Privacy Policy
Last updated: 10/09/2026
- You can browse the catalog and the map without creating an account.
- If you create an account, we keep the minimum needed for it to work: your name and email, your favorites and your conversations with selling companies.
- The company you talk to sees your name (or your email, if you didn’t give a name) and the messages of that conversation.
- We don’t sell your data. There are no ads, and neither the app nor the website uses advertising tracking tools.
- You can delete your account at any time, from the app or by email.
- If you use Encario to run your company, you control your business data; we process it on your behalf.
- For any question or to exercise your rights: support@encario.com.
1. Data controller
Encario (the “Platform”, available as a web app and a mobile app) is operated by noctime design, the controller of the personal data collected through it. For any question about your data you can write to us at support@encario.com.
2. Data we process
If you only browse
To show you the website or the app, our server automatically receives, like any web server, your IP address and the usual technical data of your connection (device or browser type, date and time of the request) and keeps them in its logs. You don’t need an account and we don’t build any profile of you.
The legal pages (policy, terms and account deletion) are shown in Spanish if your device is set to Spanish and in English otherwise. If you change the language with the selector on the page, we remember your choice during your visit using a technical session cookie. We do not use advertising or tracking cookies.
If you create an account or sign in with Google or Apple
| Data | What for | Who sees it |
|---|---|---|
| Name and email address. If you sign in with Google: your name, email and profile picture. If you sign in with Apple: your Apple identifier and, depending on what you choose to share, your name and an email (your real one or the private relay address Apple generates). | To create and manage your account and to identify you to the company you talk to. | You; the Encario team; and, in your conversations, the selling company (your name or, if you didn’t give one, your email). |
| If you sign in with Apple: an access code that Apple gives us when you sign in (we store it encrypted). | Only to ask Apple to withdraw the “Sign in with Apple” permission when you delete your account. We use it for nothing else. | Nobody: it is encrypted and is erased when your account is deleted. |
| Password (we only keep a hashed version that cannot be read). | So that you can sign in to your account. | Nobody. |
| Your favorites. | To save the machines you are interested in. | Only you. |
| The messages of your conversations with companies, and the data of blocks and reports (who reported, the reason, any details and, where applicable, the flagged message). | To talk to the selling company about a machine and to keep the environment safe. | You and the staff of the company in that conversation; the Encario team for moderation and support. |
| Session data: identifier, IP address, device or browser type, and sign-in, last-use and expiry dates. | To keep your session signed in securely and to detect improper access. | The Encario team. |
| Only if you turn on notifications: a device identifier (push notification token), the platform (iOS, Android or web), the app version, the language and the time zone. | To let you know about new messages. | The Encario team; Google and Apple, to deliver the alert. |
| Error reports: if the app fails, it may send us a technical report (error message, screen, app version, platform, your internal user identifier if you are signed in, and the IP address it is sent from). | To detect and fix failures. | The Encario team. |
If you work for a company that uses Encario
- Account data: name, email address, hashed password, company and assigned role.
- Platform usage data: activity log (actions performed, timestamps, IP address) for audit and security purposes.
- Operational data entered by the user: machinery, customer, supplier, document, invoice, contract and communication data that the user or their company manages in the Platform.
If you write to us
The contact data you voluntarily provide when requesting a demo or writing to us (for example, your name, email or phone number and your message).
3. Purposes and legal basis
- Providing the service and granting access to your account and your company’s data — legal basis: performance of a contract.
- Authentication and security, including preventing unauthorized access and keeping an activity log — legal basis: legitimate interest and legal obligation.
- Support and service-related communications — legal basis: performance of a contract.
- Handling demo or contact requests — legal basis: the data subject’s consent.
- Compliance with legal obligations (e.g. tax and accounting) — legal basis: legal obligation.
- Moderating marketplace messaging (handling blocks and reports between buyers and companies, including deleting the reported account where warranted) — legal basis: legitimate interest in keeping a safe environment, and legal obligation stemming from app store policies.
- Letting you know about new messages through push notifications, only if you have turned them on on your device — legal basis: performance of a contract and your consent (the system notification permission, which you can withdraw at any time).
- Detecting and fixing app failures through technical reports — legal basis: legitimate interest in the service working properly.
4. The mobile app
Sign in with Google or Apple
The Encario mobile app lets you sign in with an email and password or with your Google account (“Sign in with Google”). When using Google sign-in, we only request the basic profile data (name, email and picture) needed to identify you and link your account. We do not post anything to your Google account and do not access any other Google services on your behalf. You can revoke access at any time from your Google account security settings.
