Privacy policy

1. Who controls your data #

Simvito Limited is the data controller for personal data collected through this website, the Simvito mobile app and the Simvito service. Questions and requests go to support@simvito.com.

2. What we collect #

Account information: you sign in with Google or Apple. The provider sends us your email address, a unique account identifier and, if you allow it, your name. We use these to create your account and to keep your eSIMs in one place. We never see your Google or Apple password, and we get no access to anything else in those accounts. If you use Apple's Hide My Email, we receive the relay address Apple creates for you.

Order information: your email address, the plans you bought, the amount paid and the date. We need this to deliver the eSIM and to provide support. We also record the country your connection came from at checkout, worked out from your IP address, and for card payments the country the card was issued in. We use these to work out which country's tax rules apply to the sale and to detect fraud.

Payment information: our payment service provider handles your wallet or card details directly. We receive only a transaction reference and the result, plus, for card payments, the card token, brand and last four digits described below; we never receive your full card number, expiry date or security code. To complete the transaction we send the provider your email address, the amount and currency, the plan name, and your IP address and device type, together with when your account was created and your name (where the sign-in provider shared it) to help prevent fraud; the provider also uses these for its own fraud checks. When a payment is charged back or we confirm fraud, we report that transaction's reference and the reason to the provider.

Saved cards: after a successful card payment, our payment provider Antom stores the card and gives us a token (not the card number, and usable only by us to request payments through Antom), together with the card brand and last four digits. We link them to your account and list the card on the payment screen next time so you can pick it instead of typing the number. Antom keeps the full card number, expiry date and security code; we never receive them. You can remove a saved card at any time on your account page; once removed it is no longer used for payments.

Mobile payment diagnostics: the Antom payment component processes payment-screen interactions, app and SDK versions, device and network information, request timings, errors and payment-component crash logs. It sends these records to Antom to operate the payment flow, diagnose failures and improve payment reliability and security.

Technical information about the service: the eSIM identifier and its provisioning status and, where the network partner reports them, how much data has been used, when the plan expires and, for some plans, which country's network the eSIM used each day. Our eSIM platform partners supply this. We use it to show your remaining data, to email you when data is running low, used up or about to expire, and for support and billing accuracy.

Customer support: our self-hosted Simvito support chat on the website and in the app processes your messages and files, visited pages, IP address and browser or device information. When you sign in, we provide a verified account identifier, name, email, available profile photo and short-lived support identity proof so support can retrieve your account, linked sign-in methods, orders and eSIMs, wallet balances and history, recharges, unfinished checkouts, login devices and account request status. We also provide an account phone number when one is saved. Each support entry records a bounded device and issue snapshot, including random app-scoped installation and launch identifiers shared with crash diagnostics, app and OS versions, language and currency, display settings, and coded API, payment and recent action information. These snapshots stay attached to the related messages so support can distinguish devices and investigate later. Chat opened from an order or eSIM may include the order number, plan and last four ICCID digits, without installation codes or account login credentials. Cookies and browser storage on the website, and secure local storage in the app, keep the conversation available. Our support staff respond to your messages.

Website information: a minimal server log of requests, kept for security and troubleshooting. If you arrive through eSIMDB, we store its referral in a first-party cookie for 30 days. Signing in links this referral to your account for the same period, including purchases in the app. We use it to identify referred purchases and calculate partner commission; it does not change your price.

Website error and performance monitoring: the website reports script errors, failed requests to our own API, page load and resource timings and Core Web Vitals to Tencent Cloud's Real User Monitoring service in Singapore. A report contains the address of the current and previous page without query strings or fragments, browser, operating system and device type, screen size, network type, a random identifier stored in your browser, a session identifier and your IP address, from which Tencent Cloud derives an approximate region and network operator. When you are signed in, reports also carry the opaque user identifier described under analytics below, so we can find the problems you ran into when you contact support. Monitoring also records how long the payment form takes to appear, whether each payment attempt went through, failed or was cancelled (with the payment provider's error code and the payment method group), failed sign-ins (provider and error type), pages whose scripts did not start or that stayed blank, and the host of any script the browser blocked. Email addresses, eSIM installation codes, ICCIDs and sign-in or order credentials are removed before a report is sent, and request and response contents are not included. Monitoring keeps checkout and the website working.

