This policy explains what personal data we collect when you visit our website, buy or claim an eSIM, or use My eSIMs; why we use it; who receives it; how long we keep it; and the rights you have. It is written to meet the EU and UK GDPR and US state privacy laws. It is a description of what we do, not a contract, and using our website does not mean you "accept" it.
Summary
In short
- We need your email address to deliver your eSIM and to sign you in. That is the only personal detail we ask you to type.
- We never see your card number: Stripe, PayPal, Aurexio and OxaPay collect payment details on their own pages.
- We use no analytics, advertising or tracking cookies, and we do not sell or share personal data for advertising.
- The free eSIM uses automatic checks on your email, network and device to stop repeat claims. A person reviews refusals on request.
- You can ask for a copy of your data, correct it, delete your account, or object to our use of it: privacy@blingsim.com.
1. Who is responsible
The controller responsible for your personal data is BlingSIM, trading as BlingSIM.
- Company
- BlingSIM (company), trading as BlingSIM
- Registered address
- Registered address available on request from support@blingsim.com
- Company registration
- Available on request
- VAT / tax ID
- Available on request
- Customer support
- support@blingsim.com · email only
- Privacy contact
- privacy@blingsim.com
- EU representative (GDPR Art. 27): Not yet appointed - contact privacy@blingsim.com
- UK representative (UK GDPR Art. 27): Not yet appointed - contact privacy@blingsim.com
- Privacy contact: privacy@blingsim.com. We have not appointed a formal data protection officer; this mailbox is monitored for all privacy requests.
2. What this policy covers
This policy covers:
- the website at www.blingsim.com, including destination and plan pages, checkout and the blog;
- the My eSIMs dashboard;
- the emails we send you (order confirmations, eSIM delivery, sign-in codes, support replies);
- the free eSIM promotion; and
- people who receive an eSIM that someone else bought for them (see section 15).
The mobile network operators that carry your traffic process connection and location data under telecom law as independent controllers. Their processing is not covered by this policy.
3. Data we collect and where it comes from
(a) Data you give us
- Your email address (or, for a gift, the recipient's email address).
- The one-time codes you type to sign in or to claim the free eSIM.
- The checkout confirmations you tick (device checks, express-delivery consent, terms acceptance) and the policy version you accepted.
- Anything you write to us in support emails.
(b) Order data
- Order number, plan, destination, price paid, date and time, status, payment method, and a payment reference from the provider (for example a Stripe session ID, a PayPal order or payer ID, an OxaPay track ID or an Aurexio reference).
- We never receive full card numbers. Payment providers collect card, billing and wallet details directly on their own pages. For crypto payments, your wallet address and transaction hash are handled by OxaPay and are visible on the public blockchain.
(c) eSIM data from our provisioning partner
- ICCID, activation code and QR code (these work like a key to the eSIM), eSIM status, data used and remaining, expiry date and top-up eligibility.
(d) Free eSIM promotion
- Your email address, a normalised version of it (lower-case, +tags removed, Gmail dots removed), your IP address, a random device ID stored in your browser, and the time of the claim. See section 6.
(e) Technical and security data
- IP address, browser type (user agent), requested pages and timestamps in the request logs kept by our hosting providers.
- Our application and security logs (events such as "order fulfilled" or "too many sign-in attempts", with order numbers and masked email addresses) and the logs of messages our payment and eSIM providers send us (webhook logs).
(f) What we do not do
- We use no analytics, advertising or tracking cookies, no pixels and no session recording.
- We do not sell personal data and do not share it for cross-context behavioural advertising.
- We do not profile you for marketing.
- We do not send customer data to AI services. We use an AI writing tool (via OpenRouter) only to help draft blog articles; no customer data is involved.
If any of this changes, we will update this policy first and, where the law requires it, ask for your consent.
