Privacy policy

We store your email address and your orders, including the payment details listed below. We use them to deliver your eSIM, confirm your payment and prevent fraud. We don’t sell your data, and the store runs no analytics or advertising trackers.

To have your data deleted, write to [email protected].

When you buy an eSIM, we store:

• Your email address, which you give at checkout.
• Your order: the package, its price, the order reference, the destination page you came from, when it was placed, paid and delivered, your agreement to immediate delivery, and the result of our automatic fraud checks.
• Your eSIM’s details: its ICCID, activation code, status and expiry date, and the reports its supplier sends about it, such as how much data it has used and how many days it has left.
• What Whop reports about your payment: the payment method, the card brand and last 4 digits, whether 3-D Secure verified the card, Whop’s risk score, which of our fraud rules the payment matched, and the email address on the payment. We keep the notices Whop sends us about your payment, its refunds and any dispute or refund request, which can also include the name, username, phone number and billing address on your Whop account, a link to your Whop profile picture, and the expiry date and first digits of any card you pay or try to pay with.
• The card brand and last 4 digits of any card that fails to pay for your order.
• The IP address you placed the order from.
• The emails we send you about your order, and whether they were delivered.

We never see or store your full card number: you enter it on Whop’s checkout, not on esimapp.io.

An account is optional: you can always buy without one. If you create one, we also store:

• Your email address, the name you give (if any), and, if you choose a password, a one-way hash of it, never the password itself.
• If you sign in with Google or Telegram: that service’s identifier for you, and your name if it gives one. From Google we also read your email address, and use it only when Google says it has verified it. We receive nothing else from either service.
• For each device you are signed in on: when it signed in and was last used, its IP address and its browser’s description.
• Which orders belong to your account. When you verify your email address, orders placed as a guest with exactly that address are added to it.

Email verification and password reset links are single-use and expire; we keep only a scrambled form of them.

• To deliver your eSIM on screen and by email, and to send your order link again when you use Find my order.
• To confirm your payment, and to refund it when we have to.
• To prevent fraud: automatic checks limit how many orders one email address or connection can place, and block those linked to repeated failed payments or card disputes.
• To answer you when you write to us, and to handle card disputes.
• To keep the records that accounting and tax rules require.

Under data protection law, we rely on our contract with you to deliver your eSIM and handle refunds, on our legitimate interest in preventing fraud, and on our legal duty to keep accounting records.

We email you only about your orders. We send no newsletters or marketing emails.

We don’t sell your data. These services handle it for us, only as far as they need to:

• Whop runs our checkout and processes your payment. What you enter on Whop’s checkout is also covered by Whop’s own privacy policy.
• Our email delivery service sends your eSIM and your order emails, so it handles your email address and those messages. When we use a backup service for the times the main one fails, that service handles them in the same way.
• Our hosting provider runs the servers and the database that hold your orders.
• The supplier that issues your eSIM receives your order reference and the package only, never your email address or payment details.
• Google, if you sign in with it. Your browser loads Google’s sign-in script from Google, so Google sees your IP address and browser details. Google gives us your identifier, your email address, whether it has verified that address, and your name.
• Telegram, if you sign in with it. Your browser is sent to Telegram’s login page, so Telegram sees your IP address and browser details. Telegram gives us your identifier and your name.
• Cloudflare, on the sign-up, sign-in and forgot-password pages. Its Turnstile check runs in your browser to tell people from bots, so Cloudflare sees your IP address and browser details. Our server then sends it the check’s result token and your IP address to confirm it.

Some of these services may process data outside your country, including in the United States.

The store sets no cookies while you browse and buy, and loads no analytics, advertising or tracking scripts. Whop’s checkout, on Whop’s own site, may use its own cookies.

If you sign in, we set one cookie, esimapp_session, to keep you signed in. It is for that purpose only. While you sign in with Google or Telegram, a second short-lived cookie, esimapp_oauth, protects that sign-in from being hijacked. The scripts from Google and Cloudflare load only on the sign-up, sign-in and forgot-password pages.

We keep your orders for as long as we need them to support your eSIM, handle refunds and disputes, and meet accounting and tax rules. Server logs, which include IP addresses, are deleted after 14 days.

A signed-in device stays signed in for 30 days after you last use it. Signing out ends it sooner; changing your password in Settings signs out your other devices, and a password reset signs out every device. Expired sessions and links are deleted daily. Your account stays until you delete it.

The notices Whop sends us about payments are kept as Whop sent them, and they can include your email address. We have not set a period for how long we keep them, and deleting your account does not remove them.

To have your data deleted, write to [email protected] from the email address you ordered with, and include your order reference if you have it. We delete your data by hand and confirm by email within one month, keeping only what the law requires us to keep, such as accounting records.

In the same way, you can ask for a copy of your data, ask us to correct it, or object to how we use it. If you’re unhappy with our answer, you can complain to your data protection authority.

If you have an account, you can delete it yourself under Settings. It removes your name, email address, password, sign-in links to Google and Telegram, and signed-in devices. Your orders stay for accounting, with your email address replaced by a placeholder. We keep the IP address each order was placed from, because our fraud checks use it, and the notices described above. If one of your payments failed, or your address was blocked after failed cards or a dispute, our fraud-prevention records keep your email address, lowercased and without any +tag, so those checks keep working; deleting your account does not remove them.

We update this policy when what we store, or who handles it, changes. The date at the top shows when it last changed.

esimapp.io is the controller of your data under data protection law.

Questions about your data? Write to us at [email protected].