained for periods based on operational need, risk, and provider configuration.

When information is no longer required, we delete, destroy, or anonymize it, subject to lawful exceptions and, where backups are configured, applicable backup cycles.

9. Security and breaches

Current application safeguards include TLS encryption in transit and hashed passwords for credential accounts. Additional application, infrastructure, monitoring, backup, access-control, and provider safeguards vary by service and configuration. No system is completely secure, and we cannot guarantee absolute security. Where law requires, we will notify affected individuals and regulators of a qualifying personal-information breach.

10. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to ask whether we hold personal information about you; request access, correction, deletion, or portability; restrict or object to processing; withdraw consent; and complain to a privacy regulator. Some rights apply only in particular jurisdictions or circumstances and are not absolute.

• Canada: you may request access to and correction of your personal information and may withdraw consent, subject to legal or contractual restrictions and reasonable notice. You may raise an unresolved concern with the Office of the Information and Privacy Commissioner of Alberta or, where applicable, the Office of the Privacy Commissioner of Canada.
• EEA and United Kingdom: where applicable, rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent, and a complaint to your local supervisory authority.
• Switzerland: where applicable, you may exercise rights under the Swiss Federal Act on Data Protection and may contact the Federal Data Protection and Information Commissioner.

To make a request, contact our Privacy Officer using section 15. Describe your request and the account or email involved. We may verify your identity and authority before responding. We will respond within the period required by applicable law. If we deny or limit a request, we will explain why where law requires.

11. Email communications

We send necessary account, authentication, licence, transaction, security, and service messages as part of the Service or our relationship with you. We send newsletters and other commercial electronic messages only with consent or another lawful basis. You can unsubscribe using the link in a marketing email or contact us. Unsubscribing from marketing does not stop necessary transactional or security messages.

12. Children, learners, and schools

The Service includes account-free educational material that young people may use under adult or school supervision where lawful. The current self-service registration flow does not ask for age and does not provide a separate parent, legal-guardian, or school consent or acceptance workflow. It should not be used to create an account for a child who cannot independently provide legally effective acceptance and consent. We do not treat the ordinary registration checkbox as proof of parent, guardian, or school authorization. Because registration does not collect age, we cannot verify a user's age from registration alone. If you believe a child created an account or provided personal information without required authorization, contact our Privacy Officer so we can investigate and take appropriate action.

Schools and educators must not submit student records or other school-controlled personal information unless a written institutional agreement authorizes that use and assigns the parties' privacy responsibilities.

13. International representatives

Simulations4All is established in Canada. If applicable EEA, UK, or Swiss law requires us to appoint a local representative, we will publish that representative's name and contact details in this section. Until then, privacy requests should be directed to our Privacy Officer in section 15.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, law, or our practices. We will post the revised Policy and update the date above. If a change is material or applicable law requires it, we will provide additional notice and seek consent where required before using personal information for a materially new purpose.

15. Contact us