Privacy policy

This is everything we actually store. There is nothing else.

Listing what we don't do matters just as much for your decision.

There are only four purposes: fulfilling your order and delivering the eSIM; supporting you when you check an order or request a refund; sending email tied directly to a transaction (provisioning notices, password resets); and detecting and blocking abuse and fraud.

We do not use your email address for marketing.

The following providers touch the relevant data so the service can run. Each one receives only the part it needs for its own step.

This site uses three kinds of cookie. Strictly necessary cookies keep you signed in and remember your cookie choice; the site cannot work without them, so we do not ask consent for those. A preference cookie records your interface language. Analytics cookies measure how the site is used, and are only written after you explicitly agree.

The analytics cookie holds a randomly generated visitor ID used to recognise repeat visits from the same browser. It contains no name or email address, is never used for cross-site tracking, and is never shared with advertisers. You can withdraw consent at any time through "Cookie settings" in the footer — we delete these cookies and stop recording immediately.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal and do not ask again.

Once you agree, we record how the site is used: page paths, referrers, IP address, approximate location and device type. This data sits in our own database and serves three purposes — understanding where visitors come from, finding where the checkout flow loses people, and investigating whether a suspicious order is part of repeated attempts from one source.

The plaintext IP address is kept for 30 days and then cleared automatically, leaving only an irreversible hash used to tell whether two visits came from the same source. Visit records are deleted in full after 180 days. These periods are implemented in a scheduled cleanup job, not just stated here.

We also still use Google Analytics for overall trends. It is governed by the same choice above — if you decline, it is not loaded at all.

We keep your account and order data for as long as your account exists. You can ask us to delete your account, but completed transaction records may need to be retained for a period for accounting reconciliation and fraud prevention, and that part cannot be deleted along with the account.

The exact retention period has not been settled. We are not going to state a number of days here that is not yet implemented in the system.

Visit data is the exception: its retention is settled and implemented (30 days for plaintext IPs, 180 days for visit records), as described under "Site analytics" above.

The providers above may process this data on servers outside your own country or region. Using this site means you understand that.

You can ask to see the data we hold about you, correct anything that is wrong, or delete your account. Please send the request through our contact page from the email address you registered with — we need that to confirm the request is really from you.

If we cannot honour part of a request (for example the transaction records mentioned in the previous section), we will tell you why rather than simply not reply.

When this policy changes, the "last updated" date at the top of this page changes with it. If the change materially affects how data is used, we will notify registered users by email.