Privacy Policy

1. Who we are

e-sim.onl is operated by Infinite Tech Solutions LLC, United Arab Emirates.

We decide why and how your personal data is used, which makes us the controller of the data described here.

2. What we collect and why

We use personal data to run the service you asked for, to keep it secure and to meet our legal duties. We use it for marketing only with your consent. This is what we hold and why.

• Account details. Your name, email address and a password hash (we cannot read your password), whether you have verified your email address, your email preferences, the version of the terms you accepted and the date you created the account. We use them to run your account, sign you in and send you your orders.
• Orders. The plan, price, date and status of each order, the order number, your name and email address, the references Stripe gives us for the payment, a nickname if you give the eSIM one, and the eSIM's QR code, activation code and ICCID (its serial number). Our team and systems may add notes, for example about a refund. We use them to deliver your eSIM, support you, handle refunds and meet our accounting and tax duties.
• eSIM status. Our eSIM provider reports each eSIM's status, how much data has been used, and when it was installed, first connected and expires. Once the eSIM is installed, it also reports technical identifiers: the IMSI, the eSIM's phone number if it has one, the APN and the EID (the ID of your phone's eSIM chip). We use them to show your eSIM in My eSIMs, send eSIM notices and answer support questions.
• IP address and browser details. We record your IP address and your browser's user agent with each order. We also record your IP address in activity records, and we use it to limit how many requests one address can send.
• Activity records. A log of account and admin actions, such as accounts being created, sign-ins (including failed attempts), password changes, account deletions, orders, refunds and actions by our staff in the admin area. Each record holds the action, the account it concerns, the time, an IP address and some technical details. For some actions (a sign-in locked after repeated failures, an email that bounced or was reported as spam, and a password reset, an email change or a deletion made by our staff) it also holds an email address. We use it to secure accounts and investigate problems.
• Server logs. Cloudflare keeps our API's request logs and the messages our code writes. They can include the address that was requested, order references and, in a few cases, an email address. We use them to find and fix problems.
• Messages to us. If you use the contact form, we receive your name, email address, subject and message by email. We use them to reply.
• Searches with no results. When a search for a destination finds nothing, the site sends the words you typed to our server. We keep them, without your IP address or account, to see which destinations people look for.
• Campaign tags. If you arrive from a link with campaign tags (utm_source, utm_medium, utm_campaign) or from another site, your browser keeps those tags and the site you came from until you close the tab. If you then start an order, we save them with it, so we can see which links lead to orders.
• Sharing an eSIM. If you share an eSIM, we create a link that shows its plan, nickname, status, data use and dates to anyone who has the link. You can turn the link off at any time with the "Revoke share link" button. If you enter an email address to send the link to, we send one email to that address with the eSIM's QR code and codes, and we do not keep the address.

3. Sign in with Google or Apple

You can create an account or sign in with Google or Apple instead of a password. You agree to share your details on the provider's own screen, and only then does anything reach us.

• From Google we receive your name, your email address and an identifier for your Google account. Google can also include a link to your profile picture, which we do not keep.
• From Apple we receive your email address, an identifier for your Apple account and, the first time you sign in only, your name. If you choose Hide My Email, the address is a private relay address that forwards to your own.
• What we keep. We save the provider, your account identifier and the email address it gave us in a record linked to your account. When we create your account from a sign-in, we use the name the provider sends as your account name. We use the record to recognize you the next time you sign in.
• Existing accounts. If an account with the same email address already exists, we link the sign-in to it instead of creating a second account.
• What we do not do. We do not receive your Google or Apple password, and we never post to or read your Google or Apple account beyond the details above. Signing in this way does not sign you up for marketing email.

Google and Apple handle your data under their own privacy policies: Google's privacy policy and Apple's privacy policy. Deleting your e-sim.onl account also deletes the record we keep of your sign-in.

4. Payments

Stripe takes your card payment on its own checkout page. Your card number never reaches e-sim.onl: we do not receive, see or store it.

To start the payment we send Stripe your email address, the name and price of the plan, and our references for the order, the plan and your account. Stripe tells us whether the payment worked, and we keep the references it gives us with your order. Stripe handles your payment details under Stripe's privacy policy.

5. Who we share data with

We share personal data only with the providers below, and only what each needs for its job. We do not sell your personal data.

• Stripe takes your payment (section 4).
• eSIM Access is our eSIM provider. We send it the plan you bought and our order reference, plus the eSIM's own identifiers when we check its status or add a top-up. We do not send it your name or email address. Your QR code image is hosted by eSIM Access, so when your browser or email app loads it, eSIM Access sees that request, including the IP address and browser details of whatever loaded it. See eSIM Access's privacy policy.
• SendGrid, part of Twilio, sends our email. It receives your email address and the content of each message, which can include your name and, in order emails, your QR code and activation details. It can report bounces and spam complaints back to us. See Twilio's privacy notice.
• Cloudflare delivers e-sim.onl and runs our servers, database, cache and file storage. It also runs the bot check (Cloudflare Turnstile) on the forms for creating an account, signing in and resetting a password, including the sign-in dialog at checkout. For that check Cloudflare receives signals such as your IP address and browser details, and our server passes it your IP address when it confirms the result. See Cloudflare's privacy policy and its Turnstile privacy addendum.
• Google and Apple receive your sign-in request if you choose them (section 3).

