Version 1.1 dated 16 October 2026
Effective upon publication.
1 Who processes personal data
1.1. GOODLINE SOFTWARES W.L.L. determines the purposes and means of personal data processing for SimPie and acts as controller within the meaning of applicable law.
Commercial Registration No.: 175788-1.
Address: Office 33, Building 114, Road 383, Block 316, Manama, Kingdom of Bahrain.
Privacy and data enquiries: support@simpie.me.
1.2. This Policy covers simpie.me, SimPie applications, accounts, orders and support communications.
2 Information processed
2.1. Depending on how the service is used, we process:
(a) account and authentication information: email, internal identifiers, registration and authentication details; when Google or Apple sign-in is selected, information supplied by that sign-in service;
(b) order and payment information: the purchased plan, amount, currency, order and payment identifiers and status;
(c) eSIM information: ICCID and other necessary technical identifiers, installation details, connection status, usage, remaining allowance and validity;
(d) technical information: device and software characteristics, language, IP address, and information about functionality, errors and security;
(e) support information: name, email, correspondence and materials supplied to resolve an enquiry;
(f) optional analytics information: technical identifiers and information about use of the website, application, plans and orders needed for statistical assessment of SimPie.
(g) consent and mailing information: email, the user’s choice, time of consent or withdrawal and notice version to the extent needed to manage subscriptions and demonstrate that choice.
2.2. Analytics processing may derive approximate location from an IP address. SimPie does not request precise device location for this purpose.
2.3. SimPie does not collect device advertising identifiers, including IDFA and Android Advertising ID, or use them for analytics or advertising.
2.4. We do not receive full payment card numbers, card security codes or banking login credentials. Users provide this information to the relevant payment service.
2.5. Ordinary registration does not involve collecting passport information or identity-verification documents. If a particular service legally requires additional information, a corresponding notice will be provided before collection.
3 Sources
Information is obtained from users, through use of the website and applications, and from the selected sign-in service, payment service and providers involved in fulfilling an order.
4 Purposes
4.1. Information is used to:
- create accounts, authenticate users and verify access;
- process, charge for, deliver and support plans;
- display eSIM status and usage;
- handle enquiries, refunds and payment disputes;
- secure the service, prevent fraud and resolve faults;
- meet legal obligations and establish, exercise or defend lawful claims;
- with consent, analyse SimPie usage, improve the service and measure the effectiveness of SimPie advertising campaigns;
- with separate consent, send SimPie marketing messages by email.
4.2. Registration, authentication, ordering, payment and order support are based on entering into and performing a contract. Mandatory recordkeeping and compliance with binding legal requirements rely on legal obligations. Fraud prevention, necessary diagnostics and protection of claims rely on the Company’s permissible legitimate interests unless overridden by the user’s rights and freedoms; consent is obtained where the law requires it. Optional analytics and marketing emails rely on separate user consents.
4.3. Optional analytics consent is not a condition of registration or purchase. Processing necessary for orders, authentication and service security relies on the relevant separate legal bases.
If a user does not provide information objectively necessary for an account or order, the relevant function or purchase may be unavailable.
4.4. Technical diagnostics are limited to information necessary for the stated purpose. Where a particular diagnostic collection requires consent, it is subject to the user’s choice.
5 Services and recipients
5.1. Authorised personnel and providers receive access to the extent necessary for their respective functions.
5.2. SimPie uses the following categories of services:
- Amazon Web Services: infrastructure hosting and operation;
- Google Firebase: authentication and email verification, configuration management and error diagnostics;
- Google Analytics and Google Analytics for Firebase: optional analytics;
- Google/Gmail: email and support communications;
- Google and Apple: optional sign-in using the relevant account;
- The payment service identified at checkout: payment processing and related administration;
- Email delivery service: necessary service communications and marketing messages where separately consented to;
- Genesis Group AG, the Yesim provider: eSIM and package issuance and servicing.
5.3. For eSIM issuance and top-ups, Yesim receives information necessary to select the package and service the relevant eSIM, including ICCID for top-ups. The user’s email is not transmitted through this integration.
5.4. A payment service may receive the email and user and order identifiers needed for payment. SimPie receives payment results and transaction information needed to fulfil the order and administer payments.
