Privacy policy

Last updated: 1 November 2026.

This policy covers the siboncharters.com website and the Sibon apps (iPhone and Android). It explains what data we use, what for, who we share it with, how long we keep it and how you exercise your rights.

1. Who looks after your data

• Controller (trips and bookings): Sibon Charters, Jl. Pulau Karam, Berok Nipah, Padang Barat, Padang 25119, Indonesia. It decides why and how booking data is used.
• Processor (website and apps): A. E. B. Soncini Tecnologia LTDA, CNPJ 49.519.854/0001-78, Florianópolis/SC, Brazil, which builds, hosts and publishes the website and the apps on behalf of Sibon Charters and only handles the data for that.
• Privacy contact: dpo@siboncharters.com. Data protection officer: Alessi Eduardo Brancher Soncini. [A CONFIRMAR: representative in the European Union (GDPR art. 27)]

2. What we collect

When you request spots (website or app): name, e-mail, WhatsApp (optional), the trip, how many guests, the message you write and the discount code, if you use one.

In each guest's form, after your spots are held: full name, e-mail, nationality, passport number and expiry, flights to and from Padang, travel insurance (company, policy and contact), surf level, food restrictions, extra beer, notes and, if you tick it, the image permission, with the date you agreed.

If you create an account (optional): e-mail, name, language and password (stored as a secure hash, never as text). In the account you can keep a traveler profile with the same details as the form, spot and price alerts, reviews (text and, if you want, a photo) and your choice to receive promotions by e-mail, with the date you agreed. If you allow notifications in the app while signed in, we also keep the device's notification identifier (created by Apple or Google), the kind of device and when it was last seen, to send the crew's notices on the trip board and booking alerts (spots on hold, payment deadlines, guest forms, payment confirmed).

Payment by bank transfer: the proof you upload (photo or PDF, which may show your bank details), with amount, currency and date, and the payments our team records. We don't receive card details.

During the trip, in the app:

• One photo a day: taken only with the app's camera, never from your gallery, and sent only if you save it. Only you see it, through your booking link.
• Wave passport: the waves you log, the day and the rating you give; we store the swell of that day with it.
• Share my day: the server gets only the wave you picked, the weather and the image format. The image carries neither your name nor your position and is not stored.

What stays only on your phone and never reaches Sibon:

• Health: surf sessions are read from your workouts in Apple Health (iPhone) or Health Connect (Android), read only, only for your trip dates, only with your permission. There is no way for this data to be sent to our server.
• Location: GPS is used on the emergency card (so you can read out or send your position) and to suggest the nearest wave in "Share my day". The calculation happens on the phone; your position is not sent.
• Offline copies: the booking link (in the iPhone Keychain or encrypted on Android), a copy of "My booking" without anything from the form, the PDF confirmation for immigration (which has your passport) and the trip board photos you already opened. They are kept out of cloud backups and removed when you remove the booking from the phone, when the link stops working or 90 days after the trip.
• Alerts without an account: when you are not signed in on the app, it checks the trip board itself from time to time and shows a local notification, without sending anything from the phone to Sibon.

On the website: language and theme cookies and, if you sign in, the login cookie. We don't use advertising or analytics cookies. To limit abuse, the server uses the IP address of whoever sends requests or signs in. The server access logs (IP address, date, time, the address requested, browser and referring page) are kept for 6 months and then deleted.

3. Why, and on what basis

The legal bases below follow GDPR art. 6 (European Union), art. 20 of Law 27/2022 on Personal Data Protection (UU PDP, Indonesia) and LGPD art. 7 (Brazil).

• Performance of the contract (GDPR art. 6(1)(b); UU PDP art. 20(2)(b); LGPD art. 7, V): the spot request, the booking and the guest form; holding your spots, charging, picking you up at the airport, cooking for you, showing the booking in the apps, keeping your account and acting in an emergency.
• Legal obligation (GDPR art. 6(1)(c); UU PDP art. 20(2)(c); LGPD art. 7, II): the passport and nationality details on the guest list we register with the harbour master, as required in Indonesia, and the payment records kept for accounting. Under Brazilian law only (LGPD art. 7, II), also keeping the server access logs for 6 months, which art. 15 of the Marco Civil da Internet (Law 12.965/2014) requires of the processor; under the GDPR and the UU PDP, keeping them rests on the legitimate interest below.
• Consent (GDPR art. 6(1)(a); UU PDP art. 20(2)(a); LGPD art. 7, I), which you can withdraw any time: promotions by e-mail, use of your image in the crew's photos and videos, allowing a photo of the day on social media, showing your first name, country and surf level to the other guests on the same trip, publishing a review and reading workouts from Apple Health or Health Connect.
• Legitimate interest (GDPR art. 6(1)(f); UU PDP art. 20(2)(f); LGPD art. 7, IX): security of accounts and of the system, such as attempt limits per IP, access logs and the record of who changed each booking.

