Privacy Notice

1. Who we are

EPICeSIM is a trading name of Inventative LLC, a limited liability company registered in Delaware, United States (16192 Coastal Highway, Lewes, Delaware 19958, United States). When you visit epicesim.com or buy an eSIM from us, Inventative LLC is responsible for your personal information (the “controller”). In this notice “we”, “us” and “our” mean Inventative LLC trading as EPICeSIM.

• Privacy contact: hello@epicesim.com.
• Our UK representative. Because we offer our services to people in the United Kingdom, we have appointed EPICESIM LTD (company number 15968506, registered in England and Wales) as our representative for UK data protection matters. You can write to it at 7 Blade Mews, London SW15 2NF, United Kingdom, or email hello@epicesim.com with “UK representative” in the subject line.
• People in the European Economic Area can contact us directly at hello@epicesim.com about any privacy matter, and may complain to their national data protection authority (see section 8).

2. The information we collect

• Account and order details: your name, email address, billing country and address, the eSIM packages you buy, order references, amounts and dates.
• Payment details: payments are handled by our payment providers, Stripe and PayPal. We do not see or store your full card number. We receive a payment reference, the last four digits and card type, and whether the payment succeeded, was refunded or was disputed.
• eSIM service details: the eSIM identifier (ICCID), package, activation status, remaining data and usage totals, which we need to deliver, top up and support your eSIM. The eSIM suppliers we buy from provide this for each ICCID, and it can include when the eSIM was installed or connected and the country and mobile network it connected to. We do not give those suppliers your name, email address, billing address or payment details. We do not receive the content of your communications, the websites you visit or your precise location.
• Support conversations: messages you send us by email, WhatsApp or our website, and the phone number or email you contact us from.
• Device and website information: your IP address, browser and device type, pages visited and the cookies described in section 7.

3. How and why we use it

• To sell you an eSIM, take payment, deliver it by email, and provide top-ups, support and refunds (needed to perform our contract with you).
• Fraud prevention and payment checks: we and our payment providers use transaction, device and payment information to detect fraud, misuse and chargebacks (our legitimate interest in protecting our customers and business). A payment provider may automatically decline or hold a payment under its own fraud rules; payment providers act as independent controllers for that processing. We do not make decisions about you based solely on automated processing. If a payment is declined or held, contact us and a person will look into it.
• To meet legal, tax and accounting obligations (legal obligation).
• To work out which partner referred a sale so we can pay them commission (our legitimate interest in running our partner programme and paying partners correctly). Partners receive only order references and totals, never your name, contact details or payment details.
• Marketing messages: we send promotional emails or other electronic messages where you have consented. Where local law allows us to contact an existing customer about our own similar products without separate consent, we rely on our legitimate interest in marketing those products, and we give you a clear way to opt out when we collect your details and in every message. We do not use this exception where local law requires consent. You can unsubscribe at any time.
• Reviews: to invite you to review your purchase on Trustpilot, and to send you up to two reminder emails (about 14 and 35 days after your order) with a link to leave a review (our legitimate interest in getting customer feedback). If you do not want review invitations, email hello@epicesim.com and we will stop sending them.
• To understand how our website is used and improve it, and to measure and show our advertising, using analytics and marketing technologies only where you have agreed (consent). See section 7.

4. Who we share it with

We do not sell your personal information for money. We share it only with:

• Stripe and PayPal, to process payments and refunds.
• Our website hosting and technology providers, which act on our instructions: Rocket.net (hosting), Cloudflare (content delivery, security, bot management and Turnstile anti-spam checks), Automattic (Jetpack site tools), Microsoft (Microsoft 365, which sends our order and account emails and hosts our email inbox), and Meta (WhatsApp, if you contact us there).
• Advertising and analytics providers, only if you consent to marketing or analytics technologies: Google (Tag Manager, Analytics and Ads), Microsoft Clarity (records how visitors use our pages, such as clicks and scrolling, to improve the site), Automattic (Jetpack and WooCommerce site statistics) and Meta (the Meta Pixel and Conversions API, including a Meta helper script loaded from the unpkg.com code service). Depending on the tool, they may receive page and purchase events, IP address and device information, cookie or advertising identifiers and, for Meta, your email address or phone number in hashed form. Hashing does not make the information anonymous where the provider can match it to an account. We use this to measure purchases, build advertising audiences and show relevant advertising. Your choice applies to both the tags in your browser and the events our server sends.
• Trustpilot, so that it can invite you to review your purchase. When your order is completed, we send Trustpilot your name, email address, order number, the products you bought (name, page link, image and product code), and the order total and currency. When an order’s status changes for another reason (for example pending, failed, cancelled or refunded), we also send your name, email address, order number and the new status. Trustpilot’s invitation emails include its own unsubscribe link.
• Professional advisers, and authorities where the law requires it.
• A buyer of our business, if it is ever sold, under the same protections.