Server monitoring: our servers record how each request to our API and each background task was handled, including the route, timing, status code, errors, the database queries and the calls to payment and eSIM providers involved, whether the request came from the website or the app, and the country derived from your IP address. These traces are sent to Tencent Cloud's Application Performance Monitoring service in Singapore. Request headers, IP addresses, email addresses, eSIM installation codes, ICCIDs, login or order credentials and the values in database queries are removed before sending. Server monitoring is used to keep checkout, eSIM delivery and our website running.

Mobile app notifications: Firebase Cloud Messaging and Firebase Installations process an app installation identifier and push registration token. When you enable notifications, we associate the token, device platform, app version, language, time zone and notification preferences with your account to deliver order and usage updates. These identifiers are not used by us for advertising. You can turn notifications off in the app or device settings.

The app keeps account and eSIM details locally for offline access, along with language, currency, trip and notification preferences. Receipts or installation details you export are saved or shared only when you choose to do so. If you request account deletion, we record the request reference, account identifier, date and processing status to handle and verify your request.

The website uses Google Analytics cookies and the app uses Google Analytics for Firebase. Google processes a browser or app-instance identifier, device and app information, language, app display currency, signed-in status and build mode, approximate location derived from the connection, page or screen visits and how you arrived (the referring site's domain and any campaign tags on the link), plan views, checkout events, successful sign-ins, search lengths and result counts, sharing, support and installation actions, and confirmed purchase and refund references, amounts and currencies. The checkout identifier is passed to our server so payment and refund events can be associated with the originating visit without being counted again when an order is opened on another device. When you are signed in, we also send Google an opaque user identifier derived from your internal account ID, so website, app and confirmed-purchase statistics can be recognised as the same person; it is not your name, email or sign-in credential, and it is cleared when you sign out. The app also sends three device traits as statistics properties: how it was installed, whether notifications are allowed, and whether the device supports eSIM. Our analytics events exclude your name, email, account login credentials, payment credentials, ICCID and eSIM installation codes. We do not enable advertising identifiers or advertising personalization for this integration.

Mobile app crash reports: the app automatically reports crashes, app freezes and unexpected errors with Firebase Crashlytics. Google processes information including Crashlytics and Firebase installation identifiers, the time of the error, the app and operating system versions, the device model, memory and storage capacity, whether the device is rooted or jailbroken, whether the app was in the background, screen orientation, and the error type, description and program stack trace. Reports also record language and currency preferences, sign-in and account-restoration states, the current screen, app build and runtime environment, device compatibility details, display and accessibility settings, time-zone offset, app lifecycle and memory-pressure events. For troubleshooting, reports include a short coded trail of navigation and supported actions; normalized API routes, methods, statuses, timings, payload sizes and error codes; and payment stages, methods, currencies, amounts, quantities, internal product and checkout or recharge references, and payment SDK event codes and timings. This diagnostic trail works independently of usage analytics. We do not attach API request or response bodies, request headers, raw SDK messages or the device name you chose. For native crashes on Android, Google briefly processes a memory snapshot of the crashed app to extract the stack trace, then discards it. Error reports from the app's own code do not include screen contents, and we remove email addresses, ICCIDs, eSIM installation codes, access tokens and web address parameters from their descriptions. Reports also carry random app-scoped installation and launch identifiers shared with support diagnostics, so we can correlate a support request with an error on the same device and run. When you are signed in, we add your internal Simvito customer ID to crash reports to identify the affected account and investigate the issue. Signing out clears the current identifier and switching accounts updates it; reports already recorded remain subject to the retention period below. We do not add your name or email to crash reports, and we do not use them for advertising. When app analytics is on, a crash report can also include the most recent analytics events described above, such as screen views.

