Privacy Policy

This Privacy Policy explains how Simantrix Technologies (“Simantrix”, “we”, “us”) collects, uses, shares, retains, and protects personal data across simantrix.com, the Simantrix web application, our desktop applications (Windows, macOS, Linux), and related services (collectively, the “Services”).

Our legal role depends on how you interact with Simantrix:

• As a Data Processor (Service Provider). For data within a customer’s virtual office workspace — employee profiles, spatial presence, attendance logs, proximity voice audio, chat messages, uploaded attachments, and meeting transcripts — the subscribing organization is the Data Controller. We process that data solely on their documented instructions and in compliance with our Customer Agreement and Data Processing Agreement (DPA).
• As a Data Controller. For our public website, marketing interactions, sales inquiries, billing records, direct subscriber account administration, and website visitor analytics, we determine the purposes and means of processing and act as Controller under applicable privacy laws including the EU/UK General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act (DPDP Act, India), and the California Consumer Privacy Act (CCPA/CPRA).

If you are an employee, contractor, or team member using Simantrix through your employer’s workspace, your organization’s administrator controls your account and workspace settings. Please direct questions regarding your workspace records to your organization administrator.

We collect personal data only to provide, maintain, secure, and improve an immersive workplace. The categories of data collected include:

• Account & Profile Information: Full name, corporate email address, job title, department, avatar customization choices (hair, apparel, style), assigned office desk/cabin, working hours, and system role (e.g. Owner, Admin, Member, Guest).
• Virtual Office Presence & Spatial Telemetry: Sign-in and sign-out timestamps, current floor and room/zone occupancy (e.g. Bullpen, War Room, Cafeteria), spatial coordinates within the 3D/2D office grid, and status indicators (Available, In a Meeting, Heads Down, Away).
• Attendance & Workplace Records: First arrival and last departure times, total active duration, and idle time derived solely from user-configured away-from-keyboard (AFK) thresholds. Users can inspect their complete attendance ledger transparently at all times.
• Communications, Files & Media Content: Chat messages, threaded replies, reactions, shared links, files, and documents uploaded to channels or direct conversations. Media streams (audio, webcam, screen share) are transmitted in real time and are neither recorded nor stored unless a meeting host explicitly initiates recording.
• Meeting & Recording Data: When recording is enabled, we store audio/video recordings, participant rosters, chat logs, and optional transcripts generated during the session.
• Technical, Device & Connection Data: IP address, device type, operating system, browser version, WebRTC connection quality metrics (latency, jitter, packet loss), and crash diagnostics.
• Website Visitor & Lead Inquiries: Pages viewed, referring URLs, country of origin (inferred from IP/CDN headers), and information submitted through demo requests, contact forms, or newsletter subscriptions.

Simantrix is built to restore natural presence and trust in remote teams — not to spy on them. We explicitly enforce strict product and technical guardrails:

• No Keystroke Logging: We never log keystrokes or monitor typing outside of messages explicitly typed into our application.
• No Automated Screen Capture: We never take periodic or clandestine screenshots of your desktop or monitor active desktop applications.
• No Background Web Tracking: We never inspect your browsing history, active tabs, or external software usage.
• No Productivity Scoring: We deliberately do not calculate algorithmic productivity scores, attention ratings, or behavioral rankings.
• No Secret Recording: Microphones and webcams are never activated covertly. Proximity voice only transmits when unmuted, and meeting recordings always present an unmistakable, persistent banner to every attendee.
• No Data Monetization: We never sell, rent, or trade your personal data with data brokers or advertising networks.

To deliver resilient, low-latency spatial offices worldwide, we partner with vetted infrastructure and service providers. Every sub-processor operates under strict data protection agreements:

• LiveKit Cloud / WebRTC SFU: Global media relay infrastructure for low-latency proximity spatial voice, encrypted multi-party video, and screen sharing. Ephemeral audio and video flow through memory and are never persisted unless recording is explicitly active.
• Neon Tech (PostgreSQL): Serverless, SOC 2 Type II certified cloud database hosting our Platform (DB1) and Workspace (DB2) databases with strict multi-tenant isolation by organization ID.
• MongoDB Atlas: Managed database cluster (DB3) storing structured notifications, telemetry events, meeting transcripts, and immutable audit logs.
• Upstash (Serverless Redis): High-throughput, encrypted in-memory cache used for real-time avatar coordinates, presence synchronization, and Socket.IO clustering.
• Cloudflare / Amazon Web Services (AWS S3 & R2): Enterprise storage for encrypted attachments, user avatars, organization assets, and meeting recording archives.
• Payment Gateways (Razorpay / Stripe): Secure, PCI-DSS Level 1 compliant payment processing. Simantrix never receives or stores your full credit card number or bank credentials.
• Google Analytics 4 & New Relic: Anonymous website telemetry and browser performance monitoring, active only on our public marketing site subject to your cookie preferences.

