Who we are
Simply Done Limited ("Simply Done", "we", "us") is a company registered in England and Wales (Company No. 15481333), registered office at 15b Rutherford House, 40 Pencroft Way, Manchester Science Park, Manchester, England, M15 6SZ. We operate the Simply Done platform: the consumer property marketplace at simplydone.tech and the estate-agency CRM at crm.simplydone.tech (together, the "Service").
We are the data controller for personal data we collect about visitors and account holders. Where an estate agency uses our CRM to manage its own clients' data, the agency is the data controller and Simply Done acts as its data processor.
1. What we collect
- Account and profile data — name, email address, phone number, role, agency/organisation details, login credentials (passwords are hashed; we never store them in plain text).
- Property and CRM data — property listings, enquiries, viewings, offers, tenancy details, tasks, notes and communications that agencies and their staff enter into the CRM.
- Communications data — emails, SMS messages, WhatsApp messages and call metadata sent or received through the Service, where a user or agency has connected those channels.
- Connected mailbox data (Google user data) — if you connect a Gmail account, we access your mailbox as described in Section 3.
- Technical data — IP address, browser type, device information, and usage logs collected for security, debugging and service operation.
- Consumer marketplace data — search preferences, saved properties, valuation and rent-check requests, and enquiries you submit to agencies.
2. Why we process it (lawful bases)
- To provide the Service (contract): operating the CRM, marketplace, messaging and scheduling features you or your agency signed up for.
- Security and abuse prevention (legitimate interests): authentication, audit logging, fraud and abuse detection.
- Legal compliance (legal obligation): accounting, tax and regulatory records.
- Service communications (contract / legitimate interests): transactional emails such as viewing confirmations, invoices and system notices.
- Marketing (consent): only where you have opted in; you can withdraw at any time via the unsubscribe link in any marketing email.
We do not sell personal data. We do not use personal data for third-party advertising.
3. Google user data (Gmail integration)
If you choose to connect a Gmail account to the Service, we request the following Google OAuth scopes:
- Read, compose and send emails from your Gmail account — used solely to display your mail inside the CRM inbox, link messages to your contacts, properties and deals, and send email you compose in the CRM from your own address.
- Send email on your behalf — used solely to deliver messages you write in the CRM through your connected mailbox.
What we do with this data:mail from your connected mailbox is synced into your CRM inbox so you and (subject to your agency's permission settings) your team can work from one place. Message content is stored on our servers in the United Kingdom/European Economic Area for as long as the mailbox remains connected, and is used only to provide CRM functionality to you.
What we never do with this data: we do not use Google user data for advertising. We do not sell it. Humans at Simply Done do not read your messages except (a) with your explicit permission, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised for internal operations.
Limited Use disclosure:Simply Done's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AI/ML: we do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.
Disconnecting: you can disconnect your Gmail account at any time in Settings → Channels → Email. On disconnection we stop syncing immediately and delete stored OAuth tokens. You can also revoke access from your Google Account at https://myaccount.google.com/permissions. You may request deletion of previously synced messages as described in Section 7.
4. Who we share data with
- Your agency and team— data you enter in an agency workspace is visible to colleagues according to your agency's role and permission settings.
- Service providers (processors) — hosting (UK/EEA data centres), email delivery, SMS/voice/ WhatsApp delivery (Twilio; Firetext), cloud storage (Cloudflare R2, EU), search infrastructure, and DNS/CDN (Cloudflare). Providers act under contract and only on our instructions.
- Authorities — where required by law or court order.
- Business transfers — if Simply Done is acquired or merges, data may transfer to the successor under this policy.
Where any transfer takes personal data outside the UK/EEA, we rely on adequacy regulations or standard contractual clauses.
5. Retention
We keep personal data only as long as needed for the purposes above: account data for the life of the account plus a short wind-down period; connected-mailbox data while the mailbox is connected; financial records for the period required by law (normally 6 years). Backups roll off on a fixed schedule.
6. Security
Data is encrypted in transit (TLS) and protected at rest by access controls, tenant isolation enforced at the database layer (row-level security), audit logging, and least-privilege access for our systems and staff. OAuth tokens are stored encrypted and are never exposed in client-side code.
7. Your rights
Under UK GDPR you may request: access to your data, correction, deletion, restriction, portability, and to object to processing based on legitimate interests. To exercise any right, email contact@simplydone.tech. We respond within one month. If your data is held in an agency's workspace, we may direct your request to that agency as controller, and will assist them in fulfilling it.
You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with our handling of your data.
8. Cookies
The Service uses strictly necessary cookies for sign-in and security, and (where you consent) analytics cookies. See our Cookie notice in the site footer for details and controls.
9. Children
The Service is for business users and property consumers aged 18 or over. We do not knowingly collect data from children.
10. Changes
We will post any changes to this policy on this page and update the date above. Material changes affecting connected Google accounts will be notified by email.
11. Contact
Simply Done Limited, 15b Rutherford House, 40 Pencroft Way, Manchester Science Park, Manchester, England, M15 6SZ · contact@simplydone.tech