Some of these recipients act only on our instructions. Others, such as payment providers, review platforms and advertising platforms, also decide how to use the information for their own purposes and are responsible for that under their own privacy notices. A full list of the cookies we use, what they do and how long they last is in our Cookie Policy.

Partner organisations that refer customers to us (for example tourism bodies) do not receive your personal information.

Mobile networks. When you use your eSIM, the mobile network that carries your connection in each country you visit processes technical and connection information, such as when your device connects and how much data it uses. It does so under its own legal responsibilities and privacy terms, not on our behalf. The network used can vary by destination.

5. International processing and transfers

Inventative LLC is based in the United States, so information you give us is processed in the United States. We also use service providers in the United States and other countries. Where EU, UK or other applicable data protection law requires a safeguard for a transfer to a separate organisation, we use the safeguard that applies to that recipient and service. This may be an adequacy decision, including the EU-US Data Privacy Framework or its UK Extension where the recipient is certified and the transfer is covered; the European Commission’s Standard Contractual Clauses; or the UK International Data Transfer Agreement or UK Addendum. You can ask us at hello@epicesim.com which safeguard applies to a particular recipient, or for a copy of the relevant terms (we may remove commercially sensitive parts).

6. How long we keep it

We keep each type of information only for as long as we need it for the purposes in this notice, to meet legal obligations and to deal with possible claims. Our standard periods are:

• invoices, tax and core transaction records: 7 years after the end of the financial year of the transaction;
• eSIM identifiers, activation and usage records: 2 years after the plan expires;
• support conversations: 2 years after the conversation ends;
• partner-referral records used to calculate commission: 12 months after the commission is paid;
• analytics and advertising information: the retention period set in each provider’s tools. For Google Analytics, we keep event-level data for 2 months and user-level data for 14 months; the 14 months restart each time you return to our website.

We may keep a record longer while a dispute, chargeback, fraud review or legal requirement applies. At the end of the period we delete the information or make it anonymous.

7. Cookies

• Essential cookies keep your basket, login, checkout and security checks working. They cannot be switched off.
• Analytics and marketing cookies and similar technologies from Google, Microsoft (Clarity), Automattic (Jetpack and WooCommerce statistics) and Meta, plus our own marketing cookies that record how you found us and let us email you a reminder about a basket you left, are only used if you accept them. Refusing is as easy as accepting. Our Cookie Policy lists every cookie and how long it lasts.

You can change or withdraw your choice at any time through the “Cookie settings” link at the bottom of every page.

8. Your rights

Depending on where you live and which law applies, you may have the right to:

• access the personal information we hold about you;
• have it corrected or deleted;
• object to or restrict how we use it, including for direct marketing;
• receive a copy in a portable format;
• withdraw consent at any time, without affecting earlier use.

United States: privacy laws in some US states give residents rights when a business falls within the law’s scope. Where a law applies to us, these may include rights to know, access, correct or delete personal information, to obtain a copy, and to opt out of its sale, its sharing for cross-context behavioural advertising, or its use for targeted advertising. We do not sell personal information for money. Some advertising disclosures may be treated as a sale, sharing or targeted advertising under those laws. You can opt out at any time by rejecting marketing cookies in the “Cookie settings” link at the bottom of every page, and we treat Global Privacy Control browser signals as an opt-out. We will not treat you differently for using any of these rights.

These rights have limited legal exceptions, and we may need to check your identity before acting on a request. To use any of them, email hello@epicesim.com. We will reply within the period the applicable law requires; for UK and EU requests this is normally one month, which can be extended for complex requests. We do not charge unless a request is clearly unfounded or excessive. You may also complain to the data protection authority where you live or work, for example the UK Information Commissioner’s Office or your national authority in the EEA, and, where South African law applies, South Africa’s Information Regulator.

9. Security

We use technical and organisational measures designed to protect personal information, including encrypted transmission, access controls, restricted administrative access and careful choice of suppliers. No online service can guarantee absolute security. If a personal data breach occurs, we will notify the relevant authorities and the people affected where the law requires it.

10. Children

Our checkout is for buyers aged 18 or over, and our services are not directed at children. An adult may buy an eSIM for a child travelling with them, but should not give us information about the child unless it is needed for support. We do not knowingly use children’s information for advertising. If you believe a child has given us information without appropriate permission, contact hello@epicesim.com and we will delete it where required.

11. Changes to this notice

We will post any changes on this page and update the date above. If a change is significant, we will tell you by email.