Privacy policy

1. Who controls your data #

Simvito Limited is the data controller for personal data collected through this website, the Simvito mobile app and the Simvito service. Questions and requests go to support@simvito.com.

2. What we collect #

Account details: when you sign in with Google or Apple, they give us your email address, an account identifier and, if you allow it, your name. We never see your password. If you use Apple's Hide My Email, we receive the forwarding address Apple creates.

Order and payment details: the plans you buy, the amount, currency, time and payment result. Payments are handled by licensed payment providers; we never receive your full card number, expiry date or security code. If you choose to save a card, we keep only the token the provider gives us, the card network and the last four digits, and you can remove it from your account at any time. If you pay with PayPal, PayPal gives us the payer's email address, PayPal account ID, country and whether the account is verified; we use these only to prevent fraud and handle disputes.

eSIM usage: the eSIM identifier, its activation status, data used, expiry and the country it is used in, so we can show your usage, send usage and expiry reminders, provide support and reconcile accounts.

Signed-in devices: the device model or browser, operating system and app version, country and last active time of each sign-in, so you can review them under Devices in your account and sign them out. On Android this includes a one-way hash of the Simvito app's identifier on your phone, used only to recognise the same phone.

Customer support: the messages and files you send us, and the account, order and device details that help us look into the problem.

Technical data: IP address, browser and device information, pages visited and where you came from, errors, crashes and performance records, and the tokens needed for push notifications. Analytics and diagnostics never include your name, email, payment credentials or eSIM installation codes.

Analytics and cookies: we use Google Analytics and Google Firebase for usage statistics, crash reports, performance monitoring and push notifications, and use cookies and local storage to keep you signed in and remember your preferences. We also record where you came from ourselves (the referring site's domain, campaign tags on the link and the page you landed on), for 30 days and with your orders, to count which channels bring orders; it does not change your price. When you go from our website to the App Store to download the app, we briefly keep your network address (hashed) and basic device information (system version, language, time zone and screen size) so the app can open the same page and record the referral the first time it opens, and delete them within 24 hours; in the European Economic Area, the UK and Switzerland we only do this if you allow analytics.

Partner referrals: when a creator or a comparison site sends you to us with a link, or you type a partner's code at checkout, we set a cookie named simvito_partner_ref on simvito.com for 30 days. Our server signs its value, which holds the partner's code, the time, a record number and a random identifier for your browser; it does not contain your name, email or IP address. A second cookie, simvito_partner_pending, lasts one hour and is only used to try again if recording the referral did not finish. We use them only to work out which partner an order came from and to settle the commission we owe that partner under our contract with them. They are not used for profiling, advertising or tracking you on other sites, and are not combined with analytics or advertising data. A partner's code takes up to 5% off; otherwise a referral does not change your price.

Fraud prevention: when you sign in and at checkout, the country of your IP address, the card's issuing country, your device time zone and a random device identifier, on the website a one-way hash of your browser's characteristics (such as screen, graphics and language settings), the network you connect from, the card type and verification result, and information about the device the eSIM is installed on. The app also uses device integrity checks provided by Apple and Google. This is used only to prevent card fraud and handle chargebacks, is reviewed by our staff, and never on its own blocks your purchase automatically. The outcomes of these checks and of order handling (for example that an order was held for review, the card brand and issuing country, or the kind of email provider you use) are also recorded in our analytics, without your email address, card number, device identifiers or the browser hash.

3. Why we use it, and on what basis #

To perform the contract with you: delivering the eSIM, providing support, processing refunds.

To meet legal obligations: keeping accounting and tax records, and responding to lawful requests from authorities.

For our legitimate interests: preventing fraud and abuse, keeping the service secure, and measuring and improving how it works, including which of our ads lead to purchases. We do not sell your data or use it for behavioural advertising.

To perform our contracts with partners: the partner referral cookies and records described above, which we need in order to pay the partner who sent you. In the European Economic Area, the UK and Switzerland they are therefore not covered by the cookie consent choice, and they are never used for anything else.

4. Who we share it with #

Payment providers, to process payments, store cards you choose to save, and run fraud checks.

Google and Apple, for sign-in, push notifications, app analytics, crash reports and device integrity checks. When you come to us from one of our Google ads, Google also receives the ad click identifier and whether you went on to buy, so we can measure the ad. For visitors in the European Economic Area, the UK and Switzerland we only do this, and the analytics above, if you allow it. You can change your choice at any time under Cookie settings at the bottom of the website, or in Account in the app. On iPhone, once you allow ad measurement, the app also hashes your sign-in email on your phone so Google can match ad conversions there; neither the email nor the hash leaves your phone in a form that identifies you. If you installed the iPhone app from an Apple ad, the app asks Apple which campaign, ad group and keyword it was; on Android we read the Google ad click identifier from the Play install. With ad measurement allowed, we record these numbers on your orders.

Service providers we rely on to run the service, who act on our instructions.

Referral partners: for orders they referred, the order number (creators see only its last three digits), plan, amount, currency, time, commission and refund status, never your name, email or payment details. Creators also see, for each visit and order that came through their link, the country, device type, browser, operating system and referring website, without anything that identifies you.

Authorities, where the law requires it. Otherwise we do not disclose personal data to third parties.

5. International transfers #

Our servers are in Singapore, and some data may be processed outside your country or region.

When data is transferred across borders, we choose providers that offer an adequate level of protection and put contractual safeguards in place.

6. How long we keep it #

Orders and transactions: seven years, to meet Hong Kong accounting and tax requirements. Support conversations: two years after the matter is closed.

Server logs, monitoring, crash and performance data: generally no longer than 90 days. Analytics cookies: up to 180 days. Signed-in device records are deleted a week after the sign-in expires. eSIM technical records are deleted once the plan has expired and the period for billing disputes has passed. App device diagnostics are deleted after the device has been inactive for a year. Partner referral records and the result of working out which partner an order came from: 13 months, under a random identifier rather than your name or email.

Fraud flags: three years after the last related event, including after the account is deleted.

Account details: for as long as your account exists. Request deletion in the app under Account → Account and sign-in → More → Delete account, or on simvito.com/delete-account/. We process requests within 30 days, first checking any remaining balance, active plans and unfinished payments with you. Deletion is not a refund and does not forfeit your balance, and you can withdraw the request before it starts. After deletion we keep only the records we are legally required to keep for the periods above.

7. Your rights #

You may ask for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it where we have no continuing legal reason to keep it, and object to processing based on legitimate interests.

You may also ask us to restrict processing while a dispute about accuracy or lawfulness is being resolved, and to receive the data you gave us in a commonly used, machine-readable form so that you can pass it to someone else.

Write to support@simvito.com. We respond within 30 days. If you are in Hong Kong and are not satisfied, you may complain to the Office of the Privacy Commissioner for Personal Data. If you are in the EU or UK, you may complain to your local supervisory authority.

8. Security #

This site is served over HTTPS, and access to order data is restricted to the people who need it to provide the service.

If a breach affects your personal data and creates a real risk to you, we will notify you and the relevant authority without undue delay.

9. Children #

The service is not directed at children under 18. We do not knowingly collect their personal data, and will delete it if we discover we have.

10. Changes #

If we change this policy we will update the date at the top of this page. Material changes affecting how we use data already collected will be notified by email where we hold an address for you.