If you sign in with Apple, we only use the identifier and, if you choose to share them, the name and email address Apple sends us, to identify you and link your account. We also store, encrypted, an access code that Apple gives us, solely so that we can ask Apple to withdraw the permission when you delete your account. You can stop using this sign-in from your Apple ID settings.
Push notifications
If you turn them on, we let you know about new messages in your conversations. To deliver them, your device identifier and the text of the notification pass through Google’s notification service (Firebase Cloud Messaging) and, on iPhone and iPad, through Apple’s push notification service. You can turn them off at any time in your device settings; when you sign out, the app unregisters that device, and when you delete your account the identifiers of your devices are erased.
What is stored on your phone
The app stores on your device your session (in the system’s secure storage: the iOS Keychain or the Android Keystore), your preferences (language and light or dark theme) and, if you work for a company, the active company. If an error report cannot be sent (for example, with no coverage), it is kept on the phone until it can be sent. When you sign out or delete your account, the stored session is erased.
Camera
Only Workshop Mode, meant for company staff, uses the camera, and only to scan machine QR codes. Reading is done on the device itself: no photo or video is saved or sent. The app does not ask for location permission.
Map
When you open the map, your device downloads the map images from OpenStreetMap (tile.openstreetmap.org), so OpenStreetMap receives your IP address and the area of the map you are viewing. The app does not send your location to anyone.
5. Messaging, blocking and reports
The app includes a chat between buyers and selling companies about a specific machine. That chat carries the safety measures required for messaging between strangers:
- Blocking: either party (buyer or company) can block the other from within the conversation itself. Blocking stops new messages in both directions; either party can undo it.
- Reporting: either party can report a message or the conversation, stating a reason and, optionally, further detail. Reporting does not hide the message or automatically penalize anyone — it is logged for the Encario team to review.
- Review and account deletion: when reviewing a report, the Encario team may dismiss it or, where warranted, delete (anonymize) the reported buyer's account, under the same conditions as the account deletion described in this policy.
We keep blocking and report data for as long as needed for the safety of the Platform and to handle potential claims, even if either party's account is later deleted.
6. Retention and deleting your account
We keep your data while your account remains active and, afterwards, for the periods legally required to address potential liabilities. Each company’s operational data is retained according to that company’s instructions, as it acts as the controller of the data it enters into the Platform.
You can delete your account at any time, from the app (profile icon → “Eliminar mi cuenta”) or by writing to us. Your favorites, notification devices, profile picture and sessions are erased, and your name, email, phone number and password are replaced with generic values. Conversations with companies and the data of blocks and reports are kept, without your identity. The details, step by step, are on the Delete account page. Server backups may still contain your data until they are renewed on their usual cycle.
7. Recipients and processors
We do not sell your data. We only share it with whoever is needed to provide you the service:
- The selling companies you choose to talk to: they receive your name (or your email, if you didn’t give a name) and the messages of the conversation.
- Hosting and server infrastructure provider.
- Email delivery providers (including Amazon Web Services / SES).
- Stripe payment gateway, where paid plans are contracted.
- Google, as the federated sign-in provider and the notification service (Firebase Cloud Messaging).
- Apple, as the Sign in with Apple provider and the Apple Push Notification service.
- OpenStreetMap, which serves the map images (it receives the IP address of whoever opens the map).
Providers that process data on our behalf do so under a data processing agreement.
8. International transfers
Some providers may process data outside the European Economic Area. In such cases we ensure appropriate safeguards are in place (for example, the European Commission’s standard contractual clauses).
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to support@encario.com; we will reply within one month at most. If what you want is to delete your account, it is quicker to do it from the app (see Delete account). You may also withdraw your consent at any time and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Children
Encario is a tool for people over 18. It is not directed at children and we do not knowingly collect children’s data. If you believe a child has given us data, write to support@encario.com and we will delete it.
11. Security
We apply technical and organizational measures to protect data: password hashing, role-based access control, per-company data separation, encrypted communications (HTTPS) and activity logging.
12. Changes to this policy
We may update this Privacy Policy to reflect legal or service changes. We will publish the current version on this page, indicating the last updated date.
13. Contact
Encario is operated by noctime design. For any question regarding this policy or the processing of your data, write to support@encario.com.