Privacy Policy
EAssure Solutions India Private Limited
Effective 11 July 2026 · Last updated 9 September 2026
This Privacy Policy explains how EAssure Solutions India Private Limited (“SIMDU”, “Company”, “we”, “our”, or “us”) collects, uses, stores, shares and protects your personal information when you use the SIMDU website, software and related services (together, the “Services”).
SIMDU has not launched. Today the Services consist of this website and a paid waitlist reservation of $1.00, ₹99, £1.00 or €1.00, and that is all this policy currently describes in practice. This website stores nothing on your device unless you accept it — we ask first, and if you decline the analytics script is never loaded. Section 4 explains it and our Cookie Policy names the two cookies involved. We carry no advertising or social tag and build no profile of you across other websites. Sections 3 and 4 describe exactly what is collected and measured; section 8 describes the payment. Sections 7 and 9 describe accounts and software telemetry that do not exist yet; they are published in advance and take effect only when those parts of the Services are released.
1. Scope
This policy applies to visitors to simdu.co, to people who join the SIMDU waitlist, and to anyone who contacts us for support. It will also apply to users of the SIMDU software and any account system when those are released.
It does not apply to third-party websites or services that we do not control, nor to Microsoft Flight Simulator or any add-on aircraft you use with SIMDU.
2. Definitions
Personal information means information that identifies, relates to, or can reasonably be associated with an individual.
Services means the SIMDU website, waitlist, software, documentation and customer support.
Software means the SIMDU mobile application and bridge application, when released.
You means any individual using the Services.
3. What we collect today
This section describes the whole of our current processing. It is short because the site does very little.
3.1 Waitlist reservation
When you reserve a place on the waitlist, we record:
- your name, as you typed it, trimmed and capped in length;
- your email address, as you typed it, normalised to lowercase;
- the package you selected from the list on the form;
- your country, as a two-letter code chosen from a list;
- the creator code you entered, if you entered one — this field is optional, it is there so we can tell which creator sent you to us, and leaving it blank changes nothing about your reservation or its price;
- the date and time of your reservation;
- a fixed source label recording that the reservation came from this website; and
- the payment reference, amount, currency and payment time returned to us by Razorpay — see section 8.
Your name and the creator code are the only free-text fields on the form. Both are stripped of control characters and capped in length before they are stored — 120 characters for the name, 32 for the creator code. The package and country selections are validated against fixed lists, so neither can carry anything you did not choose from it.
We never receive your card number, expiry date or security code. Those are given directly to Razorpay — see section 8.
3.2 Abuse prevention
To stop a script submitting the form thousands of times, our server counts recent submissions per network address. It does this by computing a keyed cryptographic hash of the caller’s IP address and counting against that hash.
The hash is held in memory only, for at most one hour, and is discarded when the server process restarts. Your IP address itself is never written to our database and never stored alongside your waitlist entry. The hash cannot be reversed to recover the address.
The legal basis for this is our legitimate interest in protecting the Services from abuse. It is not used for analytics, profiling, advertising or marketing.
3.3 Server logs
Our hosting provider generates operational logs when a page is requested. These may contain an IP address, the page requested, a timestamp, and browser and operating system information. They are generated and retained by the hosting provider for the purposes of operating, securing and debugging the service, and we use them only for those purposes.
3.4 Website analytics
We measure how the website is used with Google Analytics 4. When you open a page, the tag sends Google: the page address, the site that referred you, your browser and device type and screen size, an approximate location derived from your IP address, and the time.
Google receives your IP address in order to make that request at all, and uses it to derive the approximate location before discarding it; it is not passed to us and we never see it. What we see is aggregate: how many people opened the site, from where, on what kind of device, and which parts of the page they reached.
None of that happens unless you accept it. If you decline, or have not answered yet, the Google Analytics script is never requested — Google is not told that you visited at all. There is no “cookieless” fallback measurement and no anonymous ping: declining means no data, not less data.
If you do accept, the tag stores two cookies on your device and one of them holds a random identifier for your browser. It is set to last up to two years — in practice your browser may cap it shorter, and Chrome caps it at about 400 days — and it is what lets us tell a returning visitor from a new one. Both are named and explained in our Cookie Policy. You can withdraw at any time from Cookie settings in the footer of any page, and we delete both cookies when you do.
That identifier is not linked to your reservation. Google Analytics never receives your name, your email address, your creator code or your payment details, and we do not join our analytics to our waitlist table. There is no field in either that would let us do it. Google Signals and ad personalisation are also switched off, so your visit is not added to a Google advertising profile and is not used to target advertisements to you.