Where it is processed. These providers process data in several countries, including the United States and countries in the European Union, and Cloudflare handles traffic on its global network. Your data can therefore be processed outside the country where you live.

6. Email

We send these kinds of email:

• Account and order emails. Email verification, password reset, account deletion confirmation and, for orders, your confirmation with the QR code and activation details, delay notices, refund notices and top-up confirmations. We also send the email that shares an eSIM when you ask us to. We need these to run your account and orders, so you cannot turn them off.
• eSIM notices. Emails about your data use and your eSIM's expiry. They are on by default, and you can turn them off under Settings.
• Marketing. Deals and travel tips, only if you ticked "Email me deals and travel tips" when you created your account. Signing in with Google or Apple does not tick it.
• Checkout reminders. When you review an order, a box asks whether we may email you a link to finish it if you leave before paying. It is ticked by default. If it is ticked, we send one email about that order, within a day, unless you start or pay for another order first. If you untick it, we do not send one. Under Settings you can turn checkout reminders off, and while they are off we send none.

Every marketing email and every checkout reminder has an unsubscribe link and the List-Unsubscribe headers that let your email app unsubscribe you in one click. Unsubscribing stops both marketing email and checkout reminders. You can also email privacy@e-sim.onl. When SendGrid tells us that you marked one of our emails as spam, we turn off marketing email, checkout reminders and eSIM notices for your address.

When SendGrid reports that an email bounced, we mark it on the order. Depending on its settings, SendGrid may record whether an email was opened or a link in it was clicked. We do not use that information, and our systems do not store it.

7. Cookies and browser storage

We set these cookies, all only to sign you in. We use no analytics or advertising cookies.

• refresh_token keeps you signed in. We set it when you sign in or create an account, and renew it each time you use your account. Page scripts cannot read it (it is HttpOnly), it is sent only over HTTPS and only to the sign-in part of our API, and it ends after 7 days without use or when you sign out.
• __Secure-esim_oauth_google or __Secure-esim_oauth_apple protects sign-in with Google or Apple against forged requests. We set it when you start that sign-in and remove it when the sign-in ends. It lasts 10 minutes at most.

Cloudflare, which delivers e-sim.onl, can set its own security cookies if it needs to check that a visitor is not an automated bot. We do not control or read them.

Your browser also stores a few items for this site:

• Session storage, cleared when you close the tab: the campaign tags from section 2 and the plan or order you are checking out.
• Local storage: a hint that you are signed in (an expiry time only, no personal data) and a note that you have signed in on this device before, so checkout opens on Sign in.
• IndexedDB: when the page after payment shows your eSIM, your browser keeps a copy of its QR code image, activation code and ICCID, with the order number, destination, plan size, validity, the date the order completed, an internal order reference and when the copy was saved. It is cleared when you sign out.

The site loads no analytics or advertising scripts today. We may later add cookieless, aggregated analytics (Cloudflare Web Analytics), which sets no cookie and uses no browser storage. If we do, we will update this policy.

8. How long we keep data

• Your account is kept until you delete it or ask us to. You can delete it with Delete account under Settings: we email you a link to confirm, and the link works for 1 hour. Deleting replaces your name and email address, removes your password and deletes the record of your Google or Apple sign-in. It also removes your name, email address, IP address and browser details from your orders.
• Order and payment records (the order number, plan, price, status, dates, payment references and the eSIM's details) are kept as long as accounting and tax rules require, including after you delete your account.
• IP addresses and browser details are removed from orders 180 days after the order, and IP addresses are removed from activity records 180 days after the action.
• Activity records, including the searches with no results from section 2, are deleted 365 days after the action. Deleting your account does not remove them, so an email address they hold stays until then.
• Server logs are kept for up to 7 days.
• Sessions and links. A sign-in session ends after 7 days without use. The link in a verification email works for 24 hours, and the links for password reset and account deletion work for 1 hour. The counters we use to limit repeated requests expire within an hour.

9. Your rights

Depending on where you live, laws such as the GDPR or the UK GDPR give you rights over your personal data. You can:

• ask for a copy of the data we hold about you;
• correct data that is wrong: change your name under Settings, or ask us to change your email address;
• delete your data: use Delete account under Settings, or ask us (section 8 explains what we keep);
• object to marketing and withdraw your consent: use the unsubscribe link in any marketing email or reminder, or ask us.

To use any of these rights, email privacy@e-sim.onl or use the contact form. We may ask you to confirm who you are before we act on a request. If you are not satisfied with how we handle your data, you can complain to your local data protection supervisory authority.

10. Security

• The site and our API are served over HTTPS, and browsers are told to use only HTTPS (HSTS).
• We store passwords only as salted PBKDF2-SHA256 hashes, so we cannot read them.
• A bot check, rate limits and a temporary lock after repeated failed sign-ins protect against password guessing.
• Changing or resetting your password, or deleting your account, ends every sign-in session. Other devices lose access within 15 minutes.
• Cloudflare encrypts the database, cache and file storage where we keep your data.
• Only accounts with the admin role can open our admin area.

11. Children

e-sim.onl is for people aged 18 or older, and the forms for creating an account ask you to confirm it. We do not knowingly collect data from anyone younger. If you think a child has given us data, email privacy@e-sim.onl and we will delete it.

12. Changes

If we change this policy, we post the new version on this page and update the date at the top.

13. Contact

Privacy questions and requests: privacy@e-sim.onl. Help with an account or an order: support@e-sim.onl or the contact form.