Privacy Policy
("Roam", "we") provides travel eSIM data plans. This page describes what personal data we collect, why, and how you can control it.
What we collect and why
- Email address, collected by Stripe during checkout — used to send your order confirmation and installation link, and to identify your order if you contact support for a refund or top-up.
- Order and payment details (plan purchased, price, payment status) — used to fulfil your order and for accounting/tax records.
- eSIM installation data (ICCID, activation code, LPA) — generated by our supplier when your eSIM is provisioned. This is encrypted at rest and only ever shown to you via your private, high-entropy install link.
- Operational logs — we log order and quote events (e.g. quote requested, checkout created, eSIM ready) server-side to run the service, debug issues, and understand product usage. We do not use third-party advertising trackers or cookies for marketing purposes.
We do not require you to create an account, and we never see or store your full card details.
Who we share it with
We use the following processors to provide the service:
- Stripe — payment processing and checkout.
- eSIM Access — our wholesale supplier, who provisions the eSIM itself.
- Supabase — database hosting for order records.
- Vercel — application hosting.
These providers may process data outside your home country (for example, in the United States or European Union), under their own data protection and security commitments. We do not sell your data to anyone.
Retention
We retain order and payment records for as long as needed to provide support (including refunds and top-ups) and to meet our accounting and tax obligations, after which they are deleted or anonymized. eSIM installation data is retained only for the life of the order.
Your rights
To request access to, correction of, or deletion of your personal data, email with your order reference and the email used at checkout. We may need to retain some records where required by law (e.g. financial/tax records) even after a deletion request.