Our legal basis for all of it is your consent. Storing or reading information on your device is regulated by the UK Privacy and Electronic Communications Regulations and the EU ePrivacy Directive, which require consent first, and the measurement itself rests on the same permission rather than on a separate legitimate interest — we do not fall back to another basis if you say no. You may withdraw at any time from Cookie settings in the footer, which is as easy as giving it was and takes effect immediately. Withdrawing does not affect the lawfulness of anything measured before it, and it changes nothing else about your reservation.
3.5 Support correspondence
If you email us, we keep your message and our reply for as long as needed to deal with your request and to keep a record of it.
4. Cookies, analytics and tracking
We ask before we store anything, and we default to storing nothing. Accept and this website sets two cookies, both for Google Analytics 4 — first-party, up to two years, one of them holding a random identifier for your browser. Decline, or ignore the question, and the analytics script is not even requested. Either way it carries no session recording, no advertising tag, no social media pixel and no third-party font. The one thing stored without asking is your answer itself, which the Cookie Policy names and explains.
Section 3.4 describes exactly what the tag sends and what we can see as a result: page addresses, referrers, approximate country, browser and device type, and — because of the identifier — whether a visit is a return visit.
We do not track you across websites and we do not build a profile of you. The identifier works only on this site. Google Signals and ad personalisation are switched off in our configuration, so your visit is not joined to a Google advertising profile. We never send Google your name, email address, creator code or payment details, and we do not join our analytics to our waitlist records.
We do not currently behave differently in response to a Do Not Track or Global Privacy Control signal. Those signals principally address the sale of personal information and cross-site profiling, and we do neither. If you would rather not be counted at all, blocking the Google Analytics script in your browser is sufficient, stops both cookies being written, and breaks nothing on this site.
To change your answer, use Cookie settings in the footer of any page. If you had accepted and you now decline, both cookies are deleted immediately and the tag stops sending in the same page view.
If this changes we will update our Cookie Policy and this section first — on the same day, because a policy that lags the site it describes is how two earlier versions of this section came to be wrong.
5. How we use your information
We use what we collect to:
- hold your place on the waitlist;
- send you a confirmation that your registration was received;
- notify you about early access, launch and significant development milestones;
- understand which aircraft to support first, in aggregate;
- respond to your support enquiries;
- protect the Services from abuse and fraud; and
- comply with our legal obligations.
We do not send marketing for anything other than SIMDU. Today the only email this site sends is the confirmation of your reservation, which is sent from an unmonitored address. To stop receiving development updates, or to be removed from the waitlist entirely, email support@simdu.co and we will action it. Any development update we send in future will carry its own unsubscribe link.
6. Legal bases
Where applicable data protection law requires a legal basis:
- Performance of a contract — holding your reservation, confirming it, and contacting you at launch about redeeming the discount you paid for. These are not marketing and they are not optional extras: they are the thing you paid us to do, so they do not rest on consent and unsubscribing from updates does not stop them. It also applies when you licence the Software, once that is available.
- Consent — the analytics cookies described in section 3.4, and the optional development updates. These are the two things you are asked about separately from the reservation itself, and either can be withdrawn without affecting the other or your reservation: cookies from Cookie settings in the footer, updates by emailing us. We do not treat a withdrawal as a reason to fall back to another legal basis for the same processing.
- Legitimate interests — rate limiting, abuse prevention, security monitoring and keeping our records. We have considered these against your rights and limited the data accordingly: the IP address behind a rate limit is hashed and never stored with your entry, and nothing you type into the waitlist form is ever sent to Google.
- Legal obligation — where we are required to retain or disclose information, including the tax and accounting records that follow from taking a payment.
7. Accounts (not yet in operation)
There is no SIMDU account system at present and you cannot create an account. When one is released, we expect to process an account identifier, credentials, licence and activation status and account preferences, and we will update this policy before that happens. Credentials will be stored hashed and never in plain text.
8. Payments
The one payment this website takes is the $1.00, ₹99, £1.00 or €1.00 waitlist reservation. It is handled by Razorpay, a third-party payment processor: you are taken to Razorpay’s secure checkout and your card or payment instrument details are given to them rather than to us.
SIMDU does not collect, see or store complete card numbers, expiry dates, security codes or banking credentials. What we receive back from Razorpay and keep is the payment identifier, the order identifier, the amount, the currency and the time of payment. We use that to confirm your reservation, to apply your discount at launch, to keep accounting records, to prevent fraud and to meet our tax obligations.
Razorpay is a separate controller of the payment data you give them, and their own privacy policy governs it. If the processor changes, this policy and our Refund Policy will be updated to name the new one before the change takes effect.
