Privacy Policy

Last updated: 7 July 2026

1. Who we are

Onboardo is operated by Simplepage Limited, Isle of Man (company no. 139122C). We are the data controller for your account and billing data, and a data processor for the personal data you enter into the service about your own clients. Contact us at [email protected].

2. Data we collect

  • Account data: name, email, company and login credentials.
  • Billing data: handled by Paddle as Merchant of Record - we do not store card details.
  • Content you create in the service.
  • Client personal data you upload, processed on your behalf.
  • Technical data: IP address, device and log data, for security and delivery.

3. Why we process it

To provide the service under our contract with you; for our legitimate interests in security, improvement and support; where you have given consent; and to meet legal obligations. We rely on UK GDPR, EU GDPR and Isle of Man data-protection law as applicable.

4. Sub-processors

We use trusted providers, each bound by data-protection terms: Microsoft Azure (hosting, UK region), Cloudflare (CDN, DNS and security), Postmark (transactional email), Paddle (payments and Merchant of Record) and Plausible (privacy-friendly, cookieless analytics).

5. International transfers

Your data is hosted in the United Kingdom. Where data is transferred outside your jurisdiction, we rely on adequacy decisions or standard contractual clauses.

6. Retention

We keep account data for the life of your account plus any period required by law. Client data is retained per your instructions, and signed-agreement evidence is retained for its legal life.

7. Your rights

You have rights to access, rectification, erasure, restriction, portability and objection, and to complain to your supervisory authority. Email [email protected] to exercise them.

8. Cookies and analytics

We use only essential cookies. Our analytics (Plausible) is cookieless and stores no personal data.

9. Security

We protect your data with encryption in transit and at rest, access controls and least-privilege practices.

10. Changes

We may update this policy and will post changes here with a new effective date.