4. Why we use it and our lawful bases
| Purpose | Data used | Lawful basis |
|---|---|---|
| Deliver and manage your eSIM and your My eSIMs account (order, provisioning, QR code, usage and status) | Email, order and eSIM data | Performance of a contract (GDPR Art. 6(1)(b)) |
| Send service emails: order confirmation, eSIM delivery, sign-in codes, changes that affect your plan | Email, order data | Performance of a contract (Art. 6(1)(b)) |
| Take payments and prevent payment fraud | Order data, payment references; card details are handled by the payment provider | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in preventing fraud |
| Enforce the free-eSIM limits and prevent abuse of the promotion | Email, normalised email, IP address, device ID, claim time | Legitimate interests (Art. 6(1)(f)): keeping a free offer affordable. The checks are narrow, explained on the Promotion Terms page, and a person reviews refusals on request |
| Customer support and complaints | Your messages, order data | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in resolving problems |
| Security and system logging, preventing attacks and abuse | IP address, user agent, request and application logs | Legitimate interests (Art. 6(1)(f)) in keeping the service secure |
| Legal, tax and accounting duties | Order and payment records | Legal obligation (Art. 6(1)(c)) |
| Handling disputes, chargebacks and legal claims | Order, delivery and support records | Legitimate interests (Art. 6(1)(f)) in establishing and defending claims |
| Marketing emails (we do not send any today) | Only with your consent (Art. 6(1)(a)) given in a separate, unticked box; you can withdraw it at any time |
Where we rely on legitimate interests, we have checked that our interest is not outweighed by your rights and that we use the least data needed. You can ask us for details of that assessment and you can object (see section 10).
5. Do you have to give us data?
Your email address is required: it is the only way we can deliver your eSIM and sign you in, so without it we cannot enter into a contract with you. Everything else we collect comes from the order itself or from your browser when you use the service. You are never required to give us marketing consent.
6. Automated checks
When you claim the free eSIM, our system automatically checks that your email address (including aliases of it) has not claimed before, that no more than 2 claims have come from your internet connection, that your device has not claimed before, and that today's daily limit has not been reached. These checks decide only whether you receive a free promotional eSIM; they have no legal or similarly significant effect on you, and they are not used for paid orders. If you think a check refused you wrongly (for example because you share a network in a hotel or coworking space), email support@blingsim.com and a person will review it. The full rules are in the Promotion Terms.
We make no other automated decisions about you.
7. Who receives your data
We share personal data only with these recipients, and only for the purposes described:
- Supabase — database hosting for orders, eSIM records, accounts and logs (processor; US company, data hosted in the cloud region chosen for our project).
- Vercel — website hosting, serverless functions and request logs (processor; US company with a global network).
- Resend — sends our transactional emails and receives the recipient address and email content (processor; US).
- eSIM Access — our eSIM provisioning partner. It receives an order or transaction reference and the plan to provision, and returns the eSIM details; the QR images in our emails load from its servers. It and the mobile network operators behind it process connection data to provide the service, and may be located outside the EEA and UK.
- Stripe — card, Apple Pay, Google Pay and Link payments. Stripe collects your payment details itself and acts as an independent controller for fraud prevention and its own legal duties.
- PayPal — PayPal payments; an independent controller for your PayPal account and the payment.
- Aurexio — a hosted card checkout that may process your payment through PayPal, Stripe or Airwallex; each collects the payment details it needs on its own pages or scripts.
- OxaPay — cryptocurrency payments; receives the order amount and reference and handles your wallet address and transaction.
- flagcdn.com — serves the country-flag images on our pages, so it receives your IP address and browser details with each image request (until we host these images ourselves).
- Professional advisers (accountants, lawyers, insurers) where needed, bound by confidentiality.
- Authorities (courts, regulators, law enforcement, tax authorities) when the law requires it or to protect our rights or someone's safety.
- A buyer or successor if our business is sold or reorganised; you will be told and this policy will continue to apply.
We do not use any other payment, analytics or advertising service.
8. International transfers
We are established in our country of establishment. Several of the recipients above are in the United States, and our eSIM provisioning partner and the network operators may be in other countries outside the European Economic Area and the United Kingdom. Where your data leaves the EEA or the UK, we rely on one of these safeguards: a European Commission or UK adequacy decision (including the EU-US Data Privacy Framework for recipients certified under it), the EU Standard Contractual Clauses (Decision 2021/914) together with the UK International Data Transfer Addendum, or, for the eSIM you have asked for, the fact that the transfer is necessary to perform your contract (GDPR Art. 49(1)(b)). You can ask for a copy of the safeguards we rely on at privacy@blingsim.com.
