DRAFT — not legal advice. This document is placeholder structure written by the engineering team so the page exists and is linkable. Final wording must be supplied and approved by Ealo's legal counsel before launch.

Privacy Policy

Last updated: DRAFT

1. Who controls your data

Ealo is the data controller for the personal data described here. The registered entity, address and (where required) data protection representative are to be confirmed by legal before launch.

2. What we collect

• Account details — your email address, and a password stored only as a hash.
• Order details — what you bought, when, the amount and currency, and the destination the plan covers.
• eSIM details — the identifiers of the eSIM issued to you and its data usage, which we retrieve from our supplier to show you your remaining allowance.
• Technical data — request logs needed to operate and secure the service.

We do not collect payment card numbers. Card data goes directly to our payment processor.

3. Why we use it

To sell and deliver your eSIM, to show you your orders and remaining data, to provide support, to detect and prevent fraud and abuse, and to meet our tax and accounting obligations. Where we rely on consent, you may withdraw it at any time.

4. Who we share it with

Our eSIM supplier (to issue and manage your plan), our payment processor (to take payment), our email provider (to deliver your eSIM and service messages), and our hosting provider. We do not sell your personal data.

5. Cookies

We use a strictly necessary cookie to keep you signed in, plus cookies that remember your chosen language and currency. We do not use advertising or analytics cookies, which is why you are not asked to accept a cookie banner. If that changes, we will ask for consent first.

6. How long we keep it

Account and order records are kept for as long as your account exists, and after that for the period required by tax and accounting law. Technical logs are kept for a short operational retention window.

7. Your rights

You can ask us for a copy of your data, to correct it, or to delete it. Deleting your account removes your personal details; records we are legally required to retain (such as invoices) are kept for the remaining statutory period and then deleted. Requests go to our support address. You also have the right to complain to your local data protection authority.

8. International transfers

Your data may be processed outside your country by the providers listed above, under the safeguards required by applicable law.

9. Contact

Questions about this policy go to our support address, shown at checkout and in the footer.