Privacy Policy

What you give us directly • Name and email address, to create your account and send your eSIM QR code. • Billing country and address where the payment requires it. • Payment details, handled entirely by Stripe. We never see or store your full card number. • Support messages, including anything you send us by email or on WhatsApp, so we can help and keep a record of what was agreed. What we collect automatically • Device and browser type, so we can spot when something breaks on a particular device. • IP address and approximate location, used for fraud checks and to show the right currency. • Usage data, such as pages visited and session length. • eSIM technical data from the network: the ICCID, connection status, and how much data has been used, so we can show your remaining balance and help when a plan misbehaves.

Under the GDPR and similar laws we have to tell you not just what we do, but the legal basis for each purpose. Here it is. • Providing the service (creating your account, provisioning the eSIM, sending the QR code, showing usage, handling refunds and wallet balance). Basis: performance of our contract with you. • Customer support, including WhatsApp and email conversations. Basis: performance of our contract, and our legitimate interest in running a support service that works. • Fraud prevention and security, including card testing checks and sanctions screening. Basis: our legitimate interest in protecting the business and other customers, and legal obligation where sanctions law applies. • Accounting, tax and invoicing. Basis: legal obligation. • Analytics and improving the site. Basis: your consent, given through the cookie banner. Refusing costs you nothing. • Marketing emails, if you ask for them. Basis: your consent, withdrawable at any time from the unsubscribe link in every message. Transactional emails such as your order confirmation and QR code are part of the service, not marketing, so they are sent on the contract basis and cannot be unsubscribed from while you have an active plan. We do not sell your personal data, we do not rent it, and we do not use it to target you with advertising on other platforms.

We share only what each company needs to do its job. These are all of them. • Stripe (Ireland and USA) — payment processing and fraud checks. Receives your payment details and email. • eSIMAccess (Hong Kong) — eSIM provisioning. Receives technical identifiers only, such as the ICCID and package code. Not your name, email or address. • Citrus Mobile — eSIM provisioning for a small number of destinations. Technical identifiers only, on the same basis. • SendPulse — sends your transactional emails, so it receives your email address and the content of that message. • Google Analytics and Google Tag Manager — website analytics, only after you accept analytics cookies. • StatCounter — website visitor statistics, only after you accept analytics cookies. • WhatsApp Business (Meta) and Telegram — if you contact us on WhatsApp, your message and phone number are processed there so our team can answer you. We use Telegram internally to route those conversations to a human. If you would rather not use WhatsApp, email support@megaesim.com instead and nothing goes through Meta. • Our hosting provider — stores the website and database. We also disclose data where the law requires it, for example a valid legal request, a tax audit, or a sanctions obligation. We will tell you when that happens unless we are legally prevented from doing so.

MegaEsim is operated from the United Arab Emirates, and some of the companies above are in the United States, Hong Kong and the European Union. That means your data may be transferred outside your own country. The UAE does not have an adequacy decision from the European Commission. So where we transfer personal data of people in the EU, EEA or UK out of those areas, we rely on the Standard Contractual Clauses approved by the European Commission, together with the UK Addendum where UK data is involved, and we assess whether the destination offers appropriate protection in practice. You can ask us for details of the safeguards that apply to your data at support@megaesim.com.

We do not keep things forever. These are the actual periods. • Order and invoice records — 7 years from the transaction, because tax and accounting law requires it. • Account details (name, email, login) — for as long as your account is open, then deleted within 30 days of you closing it, apart from the order records above. • eSIM technical records (ICCID, usage, status) — 24 months after the plan expires, so we can answer questions and handle refund disputes. • Support conversations, including WhatsApp — 24 months from the last message. • Website analytics — 14 months, then deleted automatically. • Marketing consent records — until you withdraw consent, plus 2 years so we can show when and how consent was given. • Fraud and sanctions screening logs — 5 years, because we may need to show we carried out the check.

Wherever you live, you can ask us to: • Give you a copy of the personal data we hold about you. • Correct anything that is wrong. • Delete your data, subject to records we must keep by law. • Restrict or object to how we use it, including any use based on legitimate interests. • Port your data to another provider in a machine readable format. • Withdraw consent at any time, for marketing or analytics, without affecting what we did before you withdrew it. Email support@megaesim.com and we will respond within 30 days. We do not charge for this and we will not make it difficult. If you are in the EU, EEA or UK you also have the right to complain to your national data protection authority. If you are in the UK that is the Information Commissioner's Office. You are welcome to come to us first, but you do not have to.

You can delete your account and the personal data attached to it at any time. There are three ways, and all of them work: • In the mobile app: Profile, then Delete Account. • On the website: your account settings. • By email: write to support@megaesim.com and we will do it for you. Deletion removes your name, email, login, saved preferences and support history. We keep order and invoice records for the 7 years that tax law requires, and those records are not used for anything else. Any unused wallet credit is dealt with as described in our Terms before the account closes, so please use it or ask us about it first.

The iOS and Android apps ask for these permissions, and you can change your mind at any time in your device settings: • Camera — only to scan an eSIM QR code during setup. We never open the camera at any other time and we never store photos or video. • Push notifications — order confirmations, eSIM delivery, and reminders such as low data or an expiring plan. Turn them off in device settings whenever you like. The app does not track you across other apps or websites, does not use advertising identifiers, and does not sell data to anyone. Account deletion is available inside the app itself, as described above.

We use a small number of cookies. Essential ones keep you logged in and protect the checkout, and they cannot be switched off because the site will not work without them. Analytics cookies are only set after you accept them in the cookie banner, and you can change your choice at any time using Cookie Settings in the footer. We honour the Global Privacy Control signal. If your browser sends GPC, we treat it as an opt out of analytics and of any sharing of personal information, automatically and without you having to do anything else. We do not run advertising or behavioural tracking cookies on this website. Our full Cookie Policy lists every cookie we set, what it does and how long it lasts.

The site runs over HTTPS everywhere. Passwords are stored hashed, never in readable form. Card details never touch our servers, because Stripe handles them directly. Access to customer data inside the company is limited to the people who need it to do their job. No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach happens that puts your rights at risk, we will report it to the relevant supervisory authority within 72 hours of becoming aware of it, and we will tell you directly and without delay where the risk to you is high.

MegaEsim is not for children. You must be at least 18 to hold an account, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to support@megaesim.com and we will delete it.

We update this policy when what we do changes. The date at the top always shows the current version. If a change materially affects how we use your data, we email registered customers rather than quietly editing the page.