simby | Privacy policy

Last updated: 23 September 2026

1. Who we are and what this covers

simby is a Portuguese platform, based in Porto, for selling and buying business electronic equipment, for reuse or recycling. This policy covers the simby.pt website, the app.simby.pt platform and the simby and simby admin apps for iPhone, iPad and Mac.

simby is the controller of your personal data. For any privacy question, write to hello@simby.pt.

2. What data we process

On the website

Waiting list and contact: name, organisation, email, mobile number (optional) and message (optional).

On the platform and in the apps

Company data: name, tax number, registered address, country, contact person, email and phone, and the documents the company sends for validation, such as waste management licences.
Account data: name, email, language, and the roles and purchase limit set by the company. The password is stored encrypted by the authentication service and we can never read it.
Platform activity: lots, items and photos you publish, bids, offers, orders, support requests and the documents for transactions and waste (contracts, certificates and waste transfer notes). Each action is linked to the person who did it.
Access log and security: date and time of sign-in, pages and screens viewed, device or browser type and IP address.
Notifications: your device's notification identifier, the device name and the history of alerts sent.

We do not collect device location, contacts, payment data, sensitive data or data about minors. We do not use your data for advertising and we do not track you across other apps or websites.

3. Why we use the data and on what legal basis

Purpose	Legal basis
Creating and managing accounts, and letting you publish, bid, negotiate and order	Performance of the contract (terms and conditions)
Validating companies and their licences, and issuing and keeping waste documentation	Legal obligation
Sending alerts by email, in the app and by push notification about your activity	Performance of the contract
Access log, auditing and fraud prevention	Legitimate interest in platform security
Waiting list and replies to website contacts	Consent
Meeting tax and accounting obligations	Legal obligation

Push notifications are only sent if you allow them on your device, and you can turn them off at any time in the system settings.

Other users, only what is needed: bids are anonymous between competitors. After closing, the seller and the winning buyer learn each other's identity to complete the transaction. Within a company, the account owner sees the activity of the colleagues they invited.
Authorities: when the law requires it, for example when registering waste transfer notes.
Our processors: Supabase (database, files and authentication, hosted in the European Union, in Ireland), Resend (email delivery), Apple (push notification delivery), Formspree (website form) and the website hosting provider. They process data only on our behalf.

Some of these providers may process data outside the European Economic Area. In those cases the transfer is protected by the European Commission's standard contractual clauses or another mechanism provided for in the GDPR.

We do not sell or rent personal data.

5. How long we keep data

Account and activity: while the account is active.
After you delete your account: personal data is erased within 30 days. We keep only what the law requires, such as completed transactions, invoices and waste documents, for the legal period and detached from your account.
Access log: for as long as needed for platform security and auditing.
Website waiting list and contacts: until the platform launches, or until you ask us to delete them.

6. How to delete your account

In the apps: Profile, then "Eliminar a minha conta" (Delete my account).
On the web platform: the menu with your name, "O meu perfil" (My profile), the "A minha conta" (My account) card, then "Eliminar a minha conta".
By email: write to hello@simby.pt from the account's email address.

You receive a confirmation by email and we process the request within 30 days. See also the support page.

7. Your rights

Under the General Data Protection Regulation (GDPR), you can ask for access to your data, rectification, erasure, restriction of processing and portability. You can also object to processing based on legitimate interest and withdraw consent at any time.

To exercise these rights, write to hello@simby.pt. We reply within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD (cnpd.pt).

8. Security

All connections are encrypted (HTTPS). Each company can only access its own data, through rules enforced in the database itself. Legal documents are kept in private storage and only open through temporary links. Passwords are never stored in plain text.

9. Cookies and on-device storage

The website only uses technical cookies needed for it to work. The web platform keeps your session and preferences, such as language and the selected tab, in the browser. The apps keep the session and the same preferences on the device. We do not use analytics or advertising cookies.

10. Minors

simby is intended for professional use by companies and is not directed at minors.

11. Changes to this policy

If we change this policy, we update the date at the top of this page. Significant changes are communicated by email to registered users.