9. Software diagnostics (not yet in operation)
The SIMDU Software is not released. When it is, it will work by exchanging data with your flight simulator over your own local network. In normal operation that data stays on your network and is not transmitted to us.
If the Software crashes, it may collect diagnostic information about the session — the interface state, the connected aircraft type and technical logs — to investigate the fault. That information will be used only for troubleshooting and reliability, retained only as long as needed for it, and this policy will describe the mechanism in detail before the Software ships.
10. Who we share it with
We do not sell your personal information, and we do not share it for anyone else’s marketing.
We use a small number of service providers who process data on our behalf, under contract and only on our instructions:
- Our hosting provider — serves this website and runs the waitlist endpoint.
- Our database provider — stores waitlist registrations.
- Our email provider — delivers the confirmation and any later waitlist emails.
- Google — provides the website analytics described in section 3.4. It receives page and device information and your IP address at the moment a page loads, and it sets the two cookies named in our Cookie Policy on your device. It is given no name, no email address, no creator code and no payment information.
We may also disclose information to professional advisers, to authorities where the law requires it, and to a successor entity in a merger, acquisition or sale of assets — in which case we would notify you.
11. International transfers
Our providers operate infrastructure outside India, so your information may be processed in other countries. Where it is transferred internationally we rely on the safeguards those providers operate, including standard contractual clauses where applicable.
12. How long we keep it
Waitlist registrations are kept until SIMDU launches and the launch communications are complete, or until you ask us to remove you — whichever comes first. If the product is cancelled we will delete the list.
Rate-limit hashes are held in memory for at most one hour.
Analytics records exist only if you accepted the cookies. Where you did, they are held by Google for the retention period configured on our property and are keyed to the random browser identifier described in section 3.4, not to your name or email address. The two cookies themselves are set to expire two years after your most recent visit, many browsers cap that shorter, and we delete both immediately if you withdraw from Cookie settings — see the Cookie Policy. If you declined, there is nothing to retain.
Support correspondence is kept for as long as needed to handle the matter and to keep a reasonable record of it.
When information is no longer needed we delete or anonymise it.
13. Security
We take reasonable technical and organisational measures to protect personal information, including transport encryption on every request, server-side validation and rate limiting on the waitlist endpoint, a restrictive content security policy, strict transport security, and keeping database credentials server-side only and out of the browser.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information and the law requires it, we will notify you and the relevant authority.
14. Your rights
Subject to applicable law, you may ask us to:
- confirm what personal information we hold about you;
- provide a copy of it;
- correct it if it is wrong;
- delete it;
- restrict or object to how we use it; and
- withdraw a consent you gave us — to the analytics cookies, or to development updates.
For all of these, email support@simdu.co and we will respond within one month. We may ask you to confirm your identity — ordinarily by replying from the address you registered — before we act on a request. To withdraw consent to the analytics cookies you do not need to write to us at all: Cookie settings in the footer of any page does it immediately.
Asking us to delete your waitlist entry ends your reservation. We cannot hold a discount against an email address we no longer have. If you are within the cancellation period described in our Refund Policy, say so and we will refund the fee as well; outside it, section 2 of that policy applies.
If you are unhappy with our response you may complain to your local data protection authority.
15. Children
You must be at least 18 years old to join the waitlist, hold an account, or accept these policies. A person under 18 may use the Services only under the supervision of a parent or legal guardian, who accepts these policies and remains responsible for that use.
We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact support@simdu.co and we will delete it.
16. Third-party links
The Services may link to third-party websites. We are not responsible for their content, security or privacy practices, and we encourage you to read their policies.
17. Changes
We may update this policy. The current version is always at simdu.co/privacy, and the “last updated” date at the top of this page changes whenever the substance does. Where a change is material we will make reasonable efforts to tell you — by email to waitlist members, or by a notice on the site.
18. Contact
For any question or request about this policy or your personal information:
EAssure Solutions India Private Limited
Email: support@simdu.co
Web: https://simdu.co
Concerns that are not resolved through ordinary support may be escalated to our grievance officer — see Contact.
19. Governing law and severability
This policy is governed by the laws of the Republic of India, without regard to conflict of law principles. Nothing in it limits any right that cannot be excluded under applicable privacy or consumer protection law.
If any provision is found invalid or unenforceable, the remaining provisions continue in full force, and the invalid provision is modified only so far as needed to make it enforceable.
20. Related documents
This policy should be read with our Terms & Conditions, Waitlist Terms, Cookie Policy, End User Licence Agreement and Refund Policy.