Privacy policy

1. Two roles

Organisations use SimDart to onboard their people. For the data an organisation puts in, and for the records of its members’ learning, the organisation is the controller and we are its processor: we act only on its instructions. For your account, this website and the contact form, we are the controller.

2. What we collect

• Account: your name, e-mail address, a hashed password or the sign-in provider you chose, a photo if you upload one, your language and time zone.
• Learning records, for your organisation: enrolments, lessons opened and completed, the parts of lessons you have seen, reading time if your organisation records it, answers and scores, simulation and lab attempts, and client-case conversations.
• Technical: the devices and browsers you sign in from, their IP address and when they were last active, kept with your sessions; server logs, without the content of your work.
• Contact form and trial applications: what you write to us and the details you give, such as your company, job title and company size.
• Cookies: only those the service needs to work (see the cookie policy).

3. Why, and on what basis

• To provide the service to you and your organisation (performance of a contract).
• To keep the service secure and prevent abuse, with rate limits and logs (legitimate interests).
• To answer your messages (legitimate interests, or steps towards a contract).
• To meet legal obligations, such as keeping accounting records (legal obligation).

We do not sell personal data, show advertising, or use personal data to train AI models.

4. AI features

If your organisation uses AI features, lesson content, and for coaching the client-case conversation, is sent to Anthropic, our AI provider, to produce question drafts or coaching notes. Anthropic does not use this data to train its models. An organisation can switch AI features off; on the trial and the Starter plan they are off.

5. Who receives it

Our sub-processors, listed on the sub-processors page, under contracts that protect the data. Within an organisation, its managers and mentors see its learners’ records; nobody outside the organisation can.

6. Transfers outside the European Union

The service and its data are hosted in the European Union. When AI features are on, the data sent to Anthropic is processed in the United States under appropriate safeguards, such as the European Commission’s standard contractual clauses.

7. How long we keep it

• Detailed learning activity: deleted 6 to 36 months after an enrolment ends, as the organisation chooses (12 by default). Results and completions stay until the organisation deletes them.
• Organisation data: until the organisation deletes it, or the organisation is deleted.
• Your account: until you delete it. Deleting it removes your name, e-mail address, photo and sign-in; your organisations keep their learning records under “Deleted user”.
• Expired sign-in sessions: one day. Contact messages and trial applications: two years. Backups: 14 days.

8. Your rights

You can see, correct and delete your account data in Account settings, and ask us for a copy of your data, to restrict its use or to object to it, by writing to us. For learning records, ask your organisation first: it decides about that data, and we help it answer. You can also complain to a data protection authority, for example, in Bulgaria, the Commission for Personal Data Protection.

9. Security

Organisations are separated in the database itself, labs run in isolated sandboxes, data travels encrypted, passwords are stored hashed, data is backed up every night and access follows each person’s role. The security page has the details.

10. Contact and changes

DAWNFORGE STUDIOS LTD, 23 Cherni Vrah Blvd, Lozenets, 1421 Sofia, Bulgaria. Write to us at support@simdart.com, or use the contact form on this site.

We publish changes to this policy here and tell you in the product when they matter to you.