5.5. Providers may act as processors on the Company’s behalf or independently determine certain processing for their own lawful purposes. Their role depends on the actual operation and applicable terms. A provider’s terms do not displace SimPie’s obligations for processing determined by the Company.
5.6. Information may be disclosed to competent authorities or other persons where a lawful ground exists and only to the necessary extent.
Provider privacy information: AWS, Firebase, Google, Apple, Yesim.
Information about the payment service and its data processing is provided at checkout.
6 Processing locations
6.1. SimPie’s main Amazon Web Services infrastructure is hosted in Sweden. Infrastructure used by the Company to process user data is located outside Bahrain. Personnel with access to that data work outside Bahrain; access from Bahrain is not provided.
6.2. International providers may process data in multiple countries. In particular, the Yesim provider is based in Switzerland, and Firebase Authentication involves processing in the United States. Other Google services and infrastructure providers may use additional countries under the applicable service arrangements.
6.3. Where processing involves an international transfer, the Company uses the legal basis and safeguards required for that transfer under applicable law. Locating infrastructure outside Bahrain does not, by itself, remove data protection obligations.
6.4. Information about relevant recipients, processing countries and safeguards may be requested from support@simpie.me.
7 Cookies, analytics, mailings and choice
7.1. The website and applications use technical mechanisms necessary for authentication, security, retaining selected settings and performing requested operations.
7.2. Optional Google analytics starts only after consent. It is used to analyse the operation and use of SimPie, improve the service and measure the effectiveness of SimPie advertising campaigns.
7.3. Users may allow analytics or continue without it. Refusal does not prevent use of core functions. The relevant optional collection is disabled before consent and following refusal.
7.4. Users may change their decision through the website or application privacy settings. Withdrawal stops subsequent collection based on that consent and does not affect the lawfulness of earlier lawful processing.
7.5. SimPie does not use this analytics to personalise advertising to the user. Information needed to retain the selected setting and demonstrate consent is processed to the corresponding minimum extent.
7.6. Marketing messages are sent only with separate consent. Consent is not a condition of registration or purchase and may be withdrawn in settings or through the link in an email. Refusal or withdrawal stops subsequent marketing mailings. Service messages concerning orders and eSIMs are sent independently of that consent to the extent necessary to provide the service; promotional offers are not treated as service messages. Mailing consent does not include analytics consent or authorise use of device advertising identifiers.
8 Retention and deletion
8.1. Account information is retained while necessary to operate the account and related services.
8.2. After account deletion, information is deleted or anonymised, except where continued retention is necessary for outstanding obligations, mandatory recordkeeping, a specific dispute, prevention of established abuse, or a lawful claim.
8.3. Such retention is determined by the applicable requirement, claim period and actual necessity. Information is not retained indefinitely for these purposes by default.
8.4. Deletion also covers relevant user information held by processors to the extent of the applicable obligations and service mechanisms. Backup deletion follows applicable replacement cycles; backups are not used for ordinary operation of the deleted account.
8.5. Anonymous aggregate statistics may be retained where they no longer permit identification of, or association with, a user by reasonably available means. Replacing a name or email with a technical identifier does not, by itself, anonymise data.
8.6. Email is used for marketing mailings until the relevant consent is withdrawn or the subscription ends. Necessary records of the choice and evidence of consent may subsequently be retained only to the minimum extent and for a period justified by demonstrating legal compliance or defending a specific claim; they are not used to continue marketing mailings.
9 User rights
9.1. Subject to applicable law, users may request access, correction, deletion or restriction, object to certain processing, withdraw consent and exercise data portability rights.
Where applicable, portability permits receipt of qualifying data in a structured, machine-readable format and transmission to another controller subject to the statutory conditions.
9.2. Requests should be sent to support@simpie.me. To protect information, we may request proportionate verification that the applicant is entitled to receive the information or request the action.
9.3. Responses are provided within statutory deadlines. Where a request cannot be fulfilled in full, the applicable reason and available challenge routes will be explained.
9.4. Users may complain to a competent data protection authority. Information about the Bahrain authority is available on its official website.
10 Security and changes
10.1. The Company applies proportionate technical and organisational safeguards, including access restrictions and protection of data in transit. No storage or transmission method provides absolute security.
10.2. This Policy is updated when processing changes. Material changes will be communicated through an available channel, and fresh consent will be requested where necessary.
10.3. The English version prevails in the event of inconsistency, except where mandatory law requires otherwise.