9. How long we keep data
| Data | How long we keep it |
|---|---|
| Orders and payment records (order number, plan, price, payment reference, consent record) | For the period required by tax and accounting law in our country of establishment (typically 6 to 10 years after the order), then deleted or anonymised |
| eSIM records (ICCID, activation code, status, usage) | For the life of the eSIM plus 24 months, so we can help with support and disputes |
| My eSIMs account (email, last sign-in) | While the account is active; deleted after 24 months without a sign-in, or when you ask (order records above are kept) |
| Sign-in sessions | Up to 14 days, or until you sign out |
| Sign-in and claim codes (OTPs) | 10 minutes, or until used; a code is cancelled after 5 wrong attempts |
| Free-eSIM claim record (email, normalised email) | For the life of the promotion plus 12 months, so the one-per-person limit can be enforced |
| Free-eSIM IP address and device ID | For the life of the promotion plus 12 months, for the network and device limits; not used for anything else |
| Application, security and webhook logs | 90 days |
| Support emails and complaint files | 2 years after the case is closed |
| Marketing consent records (if you ever opt in) | For as long as the consent lasts, plus the limitation period for claims |
When a period ends we delete the data or make it anonymous. If a dispute, chargeback or legal claim is open, we keep the records about it until it is resolved.
10. Your rights (EU, EEA and UK)
If you are in the EU, EEA or UK you have the right to:
- Access — get a copy of the personal data we hold about you and information about how we use it.
- Rectification — have inaccurate data corrected (for example a mistyped email on an order).
- Erasure — have your data deleted, except records we must keep by law (section 9).
- Restriction — ask us to pause the use of your data while a dispute about it is resolved.
- Portability — receive the data you gave us in a common machine-readable format.
- Withdraw consent — at any time, where we rely on consent (this does not affect what was done before).
Your right to object
Where we use your data on the basis of our legitimate interests (section 4), you have the right to object at any time, for reasons connected with your particular situation. We will then stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims.
If we ever use your data for direct marketing, you can object at any time and we will stop immediately, without exception.
To object, email privacy@blingsim.com.
How to exercise your rights: email privacy@blingsim.com from the address on your order or account, or write to the postal address in section 1. To protect your data we confirm your identity by sending a code to that email address. We answer within one month; for complex or numerous requests we may take up to two further months and will tell you why. Requests are free unless they are clearly unfounded or excessive.
Complaints:you can complain at any time to a data-protection supervisory authority, in particular in the EU or UK country where you live, work or where the problem happened. In the UK this is the Information Commissioner's Office (ico.org.uk); the EU authorities are listed by the European Data Protection Board at edpb.europa.eu. Our lead authority is the data-protection authority of our country of establishment. We would appreciate the chance to resolve your concern first.
11. US state privacy rights
This section applies to residents of California and of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon), to the extent those laws apply to us. Over the last 12 months we have collected the following categories of personal information:
| Category | Source | Business purpose | Disclosed to (service providers) | Retention |
|---|---|---|---|---|
| Identifiers (email address, IP address, random device ID for the free eSIM, order number) | You; your browser or device | Delivering eSIMs and sign-in codes; account access; abuse prevention; security | Hosting and database providers, email delivery provider, eSIM provisioning partner | See section 9 |
| Commercial information (plans bought, prices, dates, payment method and payment reference, refund history) | You; payment providers | Fulfilling orders; records; support; refunds and disputes | Payment providers, eSIM provisioning partner, hosting providers, professional advisers | See section 9 |
| Internet or network activity (pages requested, browser type, request logs) | Your browser | Security; keeping the site working | Hosting providers | 90 days |
| Coarse location (country or city derived from your IP address) | Your IP address | Abuse prevention; security | Hosting providers | As for the IP address, section 9 |
- We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not use personal information for targeted advertising or profiling.
- Sensitive personal information: we collect none (no government IDs, precise location, financial account numbers, health or biometric data).