We don't sell your data or use it for advertising.

4. Use of images

• Photo of the day: our team only sees, downloads and posts on Sibon's social media the photos you allow, one by one (the permission starts off and is recorded with the date). Withdrawing it removes the photo from the team; what was already posted stays online.
• Trip board: the crew posts photos of the day, which may show guests. They only open through the link of someone on that trip.
• Review: name, text and photo only appear on the website after you allow it and our team approves it, without your e-mail.
• Crew photos and videos on social media: on board, the crew takes photos and videos for Sibon's social media. Only people who allowed it in their guest form appear in them: the box starts unticked and the permission is recorded with the date. Each adult guest decides about their own image; whoever fills in someone else's form only ticks the box if that person allowed it. Without it, you don't appear in any post, and the crew sees on the trip manifest who didn't allow it. You can withdraw it any time at dpo@siboncharters.com (our team withdraws it in the system and, after that, the form cannot tick it again), or in the form itself while it can still be edited (until the day before the trip); withdrawing applies from then on.

5. Who sees it and who we share it with

• Sibon's team, each person with access limited to their role, with password and two-step verification.
• Indonesian authorities: the guest list for the harbour master.
• System hosting: GoDaddy (GoDaddy.com, LLC), with the server in the United States, which runs the website, the server side of the apps and the database.
• E-mail delivery: Elastic Email receives your e-mail address and the text of the booking messages to deliver them.
• Push notifications: Apple (Apple Push Notification service, on iPhone) and Google (Firebase Cloud Messaging, on Android) receive the device's notification identifier, the title and the text of the alert to deliver it.
• Maps: on iPhone the waves map is Apple's; on Android, maps come from OpenStreetMap, which receives the phone's IP address when it downloads the map images.
• On the website: fonts come from Google Fonts and videos from YouTube (privacy-enhanced mode), which receive the IP address of whoever opens the page.

International transfer: because the server is in the United States, your data is transferred outside the European Union and Brazil. The transfer relies on contractual safeguards, the standard data protection clauses in the contract with the hosting provider (GDPR chapter V; LGPD art. 33).

6. How long we keep it

• Guest form: kept for up to 5 years after the trip ends, as the record of your trips. After that, passport, nationality, expiry, e-mail, insurance, flights, food restrictions and notes are deleted; only the name, surf level, extra beer and the choices about sharing with the trip and image use (with the date) stay, for the accounts, the history and as proof of the permission.
• Proof of payment: the file is deleted 90 days after the trip ends and the note you wrote, 5 years after; amount, currency, date and decision stay for accounting.
• Booking link: stops working 90 days after the trip ends.
• Trip board photos: deleted 90 days after the trip ends.
• Photos of the day: kept while there is a confirmed account with the booking's e-mail; without one, deleted 90 days after the trip ends. You can delete each one in the app.
• Account, profile, alerts and reviews: until you delete the account.
• Bookings and payments: the phone number, the request message and our team's notes are deleted 5 years after the trip ends. The name and e-mail of whoever booked, the amounts and the payments stay as the accounting record and so the booking keeps showing in your account.
• Promotions: until you leave with one click on the link in the e-mail.
• Notifications: the device identifier is deleted when you sign out (on any device), delete the account, when Apple or Google say it is no longer valid (90 days later) or after 270 days without opening the app signed in. Each notification in the sending queue is deleted after 90 days.
• E-mails we send you (recipient and text, which may mention your name, trip, amounts and the booking link): recipient, subject and text are deleted 5 years after the trip ends (booking e-mails) or after sending (all others); only the record that something was sent stays.
• Server access logs (IP address, date, time, the address requested, browser and referring page): 6 months, then deleted. This is the minimum retention that Brazil's Marco Civil da Internet (art. 15) requires of the Brazilian processor; they also serve the security of the system (legitimate interest).

7. How we protect it

Connections are always encrypted (HTTPS). Passport, insurance, proofs of payment and photos of the day are encrypted in the database, with the key kept outside it and outside the backup. Every change to booking data is logged with who made it, without the personal value.

8. Your rights

You can ask to see, correct, take away or delete your data, and object to a use or withdraw a consent, by writing to dpo@siboncharters.com. We answer within 15 days. You can also complain to a data protection authority: in the European Union, the one in your country; in Brazil, the ANPD; in Indonesia, the authority set up under the UU PDP 27/2022.

Deleting your account: in the app (My booking tab, Account, Delete account) or on the website (My account). See what goes and what stays in Delete account.

9. Minors

Only people aged 18 or over can book or create an account. Guests under 18 only come on board with the guardian who made the booking, who fills in their guest form and provides their details. We don't ask for a date of birth: in the spot request, the sign-up and the guest form, whoever sends it confirms they are 18 or over.

10. Changes

When this policy changes, the date at the top changes too. Important changes will be announced by e-mail to people with a booking or an account.