First-party app device records: the app sends bounded device and diagnostic snapshots to our own backend, independently of opening support or Firebase crash collection. We store a random app-scoped installation identifier and a new identifier for each app launch; app, hardware and OS build versions; app installation source, times and signing-certificate fingerprint; the Google Play install referrer (campaign parameters and click and install times, only when installed from Google Play); whether notifications are allowed; the app's Google Analytics instance identifier; the IP address of each report; available memory and storage; network state and connection type; eSIM capability; language, currency, display and lifecycle settings; coded API and payment states and recent supported actions. Visitors are recorded separately. After sign-in, the server links reports to your verified internal account and login session; account names, email addresses and phone numbers remain in our account records. Reporting retries when connectivity returns and updates activity while the app is in the foreground. It does not include authentication tokens, request or response bodies, payment credentials or eSIM installation codes. Launch records are removed after 180 days without activity, and inactive device records without remaining launches after 365 days. Deleting an account also removes its linked device records and associated visitor observations; another account's records remain separate.

Mobile app performance: Firebase Performance Monitoring measures app startup, foreground and background activity, network latency and payment-component startup. Google processes installation and session identifiers, device and network information, IP-derived country, normalized request URLs, response codes, payload sizes and durations. We add the app language, current screen, signed-in status, display currency and lifecycle state to group measurements. We do not attach your Simvito customer ID, names, email, request headers or request and response contents to these measurements.

Fraud prevention in the mobile app: the app uses Firebase App Check, Apple App Attest and DeviceCheck, and Google Play Integrity to confirm that requests come from the genuine Simvito app on a real device. When you buy or top up in the app, Apple or Google also let us read and set a few markers stored for your device, which remain after the app is reinstalled. If a payment on an account is charged back as fraudulent, or a device has been marked, we mark the account and the device and decline further purchases. We keep a record of the account, a pseudonymised form of its email address and the dispute reference. If you think this is a mistake, contact us and we will review it.

Fraud-prevention records at checkout: when you start a payment on the website or in the app, we store the following with that order or top-up to detect stolen cards, card testing and multi-account abuse: a random identifier this website keeps in your browser (in the app, the installation identifier described above), neither of which is tied to hardware or advertising identifiers and both of which change if you clear site data or reinstall the app; your device's time zone; and the number of the network operator your connection belongs to, provided by Cloudflare from your IP address. After a successful card payment we also receive from our payment provider the card type (debit, credit or prepaid), a token the provider generates for the same card (not the card number) and the 3-D Secure result. We also keep a short-term count of failed payments per account and IP address. After an eSIM is installed, we also receive from our eSIM platform partners the eSIM chip number (EID) of the device it was installed on, the installation and activation times, and the countries where data was used; if you sign in with Apple, we keep Apple's indication, given at first authorization, of whether the account appears to belong to a real person. We use this information only to prevent fraud and to respond to chargebacks; our staff review it, and it does not on its own automatically refuse your purchase. These records are kept with the order for the periods above; failed-payment counts are kept for at most 24 hours.

3. Why we use it, and on what basis #

To perform the contract with you: delivering the eSIM, providing support, processing refunds.

To meet legal obligations: keeping accounting and tax records, and responding to lawful requests from authorities.

For our legitimate interests: preventing fraud and abuse, keeping the service secure, and improving how it works. We do not use your data for behavioural advertising and we do not sell it.

We use Google Analytics to understand and improve browsing and purchasing.

4. Who we share it with #

eSIM platform and mobile network partners, who need the technical identifiers to provision and run the connection in the destination country.

Antom and the payment providers for your selected method, which process the transaction, fraud checks and the payment-component diagnostic information described above.

Google and Apple, when you sign in with them. They process the sign-in under their own privacy policies; we only receive the details listed in section 2.

Service providers that host this website and send our transactional email, acting on our instructions.

eSIMDB, for purchases attributed to its referral: a purchase reference, referral reference, plan, quantity, amount, currency, purchase date, refund status and commission. This report does not contain your name, email, payment credentials or eSIM installation details.

