Privacy Policy
How SIMSIM collects, uses and protects personal data — including for visitors in the EU, UK, US, Canada, Australia and India.
Last updated: 2026-09-30
Template for review. Replace bracketed details and have qualified counsel review this document for each jurisdiction before launch.
1. Two roles
For images and biometric data customers send through the API, SIMSIM is a processor (service provider) acting on the customer's instructions under our DPA. If you're an end user of one of our customers, please contact that company first. For our website, sales and accounts, SIMSIM is the controller, and this policy applies.
2. What we collect
- Contact form data: name, work email, company, your message, the plan you selected and the page you sent it from.
- Account and billing data for customers.
- Analytics data, only if you consent: pages viewed, device and approximate location via Google Analytics 4.
- API data processed for customers: images are used to create templates and are not retained after processing.
3. Why and on what basis
- Replying to enquiries and providing the service — contract or steps before a contract.
- Security and fraud prevention — legitimate interests.
- Analytics — consent, which you can withdraw via Cookie settings.
- Legal compliance — legal obligation.
4. Sharing
We use service providers including our form processor (Formspree) and, with consent, Google Analytics. We don't sell or share personal data for cross-context behavioural advertising, and we never sell biometric data.
5. International transfers
Where data moves across borders we use appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
6. Retention
Enquiries: up to 24 months after last contact. Customer records: for the contract term plus statutory periods. Biometric templates: per the customer's instructions and our Biometric Data Policy.
7. Your rights
Depending on where you live, you can access, correct, delete or port your data, object to or restrict processing, withdraw consent, and complain to a regulator.
- EU/UK: your local data protection authority or the ICO.
- California: rights to know, delete, correct and limit use of sensitive personal information. We honour Global Privacy Control signals.
- Canada: the Office of the Privacy Commissioner or, in Quebec, the CAI.
- Australia: the OAIC.
- India: rights under the DPDP Act, including grievance redressal and nomination.
Email privacy@sim-sim.io. We respond within the time the law requires.
8. Grievance officer and contact
[Name], Privacy and Grievance Officer, [SIMSIM legal entity name], [address] — privacy@sim-sim.io.