This Privacy Policy describes how your personal information is collected, used, and shared by Simbase Incorporated ("Simbase," "we," "us") when you visit or make a purchase from www.simbase.com (the "Site") or use Simbase services, including signing in with Google.
Personal information we collect
When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. We refer to this automatically-collected information as "Device Information."
We collect Device Information using the following technologies:
"Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
"Log files" track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
"Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse the Site.
When we talk about "Personal Information" in this Privacy Policy, we are talking both about Device Information and personal details shared by website users through web forms, account registration, and authentication providers such as Google.
How we use your personal information
We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our customers browse and interact with the Site, and to assess the success of our marketing and advertising campaigns).
Google user data
Simbase offers the option to sign in with Google. When you choose to sign in with Google, Google shares a limited set of information with us based on the permissions you grant, which may include:
How we use Google user data. We use this information solely to:
Create and authenticate your Simbase account
Identify you when you log in
Display your name and profile picture in the Simbase dashboard
Communicate with you about your account, orders, and service updates
How we store Google user data. Google profile information is stored in our access-controlled production database, encrypted at rest and in transit, and is accessible only to authorized personnel who need it to operate the service.
How we share Google user data. We share Google user data only with the limited subprocessors required to operate our service (for example, our cloud hosting and database providers), as listed on our Subprocessors page. We do not share Google user data with advertisers or data brokers.
We do not sell Google user data. Simbase does not sell, rent, or trade any data obtained through Google sign-in or any other Google API to third parties, advertising networks, data brokers, or information resellers, and we do not use Google user data for advertising or any purpose unrelated to providing and improving the Simbase service. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing your personal information
We use Google Analytics to help us understand how our customers use the Site--you can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/. You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
We may also share your Personal Information with our affiliate Simbase Connect B.V. (Netherlands) for the purpose of operating and supporting the Simbase service.
Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
Data retention and deletion
We retain your Personal Information only for as long as necessary to provide the Simbase service and to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
Specific retention periods:
Account data (including Google profile information): retained for the lifetime of your account. If you close your account or request deletion, we delete or irreversibly anonymize your account and Google profile data within 30 days, except where we are legally required to retain it.
Billing and transaction records: retained for 7 years to comply with tax, accounting, and financial regulations.
Support communications: retained for up to 3 years after the last interaction.
Server and access logs: retained for up to 12 months and then automatically deleted.
Analytics data: retained for up to 26 months in accordance with Google Analytics defaults.
Backups: residual copies of deleted data may persist in encrypted backups for up to 90 days before being overwritten.
How to request deletion. You can request deletion of your account and associated personal data — including any data obtained via Google sign-in — at any time by emailing privacy@simbase.com or through your account settings. We will confirm receipt and complete the deletion within 30 days. Revoking Simbase's access to your Google account at https://myaccount.google.com/permissions will also stop further data sharing from Google to Simbase, but will not by itself delete data we have already stored; please contact us to request deletion.
How we protect your data
We take the security of your Personal Information seriously and implement administrative, technical, and physical safeguards designed to protect it against unauthorized access, disclosure, alteration, and destruction. These measures include:
Encryption in transit: all traffic between your device and Simbase is encrypted using TLS 1.2 or higher.
Encryption at rest: databases, file storage, and backups containing Personal Information are encrypted at rest using industry-standard algorithms (AES-256).
Access controls: access to production systems and personal data is restricted to authorized personnel on a least-privilege basis, protected by strong authentication and multi-factor authentication (MFA), and logged for auditing.
Secure infrastructure: our services are hosted with reputable cloud providers operating from certified data centers (ISO 27001 / SOC 2).
Network security: firewalls, segmented networks, and intrusion detection are used to protect our environment.
Secure development: code changes are peer-reviewed, dependencies are monitored for vulnerabilities, and we perform regular security testing.
Monitoring and incident response: systems are continuously monitored, and we maintain an incident response plan to investigate and address security events, including timely notification where required by law.
Employee training: staff with access to Personal Information receive regular security and privacy training and are bound by confidentiality obligations.
Fraud screening: we use IP address and device signals to screen for potential fraud and abuse.
No method of transmission or storage is 100% secure, but we work continuously to protect your information using current best practices. You can report a suspected vulnerability via our Responsible Disclosure Policy.
Behavioral advertising
As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative's ("NAI") educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.
You can opt out of targeted advertising by:
Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance's opt-out portal at: http://optout.aboutads.info/.
Do not track
Please note that we do not alter our Site's data collection and use practices when we see a Do Not Track signal from your browser.
Your rights — United States
Depending on your state of residence, you may have rights under applicable U.S. state privacy laws, including the right to know what personal information we collect about you, the right to access a copy of that information, the right to request correction or deletion, and the right to be free from discrimination for exercising your rights.
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you with the additional right to opt out of the "sale" or "sharing" of your personal information. Simbase does not sell or share your personal information as those terms are defined under the CCPA, and we do not knowingly sell or share the personal information of consumers under the age of 16.
To exercise any of these rights, please contact us at privacy@simbase.com. We will verify your request and respond within the timeframes required by applicable law. You may also designate an authorized agent to make a request on your behalf.
Your rights — Canada
If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including the right to access the personal information we hold about you, the right to request correction of inaccurate information, and the right to withdraw consent to our processing (subject to legal or contractual restrictions).
To exercise these rights, please contact us at privacy@simbase.com. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where applicable, your provincial privacy regulator.
International transfers
Simbase operates internationally. Your Personal Information may be transferred to, stored in, and processed in countries outside of the United States and Canada, including the Netherlands and other countries where our affiliates and subprocessors operate. Where required, we put in place appropriate safeguards to protect your information in connection with such transfers.
Changes
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.
Contact us
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at privacy@simbase.com or by mail using the details provided below:
Simbase INC. 1401 Pennsylvania Ave, Suite 105 Wilmington, DE 19806-4125 United States of America
