Legal

Privacy policy

Last updated 10 September 2026

This Privacy Policy explains how smallbizsim ("we", "us") collects, uses and protects information when you use our website and feasibility tools (the "Service"). We keep data collection to the minimum needed to run the Service and we never sell your personal data.

Information we collect

  • Account details — your email address and a hashed password when you create an account.
  • Account activity — sign-in successes and failures targeting an account, report creation and claims, saved changes, explicit premium retries, confirmed payments and password changes or recovery. Activity records contain timestamps and related account/report references, not passwords or recovery tokens.
  • Simulation inputs — the assumptions you enter (rent, pricing, capacity and similar figures) and the reports generated from them.
  • Payment information — handled by our payment processor (Stripe). We never store full card numbers on our servers.
  • Usage data — anonymised analytics such as pages viewed and features used, to help us improve the Service.

How we use your information

  • To create and run your simulations and generate reports.
  • To manage your account, entitlements and purchases.
  • To send you the documents and emails you request.
  • To maintain security and improve the Service.

Analytics and cookies

We use Microsoft Application Insights for essential fault monitoring. For all visitors it may receive a sanitised error category, an operation label and a route template, without cookies, browser storage, raw error details, complete URLs or persistent user identifiers.

With your permission, we also use Google, Microsoft and TikTok services to understand website traffic, completed simulations and purchases, and to improve usability and advertising performance. Until you choose “Accept”, optional analytics and advertising measurement storage are disabled. Google may receive cookieless page measurement and consent-status signals, while Microsoft analytics and advertising measurement and the TikTok Pixel remain disabled. After acceptance, advertising measurement is used only to measure and attribute completed simulations and purchases. Advertising personalisation, advanced matching, customer-list targeting and remarketing remain disabled.

The TikTok Pixel receives only simulator start and completion events and is not called from report pages. Other funnel events contain only the event name, business type, a broad funnel source and, for a confirmed purchase, the transaction reference, value and currency. We do not send simulation inputs, report tokens, exact addresses, card or billing details, report contents or email addresses to analytics providers. You can reject optional measurement when first asked or change your choice later through “Cookie settings” in the site footer.

Microsoft advertising events use sanitised page locations rather than private report URLs. After acceptance, a Microsoft advertising click identifier may be retained with that sanitised location to attribute a visit or conversion to an ad. Other URL query values, including checkout session identifiers, are omitted.

Account security and recovery

Password changes and forgotten-password recovery use a short-lived, single-use link sent through Azure Communication Services. We cannot recover an existing password. Completing a password change or recovery invalidates existing sessions.

When enabled, Google reCAPTCHA protects sign-in from automated abuse. Google processes the verification interaction and device/network information needed to assess it under its Privacy Policy and Terms of Service. This security verification is separate from optional advertising measurement. Authentication and password-recovery pages do not load optional analytics or session replay.

Data sharing

We share data only with the service providers needed to operate the Service — for example our cloud hosting, email delivery and payment processing partners — and only to the extent required to deliver those functions. We may also disclose information where required by law.

Data retention

We retain your account and report data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting us.

Account activity records do not expire automatically and are available only to authorised administrators for security and service support. The default 30-day activity view is a display filter, not a deletion policy. Deletion requests remain subject to applicable legal and security record-retention requirements.

Your rights

You may access, correct or delete your personal data, and object to certain processing. To exercise these rights, email us at contact@smallbizsim.com.

Contact

Questions about this policy? Reach us at contact@smallbizsim.com.