Our support service is hosted on our own server, and support staff can review conversations and the relevant order or plan details to assist you.

Tencent Cloud, which provides our website and server error and performance monitoring from Singapore and processes the monitoring data described above on our behalf.

Google Firebase and Apple push notification services, to deliver the mobile notifications you enable. Firebase processes installation identifiers and notification routing data; relevant identifiers may be processed outside the country where you use the app.

Authorities, where we are legally required to disclose. We do not otherwise disclose personal data to third parties, and we never sell it.

Google, for website and app analytics while analytics is enabled. Google may process these statistics outside your country under its applicable privacy terms and our configured Analytics settings.

Google Firebase Crashlytics and Performance Monitoring, which process the app diagnostics described above on our behalf. Google may process these records outside the country where you use the app.

Apple and Google, which run the device integrity checks described above and store the device markers we set.

5. International transfers #

Our servers and database are located in Singapore, and encrypted backups are held in Cloudflare's object storage. Delivering roaming connectivity also involves transferring technical identifiers to network partners in the destination country, which may be outside Hong Kong.

Where we transfer personal data internationally we use providers that offer an adequate standard of protection and put contractual safeguards in place.

6. How long we keep it #

Order and transaction records: seven years, to meet accounting and tax requirements in Hong Kong.

Support correspondence: two years after the matter is closed.

Server logs: 15 days. Technical eSIM records are deleted once the plan has expired and the retention period for billing disputes has passed.

Account profile, linked login identities and notification registrations: for as long as your account exists. Request deletion in the app under Account → Account and sign-in → More → Delete account, or on simvito.com/delete-account/. We process requests within 30 days, first reviewing any remaining balance, active plans and unresolved payments with you. Deletion does not automatically refund purchases or forfeit balances. Before deletion starts you can withdraw the request. Only records that we must retain under the periods above remain; they are not used to restore your deleted account.

After deletion, sign out on each device to clear the account cache, and separately remove files you exported. Installed eSIM profiles are managed in device settings. Notification registrations and installation sharing links held by Simvito are removed when the account is deleted; Firebase installation data follows Google Firebase retention rules. Contact us to request deletion of associated support or processor data where it is not subject to a continuing legal retention requirement.

Analytics cookies set by this website expire after up to 180 days. Analytics event retention is controlled by the settings of our Google Analytics property.

Website monitoring data is kept by Tencent Cloud for 30 days for errors and page views, and for 15 days for page performance, API and resource timings. Server traces are kept for 7 days.

Firebase Crashlytics keeps app crash reports and their installation identifiers for 90 days, after which Google starts deleting them. Performance Monitoring retains IP-associated events for 30 days and installation-associated and de-identified performance data for 60 days before Google starts deleting them.

Fraud-prevention marks on accounts are kept for three years after the last related event, including after account deletion. Apple keeps device markers until we change them; Google keeps them for three years after they were last read or changed.

7. Your rights #

You may ask for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it where we have no continuing legal reason to keep it, and object to processing based on legitimate interests.

You may also ask us to restrict processing while a dispute about accuracy or lawfulness is being resolved, and to receive the data you gave us in a commonly used, machine-readable form so that you can pass it to someone else.

Write to support@simvito.com. We respond within 30 days. If you are in Hong Kong and are not satisfied, you may complain to the Office of the Privacy Commissioner for Personal Data. If you are in the EU or UK, you may complain to your local supervisory authority.

8. Security #

This site is served over HTTPS. Access to order data is restricted to the people who need it to provide the service, and payment credentials never reach our systems.

No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we will notify you and the relevant authority without undue delay.

9. Children #

The service is not directed at children under 18. We do not knowingly collect their personal data, and will delete it if we discover we have.

10. Changes #

If we change this policy we will update the date at the top of this page. Material changes affecting how we use data already collected will be notified by email where we hold an address for you.