Who is responsible for your data
Qorinx OÜ, trading as SimFuse, is the controller for the processing described here. We are registered in Estonia under registry code 17422930, at Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia. Our VAT number is EE103030207. Contact info@simfuse.app for privacy questions or requests.
Payment providers, sign-in providers, messaging platforms and mobile network operators can also process data under their own legal responsibilities. Where they act as independent controllers, their privacy notices explain that processing. Our terms cover purchases and use of the service.
Account, sign-in and information from others
We process your email, account identifiers, sign-in records, access and refresh tokens, preferences and information you choose to add. Supported Apple, Google or other sign-in providers supply the identifiers and permitted account details needed to authenticate you, such as email, name or an email-relay address. We do not receive your provider’s password.
We receive service status from connectivity providers, payment and fraud results from payment providers, and referral information from links or partners. If somebody buys a plan for you, we process the contact and delivery information they provide. Information is also collected automatically as explained below.
Account and purchase information is needed to perform our contract; security and sign-in monitoring also serve our legitimate interest in protecting accounts. Without the required information, we cannot authenticate you or deliver the requested service.
Orders, payments and tax records
We process purchased plans, order status, amounts, currency, discounts, invoices, refunds and balance transactions. Billing information can include your name, address, residence or tax country and, for business purchases, company and VAT details. We use payment and location evidence to calculate tax and meet accounting obligations.
Stripe processes card payments, supported wallets, saved payment methods, verification and refunds. We receive payment identifiers, tokens, status and limited card and fraud metadata, including information used to recognise repeated payment methods. We do not store your full card number or security code. Stripe also processes device information for fraud prevention and its other business services.
If you choose an offered cryptocurrency payment method, we process the asset, network, amount, deposit address, payment reference and transaction status. The payment provider processes blockchain transactions; a wallet address or transaction history can be public and cannot generally be erased from a blockchain. Manual refunds can require a return address.
Payment processing and order fulfilment rely on our contract. Tax and accounting records rely on legal obligations. Fraud and dispute investigations also rely on our legitimate interests in preventing abuse and defending claims.
eSIMs, connectivity and optional features
We process technical eSIM identifiers such as ICCID, installation and activation information, supported networks, validity, consumption and service status. Connectivity partners supply this information so we can deliver plans, show remaining data, manage top-ups and investigate problems or refund eligibility. Those partners and network operators process the technical data necessary to connect your device, subject to their roles and applicable telecommunications law.
Where you use an optional feature, we process the information needed for it. This can include VPN access identifiers, chosen server, connection reservations, device identifiers and expiry, or diagnostics and connection-quality measurements you submit. We do not promise that a VPN or mobile network is anonymous or that all providers keep no logs.
We use this information to perform the requested service and, for troubleshooting, security and service improvement, on the basis of our legitimate interests. Optional device permissions are explained when requested.
Free eSIM claims and device location
A free-eSIM offer can require your device location to confirm that you have arrived in the destination. With the device permission you grant, we receive the country and coordinates for the claim. This is separate from the approximate country inferred from an IP address. The claim does not require background location tracking.
We record the claim, location evidence, account and email identifiers, device fingerprint, payment-method fingerprint and verification reference to enforce eligibility, prevent duplicate claims and investigate disputed decisions. Location evidence can remain with the claim; reading it once does not mean it is never stored.
We use location to check the destination condition of the offer you request and rely on our legitimate interests for proportionate abuse prevention and dispute handling. You can refuse device location access or change permission in device settings; the free claim then cannot be verified. This does not require you to permit location access for an unrelated paid plan. Contact support to challenge an eligibility error.
Support, messaging channels and AI
When you contact us, we process your messages, attachments, contact details, conversation history and relevant order, account and eSIM context. Our support platform can receive the page you are viewing, language and currency to understand your request. Messages through email, WhatsApp, Messenger, Telegram or other offered channels also pass through the relevant platform under its own privacy terms.
Support can use an AI assistant. Conversation text and relevant context are processed by the support system, AI model services and associated service providers to generate replies, call authorised support tools and review service quality. Human staff can review conversations. You can ask to speak to a person; please avoid sending passwords, payment secrets or unrelated sensitive information.
