Last updated: November 1st, 2026

Privacy Policy

1. Who Is Responsible

The controller responsible for your personal data on this service is:

Similarity B.V.
Catharina van Rennesstraat 28, 1077KX, Amsterdam
privacy@simil.ar

2. What We Process, Why, and on What Legal Basis

  • Your account. When you sign in with Google we store your email address, whether Google has verified it, your name, the address of your Google profile picture, the nickname you choose and when the account was created and last updated, together with the identifier Google uses for you. Other users can find you by your nickname to share a project with you. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • Signing you in. We store a hashed token for each browser login session and, for each API key you create, its label, a hash of the key, a short hint for recognising it, and when it was created and last used. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • Unfinished signup. Between signing in with Google and choosing a nickname we keep a hashed signup token and the page you were heading to. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
  • Projects and sharing. We record which analysis projects your account belongs to, and, when you invite someone into a project, who invited whom and whether the invitation was accepted. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • Access logging. For each request we log your account number (not your name or email address), the request method and address with sign-in secrets removed, the response status, size and duration, your IP address and your browser's user-agent string. Legal basis: our legitimate interest in keeping the service secure and running (Article 6(1)(f) GDPR).
  • Sample analysis. We process the files you upload, their filenames and the analysis derived from them, including names you give to functions. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • Feedback. When you send feedback on an analysis we process your text together with the sample and address it concerns and an author label. Legal basis: our legitimate interest in improving the analysis (Article 6(1)(f) GDPR).

Data described here will be processed by the platform. Similarity B.V. team members may have access to this data as needed to provide the service to you, for example in responding to support requests or feedback.

3. Uploaded Files

Files uploaded for malware analysis are not shared with third parties. The service's own analysis backend processes and stores them, together with their filenames and the analysis derived from them. A file you upload may itself contain personal data about other people; we do not inspect or filter it for that.

4. Internal Processing

Two parts of the service process data on our behalf. They are run by us, acting as Data Processor, and are not third parties:

  • The analysis backend holds the filenames and contents of the files you upload and the analysis derived from them. It receives the identifier of the analysis project you are working in, never your email address, name or nickname.
  • The feedback system holds the feedback you send: the sample identifier, the address within it, your free text and an author label, which is your account's name or, if it has none, your email address.

5. Third-Party Recipients

We sell no personal data. We pass personal data to these third parties only:

  • Google, as identity provider. When you sign in, your browser makes the OAuth round trip to Google, and if you gave us your email address in advance we send it to Google as a login hint. Google returns to us your Google account identifier, email address, whether that address is verified, your name and your profile picture address. Data processing agreement: <DPA status: Google>.
  • SendGrid, as mail processor. When you invite someone into a project, SendGrid receives the invitee's email address, a label naming you as the inviter (your nickname, name or email address) and the invitation link. When you create your account, SendGrid receives your email address and nickname to send you a one-time welcome email. Data processing agreement: <DPA status: SendGrid>.

6. Cookies and Tracking

We set only cookies that sign you in and keep you signed in:

  • similar_session keeps you logged in to your browser session. It expires after 30 days.
  • similar_signup holds an unfinished signup while you choose a nickname. It expires after 24 hours.
  • __Host-similar_oauth_state, __Host-similar_oauth_next and __Host-similar_oauth_nickname carry a Google login round trip from our site to Google and back. They expire after 10 minutes.
  • last_login_method remembers how this browser last logged in, by email or with Google, so the login page shows that way first. It holds the method only, never your address or account, stays after you log out, and expires after 400 days.

We set no analytics, measurement or tracking cookie, and we embed no third-party tag or script on our pages.

7. Data Retention

  • Login sessions are deleted 30 days after they expire.
  • Unfinished signups are deleted 2 days after they expire.
  • Project invitations that are never accepted are deleted 7 days after they were sent.
  • Accounts: user information removed on account deletion.
  • API keys: until account or key deletion/expiry.
  • Project memberships: Until deletion of project or account, whichever comes first.

8. Artificial Intelligence & Automated Decision-Making

  • Similarity B.V. does not use automated decision-making.
  • Any third-party agent, client or assistant connected to the services (e.g. via MCP), personal information held by Similarity B.V. may be transmitted to the provider of that client at your discretion. That provider acts under your own agreements with it and is not a third-party or supplier to Similarity B.V.

9. Your Rights

You have the right to access, correct and erase your personal data, to receive it in a portable form, to object to processing based on legitimate interests, and to complain to a data protection supervisory authority.

  • Download the account data held in our account database from /settings/export: your profile, sign-in identities, login sessions, unfinished signups, API keys, project memberships and invitations. It does not include the files you uploaded or the analysis derived from them, which the analysis backend holds, the feedback you sent, which the feedback system holds, or the access logs.
  • Delete your account at /settings/delete. This removes your account and every row stored against it in our account database, including your project memberships. It does not erase the files you uploaded or the analysis derived from them, which the analysis backend holds, nor the feedback you sent, which the feedback system holds; a project shared with other members stays with them.
  • Change your nickname in your settings.

For any other request, contact us at the address below.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@simil.ar.