Privacy Policy
Effective date: 10 October 2026.
1. Who we are
eSimgator is operated by Revaltex Group OÜ, registration number 17112275, VAT number EE102798333, Vesivärava tn 50-312, 10152 Tallinn, Estonia. We are the controller of the personal data we use to operate our shop, administer orders and support customers. Contact info@esimgator.com about privacy, or support@esimgator.com for order and service assistance.
2. Information we use
We use the information you provide when creating an account, checking out or contacting us, including your name, email, billing address, country of residence, order details and correspondence. For business purchases, we also use the company name, registration number, VAT number where supplied and company billing address to prepare the invoice. Please do not send payment card details or identity documents by email.
Payment processing produces transaction references, payment status, refund records and limited payment method information. When Stripe processes your payment, your payment information is handled through its payment interface. Our shop is designed not to store complete card numbers or card security codes.
Our eSIM fulfilment records include the purchased package, supplier order reference, eSIM identifier, installation credentials, provisioning and activation status, and any usage or remaining-data information supplied by the connectivity provider. Installation credentials require the same care as passwords.
When you visit, technical records may include your IP address, browser and device information, time of access and security events. We use your declared residence and billing country for tax and transaction checks. We estimate your country from your IP address using a local DB-IP database. Your IP address is not sent to DB-IP for this lookup. This estimate can be inaccurate, including when you use a VPN, and you can change the suggested country. Your declared residence remains the basis for checkout checks. The destination covered by your eSIM is a separate piece of information. We use aggregate completed-order statistics grouped by the estimated IP country to select popular packages. We also record daily visitor estimates using a daily keyed hash of the IP address and browser information, without setting an analytics cookie or storing the raw IP in these statistics. Counts distinguish page views and return visits after 30 minutes of inactivity; individual statistical records are deleted after 35 days. These rankings are updated monthly and do not expose individual customer information.
Guest orders are linked to the email entered at checkout. Viewing them later requires access to that mailbox. If you choose a password, we store a secure password hash, not your password in plain text.
With your analytics consent, we store campaign labels, a referring domain and a partner code in the encrypted esg_acquisition cookie for up to 30 days. We retain the first source and the latest non-direct source. Optional advertising measurement runs only with the corresponding consent.
3. Purposes and legal grounds
| Purpose | Ground |
|---|---|
| Create and maintain your account; process, fulfil and support your order | Performance of our contract, including steps you request before purchase |
| Maintain tax records, determine the appropriate tax treatment and meet lawful requests | Compliance with legal obligations |
| Protect accounts and payments; investigate abuse and establish or defend claims | Our legitimate interests in a secure service and protecting legal rights, balanced against your interests |
| Optional analytics, advertising technologies and consent-based marketing, where offered | Your consent, requested separately from accepting the purchase terms |
Information marked as required is needed for the stated transaction or legal purpose. Without it, we may be unable to complete your purchase. Optional choices do not determine whether you can buy an eSIM.
4. Where information comes from and who receives it
We receive information from you, your browser, our payment processor and our eSIM supplier. Our website and transactional email are hosted by Zone. Stripe processes payments. RoamWiFi supplies the eSIM profile and connectivity through its network partners; the provisioning request uses an order reference and package identifier. We share information needed for these services with the providers carrying out those functions. Our accountants and professional advisers may receive records relevant to their work. Public authorities receive information when the law requires it.
Stripe processes payment information under the arrangements applicable to the transaction, including its own Privacy Policy. Network operators and connectivity suppliers may have their own responsibilities for network records and legal compliance; those activities are subject to their applicable notices. We do not assume that every provider acts solely on our instructions.
We limit disclosure to the purpose concerned. If a corporate transaction affects personal data, we will apply the applicable safeguards and notify affected customers when required.
5. International transfers
Some recipients may process data outside the European Economic Area. Where GDPR transfer rules apply, we use an applicable adequacy decision or appropriate safeguards such as European Commission standard contractual clauses, together with additional measures where necessary. Contact us for information about the safeguards applicable to your data and how to obtain a copy.
6. How long we keep information
Account information is retained while needed to provide the account and resolve its closure. Accounting source documents are normally retained for seven years from the end of the financial year in which the transaction was recorded. Any longer period required for tax records or an unresolved claim also applies. Support records are kept for the time needed to resolve the matter and handle related claims. Security logs are retained for a limited period proportionate to detecting and investigating abuse. Where a dispute or legal preservation requirement applies, relevant records may be retained until it is resolved.
You can request deletion of information that we no longer need. Sign-in challenges expire after ten minutes and are removed after two days. Closing an account does not immediately remove invoices or other records we must retain by law. Ask us for the retention period that applies to a particular record.
7. Your choices and rights
Depending on applicable law, you may request access, correction, erasure, restriction or portability of your information and object to processing based on legitimate interests. You can object to direct marketing and withdraw consent at any time; withdrawal does not change the lawfulness of earlier processing.
Send requests to info@esimgator.com. We may need proportionate verification to protect your information. Under the GDPR we normally respond within one month, and explain any permitted extension. You may complain to the Estonian Data Protection Inspectorate at aki.ee or to your competent local authority.
8. Cookies and security
See Cookie preferences for optional website technologies. We use access controls and other technical and organisational measures appropriate to the information handled. Please protect your account and eSIM credentials and notify support if you suspect unauthorised access.
9. Children and automated decisions
Our shop is intended for people who can legally enter into the purchase contract. If you believe a child has provided information without appropriate authority, contact us. Pricing is based on the package and commercial pricing rules rather than an individual willingness-to-pay profile. Payment providers may conduct automated security checks; contact support if a payment is declined and you need assistance.
10. Changes
We update this notice when our practices change, identify the effective date and provide additional notification where required. A new notice does not by itself authorise a new use of information that requires consent.
Google Analytics
With your renewed analytics consent, Google Analytics receives pseudonymous browser identifiers, public page visits and completed purchase amounts, currency and plan details. We do not send names, email addresses or eSIM activation codes. Google Analytics cookies are configured for 30 days. Advertising personalization and Google signals are disabled. You can withdraw consent through Cookie Preference.
Meta
With advertising consent, Meta receives public page visits, browser identifiers and completed purchase details to measure Facebook and Instagram ads. We do not send customer names, emails or eSIM activation codes.
You can withdraw advertising consent through Cookie Preference. Meta may process data internationally under its privacy policy.
Google Ads measurement
With analytics consent, Google receives advertising click identifiers and purchase details to measure Google ads. Advertising personalization stays off.
This measurement requires analytics consent and separate Google Ads measurement consent. You can withdraw either choice through Cookie Preference. Click identifiers (gclid, gbraid and wbraid) may be included in public page addresses sent to Google. We do not send names, emails, checkout tokens or eSIM activation codes. Existing Meta consent does not enable Google Ads measurement.
Package view statistics
With analytics consent, we measure which eSIM package cards you view and which packages you select for checkout. A random browser identifier is stored in esg-package-visitor in local storage for up to 30 days and is removed when you withdraw analytics consent. Our backend keeps a keyed hash of that identifier, the destination, data allowance, validity, package code and time. These statistics do not contain raw IP addresses, names, emails, payment details or eSIM activation codes, and are not sent to advertising providers. Statistical view records are retained for up to 366 days. Refusing analytics does not prevent browsing or buying.