Legal
Privacy Policy
Last updated: 14 September 2026
This policy explains how Simtasy OÜ ("Simtasy", "we") processes personal data when you visit simtasy.com, use the Simtasy dashboard and API, or interact with a storefront hosted on our platform. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
1. Controller and contact
Controller: Simtasy OÜ, Tallinn, Estonia. Data protection contact: privacy@simtasy.com. We have not appointed a data protection officer because we are not legally required to.
2. Our role: controller or processor
Website visitors and reseller accounts — we are the controller for data about visitors of simtasy.com and about the people who use a reseller account (dashboard, API, billing).
End customers of resellers — when you buy an eSIM in a shop operated by one of our resellers (for example on a *.simtasy.com subdomain or a reseller's own domain) or through a reseller's app, the reseller is the controller of your data. We process your data on the reseller's behalf as a processor (Art. 28 GDPR) to deliver the eSIM you bought. Please refer to the privacy policy of the shop you bought from; you can still exercise your rights towards us and we will forward your request.
3. What we process, why, and on which legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, e-mail, password hash, organisation, role, sign-in times | Providing your account, authentication, security, notifications | Art. 6(1)(b) GDPR — contract |
| Company and billing data: legal name, address, VAT ID, billing e-mail, plan, invoices | Invoicing, tax compliance, subscription management | Art. 6(1)(b) and (c) GDPR — contract and legal obligations (accounting, VAT) |
| Payment data: Stripe customer and payment references (we never see full card numbers) | Collecting subscription fees, wallet top-ups, storefront payouts via Stripe Connect | Art. 6(1)(b) GDPR — contract |
| Usage and order data: orders, eSIM identifiers (ICCID, activation code), wallet ledger, API requests, webhook deliveries, audit log | Executing orders, provisioning eSIMs, fraud prevention, troubleshooting, proof of transactions | Art. 6(1)(b) and (f) GDPR — contract; legitimate interest in security and record-keeping |
| End-customer data (on behalf of resellers): e-mail, optional name, order, eSIM data, usage | Delivering the eSIM, customer eSIM page, installation e-mails, usage display | Processed for the reseller under Art. 28 GDPR; the reseller relies on Art. 6(1)(b) |
| Technical data: IP address, browser, device, referrer, request logs | Delivering the website securely (CDN, DDoS protection), error analysis | Art. 6(1)(f) GDPR — legitimate interest in a secure, functioning service |
| Communication: support requests, e-mails | Answering your questions, improving the service | Art. 6(1)(b) and (f) GDPR |
| Consent preferences: your cookie choices | Remembering your decision | Art. 6(1)(c) GDPR — proof of consent; Art. 6(1)(f) |
5. Recipients and sub-processors
We share personal data only with providers that help us run the service, bound by data-processing agreements:
| Provider | Purpose | Location / transfer safeguard |
|---|---|---|
| Supabase Inc. (project hosted on AWS eu-central-1) | Database, authentication, file storage | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | Hosting/edge computing, CDN, DNS, TLS, DDoS protection | Global network; EU-US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe Ltd. / Stripe, Inc. | Payments, subscriptions, invoices, Connect payouts | Ireland (EU); transfers to the US under the Data Privacy Framework |
| Resend, Inc. | Sending transactional e-mails (eSIM delivery, alerts) | United States; Standard Contractual Clauses |
| eSIM Access (eSIM supplier) | Provisioning eSIM profiles; receives order reference and, if provided, the end-customer e-mail | Outside the EU; Standard Contractual Clauses |
We may also disclose data where required by law or to enforce our rights. We do not sell personal data.
6. International transfers
Where data is transferred outside the EU/EEA, we rely on an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework for certified US companies) or on the European Commission's Standard Contractual Clauses together with supplementary measures where necessary. Copies are available on request.
7. Retention
- Account and organisation data: for the duration of the contract and up to 30 days after closure for export, then deleted.
- Invoices, orders, wallet ledger and related records: 7 years after the end of the financial year (Estonian Accounting Act and VAT Act).
- eSIM and order data processed for resellers: for as long as the reseller's account exists or as instructed by the reseller, plus statutory retention.
- Server and API request logs: up to 90 days; audit logs: 3 years.
- Cookie consent: 12 months, then we ask again.
8. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Where processing relies on consent you may withdraw it at any time with effect for the future. To exercise your rights, e-mail privacy@simtasy.com.
You also have the right to lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee) or the authority of your habitual residence.
9. Security
We protect data with TLS encryption in transit, encryption at rest, row-level access control in our database, hashed API keys, signed webhooks, least-privilege access for staff and an audit trail of administrative actions. No system is perfectly secure; we will notify you and, where required, the supervisory authority of personal data breaches in accordance with Art. 33 and 34 GDPR.
10. Processing on behalf of resellers (data processing terms)
For resellers, the following terms apply to end-customer data we process on your behalf and form part of our Terms of Service: (a) we process such data only on your documented instructions as embodied in the platform functions you use; (b) our personnel are bound by confidentiality; (c) we implement the security measures described above; (d) we engage only the sub-processors listed in this policy and inform you of changes in advance, giving you the right to object; (e) we assist you in responding to data-subject requests and in meeting your obligations under Art. 32–36 GDPR; (f) we delete or return end-customer data at the end of the contract, subject to statutory retention; (g) we make information available to demonstrate compliance and allow audits under reasonable conditions.
You are responsible for having a legal basis for the data you collect, for informing your end customers (your own privacy policy on your storefront) and for the lawful content of communications you send.
11. Automated decisions, minors and changes
We do not make automated decisions with legal effect on you. Our services are for businesses; we do not knowingly collect data from persons under 18.
We update this policy when our processing or the law changes. The current version is always available at simtasy.com/privacy; significant changes are announced in the dashboard or by e-mail.