Support needed to fulfil an order relies on our contract. Security, quality review and handling disputes also rely on our legitimate interests. We do not treat your use of a chat as permission for unrelated marketing. A human-review request does not automatically erase messages already processed.
Technical information and notifications
Our website, apps and infrastructure process IP address, approximate country, browser and device type, operating system, timestamps, request and error logs, and diagnostic information. Push notifications require a device token and your device permission. Apple, Google and email delivery providers process the data needed to deliver messages.
We use technical data to operate and secure the service, investigate faults and fraud, and improve reliability, relying on our contract or legitimate interests as appropriate. Order confirmations, security notices and messages needed to manage an active service are separate from promotional messages. You can manage push permission in your device settings.
Automated checks and your choices
We use automated checks to detect duplicate free claims, assess payment risk and evaluate cancellation eligibility using payment, activation and usage records. A failed check can stop a claim, payment or automatic refund route. Contact support@simfuse.app if you believe the result is wrong or want a person to review it.
Where a decision is based solely on automated processing and has legal or similarly significant effects within the meaning of data-protection law, you have the applicable safeguards, including the right to obtain human intervention, express your view and contest the decision. We explain the relevant factors and consequences when required. We do not treat every automated technical check as such a decision.
International processing
Service providers and networks can process data outside Estonia, the European Economic Area or the United Kingdom. International connectivity and global payment, messaging and AI infrastructure can involve countries with different data-protection laws.
For restricted transfers, we rely on applicable adequacy decisions or appropriate contractual safeguards, such as the European Commission’s Standard Contractual Clauses with any necessary supplementary measures. UK-restricted transfers require a valid UK mechanism, such as the UK Addendum or International Data Transfer Agreement where applicable. Contact info@simfuse.app for information about the recipients, destinations and safeguards relevant to your data and how to obtain a copy.
How long information is kept
Retention depends on the purpose and the records involved. Account and service information is needed while your account or service is active and to complete outstanding transactions, support or disputes. Closing an account does not itself remove records that must be retained separately.
Financial, invoice and tax evidence is retained for the applicable statutory period. Estonian accounting records generally require seven years from the end of the relevant financial year; records covered by EU One Stop Shop VAT rules require ten years from the end of the transaction year. The relevant rule applies to the record, not to every item of account data.
Support, diagnostic and security records are retained according to the time needed to resolve the issue, investigate abuse or establish or defend claims. Free-claim records are used to enforce one-per-traveller eligibility and handle challenges. Their necessity is assessed against those purposes; this is not permission for indefinite unrelated use. Cookie expiry and provider retention differ from retention of a transaction or consent record. Contact us for the period or criteria applicable to a particular record.
Your rights and account deletion
Depending on the processing and applicable law, you can request access, correction, erasure, restriction or a portable copy of your data, object to processing based on legitimate interests, and withdraw consent. You can object to direct marketing at any time. Withdrawal does not affect processing that was lawful before it.
Email info@simfuse.app to exercise your rights. Supported account settings also provide account deletion and data-export options. We can ask for proportionate information to verify ownership. Requests are normally answered within one month under GDPR; where a lawful extension is needed, we explain it within that month. Deletion and portability have legal limits, including required records and other people’s rights.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local competent supervisory authority. You do not need our permission or have to complain to us first.
Security and children
We use technical and organisational safeguards appropriate to the data and risks, including access controls and encryption in transit. Payment providers handle sensitive card information. No internet or storage system is perfectly secure; do not share sign-in links or eSIM credentials publicly.
Purchasers must be adults under our terms. SimFuse is not directed to children under 16, and we do not knowingly seek their personal data. Contact info@simfuse.app if you believe a child’s data has been provided so we can assess the appropriate deletion or other action, including any legal retention duties.
Changes and contact
We update this notice when our processing changes. Material changes will be brought to your attention as required. Continuing to use SimFuse is not consent to new optional processing; we ask separately where consent is needed.
Privacy contact: info@simfuse.app. Service and eligibility questions: support@simfuse.app. Controller: Qorinx OÜ, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia.
