What we collect
- Account: email, hashed password or Google sign-in identifiers, language and currency preferences.
- Orders: product, price, timestamps, delivery status, eSIM QR/activation metadata, SMS rental metadata.
- SMS content: inbound verification messages needed to show the code in your inbox.
- Payments: amount, method, processor references — not full card numbers (those stay with the processor).
- Support: ticket text and attachments you send.
- Technical: IP address, device/browser, security logs, Cloudflare Turnstile challenge results.
Why we process it
To perform the contract (account, orders, delivery, refunds), to prevent fraud and abuse (legitimate interests / legal obligation), and to keep accounting records (legal obligation). We do not sell personal data. We do not run advertising cookies.
SMS messages
Inbound SMS is stored so you can read the code. We delete message content within 24 hours after the rental ends. Order records (that a rental happened, price, status) are kept for accounting.
Recipients and transfers
Processors include Stripe, PayTR, Shopify Payments, Cryptomus, hosting on Hetzner in Germany, SMS and eSIM suppliers, Google (if you sign in with Google), and Cloudflare (Turnstile). Data may leave the UK. We rely on the UK adequacy regulations and/or the UK International Data Transfer Agreement / Addendum where required.
Retention
- Account profile: while the account is open, then a short closure period.
- Orders and payments: typically 6 years for tax and accounting.
- Support tickets: up to 24 months after closure, unless a dispute continues.
- Security logs: typically 12 months.
Automated decisions
The only automated decision with a direct money effect is SMS auto-cancel when no code arrives within 20 minutes. We do not use other profiling that produces legal effects.
Your rights
Depending on UK GDPR you may access, correct, delete, restrict, object, or port data, and complain to the ICO (ico.org.uk). We have not appointed a separate Data Protection Officer; write to [email protected]. We have 30 days as a default to reply to a valid request.