Simbu privacy policy

Information we collect

• Account details: your username, email address and password. Passwords are stored only as a one-way hash.
• Business details you enter: branch names, addresses, phone and WhatsApp numbers, timezone, opening hours and links to your social profiles.
• Connected accounts: when you connect Google Business Profile or Facebook, we receive an access token from that platform and the name and ID of the location or Page you choose. For WhatsApp Business, the access token and phone number ID you provide.
• WhatsApp assistant: the phone number you write from and the content of messages exchanged with our assistant, so it can understand and confirm changes to your hours.
• Technical logs: requests to our servers (time, address requested, result) used to keep the service running and secure.

How we use it

We don't sell your information, we don't use it for advertising and we don't build profiles of you.

• To publish your opening hours to the platforms you connect, and to show you whether each one is up to date.
• To let you change your hours by WhatsApp and confirm each change before it is published.
• To sign you in, keep your account secure and provide support.

Information from Google

When you connect Google Business Profile, we ask for permission to manage your business listings. We use it only to list the locations your Google account manages, so you can choose one, and to update that location's opening hours. We don't read or change anything else.

Simbu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information from Facebook

When you connect Facebook, we ask to see the Pages you manage and to edit their information. We use this only to list your Pages, so you can choose one, and to update that Page's opening hours. We don't post, read messages or access your personal profile.

Who we share it with

• Google and Meta (Facebook, WhatsApp): only the information needed to publish your hours to the accounts you connected, or to send and receive the assistant's WhatsApp messages.
• Anthropic: the text of messages you send our WhatsApp assistant may be processed by Anthropic's Claude AI model to understand what change you're asking for. Anthropic processes it on our behalf to provide this feature.
• Infrastructure providers that host our servers and database, under their confidentiality and security terms.
• Authorities, when the law requires it.

How we protect it

Platform tokens are encrypted (AES-256-GCM) before they are stored and are never sent to your browser. Passwords are hashed. Access to our systems is restricted to the people who operate the service.

How long we keep it

We keep your information while your account is active. When you disconnect a platform, we delete its stored token right away. Unfinished sign-ins are deleted after 15 minutes. When you delete your account from the dashboard, we delete your account and business information right away; if you ask us by email, within 30 days. We only keep what the law requires us to.

Your rights

You can access, correct or delete your personal information at any time. Most details can be edited directly in the dashboard. You can delete your account yourself from the account menu. For anything else, write to us. See our data deletion page for step-by-step instructions.

Under Argentina's Personal Data Protection Law (Law 25,326) you may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest. The Agency for Access to Public Information (AAIP), as the enforcement authority of Law 25,326, handles complaints about breaches of personal data protection rules.

Children

Simbu is a service for businesses and is not directed to children under 13.

Changes to this policy

If we change this policy, we'll update the date above and, for important changes, let you know by email or in the dashboard.

Contact

Questions about privacy or your data:

info@simbu.rocks