Simantrix includes autonomous AI workplace intelligence features (such as real-time meeting transcription, automated meeting recaps, task extraction, and semantic workspace search):

• Zero Foundation Model Training: Customer workspace content, chat messages, documents, and voice recordings are never used to train, retrain, or fine-tune public foundation AI models.
• Zero Retention by AI Providers: AI inference queries routed to enterprise LLM providers (such as OpenAI, Anthropic, or AWS Bedrock) operate under strict B2B zero-data-retention (ZDR) agreements. Data is discarded immediately following completion.
• Admin Opt-In Controls: Workspace administrators have granular controls to enable, restrict, or disable AI features across their entire organization or specific room categories.
• Human Agency: AI-generated summaries, action items, and task cards remain drafts until confirmed or edited by human team members.

Virtual offices enable fluid spatial collaboration. Our recording safeguards include:

• Persistent Notice: When a host initiates recording in any room or town hall, every participant receives an audible announcement and an unambiguous visual banner in their viewport.
• Participant Consent: Attendees who do not wish to be recorded may mute their audio, turn off their video, or exit the room to return to common open areas.
• Access Restrictions: Recorded files and transcripts are accessible only to authorized attendees and organization administrators according to workspace role permissions.

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected or to comply with statutory accounting and legal obligations:

• Active Workspace Data: Retained for the duration of the organization’s active subscription, subject to administrator-defined data retention schedules.
• Deprovisioned Members: When an employee is removed from a workspace, their credentials and direct access are revoked immediately. Content contributed to team channels is preserved under the organization’s workspace policy.
• Subscription Cancellation Grace Period: When a subscription ends, workspace data is preserved in read-only export format for 30 calendar days to allow organizations to download their records. After 30 days, workspace databases, uploaded files, and transcripts are permanently purged.
• Deletion Requests: To request permanent deletion of your personal data where Simantrix acts as Controller, email simantrix.com@gmail.com. We process and confirm verified erasure requests within 30 days.

We deploy a minimal, transparent set of first-party cookies and storage identifiers:

• Strictly Necessary: Essential session cookies (e.g. sx_home_at) and security tokens required to maintain your authenticated state, CSRF protection, and load balancer affinity.
• Functional & Preferences: Local storage entries (e.g. theme preference, desktop download choices) to remember your interface preferences between visits.
• Anonymous Analytics: Privacy-first visitor metrics (Google Analytics 4, anonymous session IDs). Users can accept or reject analytics tracking via our Cookie Consent Banner. We strictly respect browser signals including Do Not Track (DNT) and Global Privacy Control (GPC).

We employ multi-layered technical and organizational safeguards to protect customer data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All HTTP and WebSocket traffic is protected using TLS 1.3. Media streams utilize SRTP / DTLS.
• Encryption at Rest: All databases, storage volumes, and backups are encrypted at rest using AES-256.
• Multi-Tenant Isolation: Data queries are strictly scoped by organizationId to guarantee tenant separation.
• International Safeguards: When transferring data across borders, we implement EU Standard Contractual Clauses (SCCs) and equivalent international data transfer agreements.

For complete security architecture and audit details, review our Security & Trust portal.

Depending on your jurisdiction (e.g. GDPR, UK DPA, India DPDP Act, California CCPA), you possess specific statutory rights regarding your personal data:

• The right to access and receive a copy of your personal data in a structured, portable format.
• The right to rectify inaccurate, incomplete, or outdated information.
• The right to request erasure (“Right to be Forgotten”) of your personal data.
• The right to restrict or object to certain processing activities.
• The right to withdraw consent at any time without affecting prior lawful processing.
• The right to nominate a representative or lodge a complaint with your supervisory data protection authority.

To exercise your rights, contact us at simantrix.com@gmail.com.

In accordance with the Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer for Simantrix Technologies is:

Turnaround Time: We acknowledge complaints within 24 hours of receipt and resolve or provide a comprehensive written redressal within 15 calendar days in accordance with statutory guidelines.