Pop Machine Privacy Policy

Effective date: 2 September 2026 · Language: English

This Privacy Policy explains how Simple.Life Apps Inc, a Delaware corporation with registration no. 7688095 and registered address at 8 The Green, Ste A, Dover, County of Kent, DE 19901, USA, and AM APPS Ltd, a Cyprus company with registration no. HE 392517 and registered address at 188 Ayias Fylaxeos, Excelia Tower, Ground Floor, 3083, Kapsalos, Limassol, Cyprus, collect, use, store, disclose, and protect personal data when you use Pop Machine.

“Pop Machine” means the Pop Machine iOS application and related services, features, content, communications, and support channels. In this Policy, “Company”, “we”, “us”, and “our” refer to the companies listed above. Simple.Life Apps Inc acts as the data controller for personal data processed under this Policy, unless a different controller is stated in a specific notice. Pop Machine uses shared Simple.life infrastructure for account authorization, content delivery, notifications, security, and operations. This means Pop Machine data may be processed in shared company systems and by shared service providers, while being identified and operated as Pop Machine data where appropriate. If you do not want us to process your personal data as described in this Policy, please do not use Pop Machine.

Pop Machine is an internal tool: employees of Simple and contracted partners use it to watch, react to, and comment on marketing video creatives that Simple is producing or researching. Access requires a Simple corporate Microsoft account or an account issued by Simple.

1. Personal Data We Collect

We collect the following categories of personal data for the purposes described. You provide some of it, some is generated when you use Pop Machine, and some is provided by your identity provider.

Purpose: Provide Pop Machine: sign-in, the review feed, synchronisation across your devices, and offline caching.
Data categories: Account ID, name, work email address, display name, nickname, an avatar image if you upload one, a device identifier generated by the app, the device name you give it, app settings, review state (which creatives you have viewed, liked, disliked, or marked to send to test) and the time of each such action, and synchronisation timestamps.
Collection source: Your Microsoft Entra ID sign-in or the account Simple issued to you; you, through the app; generated automatically when you use Pop Machine.
Legal basis where GDPR applies: Contract, legitimate interests, and consent where required.

Purpose: Operate comments, mentions, and notifications.
Data categories: Comment content, the creative and playback position a comment refers to, @-mentions, message metadata, notification tokens (Apple Push Notification service), and account ID.
Collection source: You provide it, or it is collected automatically when comments are posted and notifications are delivered.
Legal basis where GDPR applies: Contract, legitimate interests, and consent where required.

Purpose: Bring creatives into review: links and files you share into Pop Machine.
Data categories: The links you share (for example a TikTok, Instagram, or Meta Ad Library page), public page metadata we retrieve for them, files you upload, and your account ID as the contributor.
Collection source: You provide it through the share extension or the app; page metadata is retrieved from the linked site.
Legal basis where GDPR applies: Contract and legitimate interests.

Purpose: Show team activity and attribute work to its author.
Data categories: Your name, nickname, and avatar next to comments and creatives you brought in; counts of creatives you have liked and contributed.
Collection source: Generated from your use of Pop Machine.
Legal basis where GDPR applies: Legitimate interests.

Purpose: Maintain, secure, debug, and improve Pop Machine.
Data categories: Device identifiers, IP address, app version, server request logs, diagnostics, and aggregated or de-identified data.
Collection source: Collected automatically when you use Pop Machine.
Legal basis where GDPR applies: Legitimate interests.

Purpose: Comply with law, enforce our rights, resolve disputes, and protect users, the Company, and third parties.
Data categories: Account data, usage data, comment content, security logs, and records needed to establish or defend legal claims.
Collection source: Collected from you, generated by us, or received from service providers.
Legal basis where GDPR applies: Legal obligation and legitimate interests.

2. Cookies, SDKs, and Similar Technologies

Pop Machine uses local storage on your device to operate: the iOS Keychain holds your session token; on-device storage holds cached videos and your review state so the feed works offline; and the Microsoft Authentication Library handles corporate sign-in. Our service providers may set the cookies necessary to deliver and secure the service.

Signing out removes your session; deleting the app removes the rest. You can control notifications through your device settings. If you disable certain technologies, some features may not work as expected.

3. How We Use Personal Data

To authenticate you and manage your access to Pop Machine.
To provide the review feed, keep your reactions and comments in sync across your devices, and cache creatives on your device for offline viewing.
To attribute comments, reactions, and contributed creatives to you within the team.
To deliver notifications you have enabled, such as when a colleague mentions you.
To maintain safety, quality, reliability, and performance, fix bugs, and develop product improvements.
To comply with law, enforce our agreements, and protect rights, safety, and security.

We may share personal data with:

Other users of Pop Machine within Simple and its contracted partners, who see your name, nickname, avatar, comments, reactions, and activity counts as part of the shared review workspace.
Service providers that host, secure, deliver, and operate Pop Machine, including identity (Microsoft), push notifications and app distribution (Apple), and cloud hosting and storage (Amazon Web Services).
Company affiliates and personnel who need access to operate Pop Machine and shared infrastructure.
Professional advisers, regulators, courts, law enforcement, or other parties where required by law or necessary to protect rights and safety.
Another organization in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards.

We do not sell personal data.

5. International Transfers

We operate internationally and may process personal data in the United States, European Economic Area, United Kingdom, Cyprus, and other countries where we or our providers operate. Where required, we use appropriate safeguards such as standard contractual clauses or other lawful transfer mechanisms.

6. Retention

We keep personal data for as long as necessary to provide Pop Machine, maintain your access, comply with legal and accounting obligations, resolve disputes, enforce agreements, prevent fraud, and improve the service. Retention periods vary based on the type of data and the reason we process it.

When personal data is no longer needed, including after your access to Pop Machine ends, we delete it, de-identify it, or aggregate it unless retention is required or permitted by law. Comments and reactions may be kept, attributed to a deactivated account, where they form part of a team’s review record.

7. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, port, or restrict the processing of your personal data; object to certain processing; withdraw consent; appeal a decision; or lodge a complaint with a supervisory authority.

You can edit your display name, nickname, and avatar in the app, and turn notifications on or off at any time. You can exercise other privacy rights by contacting us at support@simple.life. We may need to verify your request before acting on it. Authorized agents may submit requests where permitted by law.

8. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure, including encryption in transit and at rest and access limited to the personnel operating the service. No online service can be guaranteed to be completely secure, so you should protect your devices and your corporate account and contact us if you believe your account or data has been compromised.

9. Children

Pop Machine is not intended for people under 18. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided personal data to us, contact us and we will take appropriate steps to delete it.

10. Changes to This Policy

We may update this Policy from time to time. If changes materially affect your rights or how we process personal data, we will take reasonable steps to notify you, such as by email, in-app notice, or posting an updated Policy with a new effective date.

11. Contact Us

For privacy questions, requests, or complaints, contact us at support@simple.life. Our data protection officer can be reached at dpo@simple.life.

You may also write to AM APPS Ltd, 188 Ayias Fylaxeos, Excelia Tower, Ground Floor, 3083, Kapsalos, Limassol, Cyprus.