- Your rights: to know and access the personal information we hold; to delete it; to correct it; to obtain a portable copy; to opt out of sale, sharing and targeted advertising (not applicable, since we do none); to limit the use of sensitive personal information (not applicable); and not to be discriminated against for exercising these rights.
- How to make a request: email privacy@blingsim.com or call email only. We verify requests by sending a code to the email address on your order or account, and we may ask for an order number. An authorised agent may submit a request for you if they provide your signed permission and we can verify your identity. We respond within 45 days (extendable by a further 45 days with notice).
- Appeals:if we refuse a request, reply to our decision within 60 days with "Appeal" in the subject line. A different person will review it and answer within 45 days. If you are still not satisfied, you may contact your state attorney general; we will include the contact details in our reply.
- Global Privacy Control: we honour GPC signals. Because we do not sell or share data, there is nothing further to opt out of.
- California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.
Notice of Financial Incentive: free 100 MB eSIM
- The offer: one free data-only eSIM with 100 MB of data, once per person, subject to the Promotion Terms.
- What we collect: your email address, a normalised copy of it, your IP address, a random device ID and the time of the claim (identifiers). We use them to deliver the eSIM and to enforce the one-per-person limit.
- Value of your data: we make a good-faith estimate that the value equals the retail price of the closest equivalent 100 MB plan on our website at the time of your claim, because that is what we would otherwise charge for the same data; we do not otherwise monetise your data.
- Opting in and out: you opt in by ticking the Promotion Terms box and claiming. You can withdraw at any time by asking us to delete your account at privacy@blingsim.com; an eSIM already delivered keeps working until it expires.
12. Cookies and browser storage
We set no cookies. We use a small number of browser storage items: blingsim_session (keeps you signed in to My eSIMs for up to 14 days), blingsim_email (remembers your email for the forms), blingsim_device (a random ID set only when you claim the free eSIM), aurexio_oid (during an Aurexio payment), admin_token (staff only) and bs_install_hint_dismissed (remembers that you closed the "Add to Home Screen" hint). A service worker caches public pages for offline use but never payment or account pages. Full details, including how to clear them, are in our Cookie & Storage Notice.
13. Security
- All traffic between you and our website, and between our website and our providers, is encrypted (HTTPS/TLS).
- Access to the database and admin panel is restricted to staff who need it, protected by two-factor sign-in, and uses server-side keys that are never sent to your browser.
- Sign-in codes expire after 10 minutes and after 5 wrong attempts; sessions expire after 14 days; requests are rate-limited.
- Payment details are handled only by PCI-DSS-compliant payment providers.
- Logs contain order numbers and masked email addresses rather than full addresses wherever possible.
No system is completely secure, so we cannot guarantee absolute security. If a breach is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you without undue delay, as the law requires.
14. Children
Our services are for adults aged 18 or over and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@blingsim.com and we will delete it.
15. Gift purchases
If you enter someone else's email address at checkout, we use it only to deliver the eSIM, the sign-in codes for My eSIMs and service messages about that eSIM. Please tell the recipient that you have bought an eSIM for them and point them to this policy. The order record stays linked to the recipient's email address.
16. Links and payment pages
Payment pages run by Stripe, PayPal, Aurexio (and the PayPal, Stripe or Airwallex scripts it loads) and OxaPay, and any other website we link to, are governed by their own privacy notices. Please read them before you enter data there.
17. Changes to this policy
When we change this policy we update the version number and effective date at the top of this page. For material changes we will email account holders in advance and, where a change needs your consent, ask for it. Previous versions are archived and available on request.
| Version | Effective | Change |
|---|---|---|
| 2026-09-23 | 23 September 2026 | Full rewrite: controller and representatives, lawful bases, named recipients, retention table, EU/UK and US rights, free-eSIM checks, accurate storage description. |
18. Contact
Privacy requests and questions: privacy@blingsim.com. Post: BlingSIM, Registered address available on request from support@blingsim.com. Phone: email only. EU representative: Not yet appointed - contact privacy@blingsim.com. UK representative: Not yet appointed - contact privacy@blingsim.com.