Privacy Policy
Effective and last updated: June 4, 2026
This notice explains how SIMplify processes personal data. Using the service does not constitute consent to optional processing.
1. Who controls your data
SIMplify is the controller for personal data processed through this website and the SIMplify eSIM service. Privacy questions and data rights requests can be sent to privacy@simplify-esim.com.
The backend service, mobile applications, infrastructure providers, and vendor contracts are reviewed separately from this website notice.
2. Data we process and why
| Data and purpose | Legal basis |
|---|---|
| Account details, authentication, purchases, payments, eSIM activation, top-ups, and order support. | Performance of our contract and steps requested before entering a contract. |
| Transaction records required for accounting, tax, fraud prevention, and legal compliance. | Legal obligations and our legitimate interest in protecting the service. |
| Device and compatibility information you request us to analyze. | Performance of the requested service and our legitimate interest in preventing incompatible purchases. |
| Support requests and operational error information that has been minimized and redacted. | Performance of our contract and our legitimate interest in maintaining a reliable service. |
3. Browser storage and cookies
We use strictly necessary storage for authentication, security, checkout state, language or currency preferences, and interface settings. Authentication cookies are server-set, HttpOnly, SameSite=Lax, and expire after seven days.
On the standard public website, Vercel supplies an IP-derived country code so we can determine whether an EEA or UK visitor should see the cookie consent banner. We store only whether consent is required, not the raw IP address or country code. If the location is unknown, we ask for consent before enabling optional cookies.
In the mobile app, with your permission, we use your device location to detect your current country and recommend relevant eSIM plans. For example, if you are in Cambodia, we may show Cambodia data plans.
Your accept or reject choice is stored in a first-party cookie for 180 days. You can change your decision at any time by selecting "Cookie settings" in the website footer.
The Bakong mini-app stores a device identifier solely for authentication and fraud prevention. It rotates after 30 days and is not used for analytics, advertising, or cross-service profiling.
We do not intentionally run advertising, session replay, or first party analytics tools. We will request consent before introducing non-essential analytics or tracking technologies.
4. Service providers and recipients
We share only the data needed to provide the requested service with payment providers, mobile network and eSIM providers, authentication providers, support providers, and infrastructure operators.
- ABA PayWay is loaded only during PayWay checkout. We block its bundled Google Analytics request at our application boundary.
- Google receives information when you choose Google sign-in.
- YouTube receives your IP address and device information only after you choose to load a tutorial video.
ChatWoot, Intercom, and Tawk are not loaded by this website source code. A containing mini-app or separately injected runtime may have additional practices and must provide its own notice.
5. Retention and security
Browser authentication sessions expire after seven days, the Bakong device identifier rotates after 30 days, and checkout session storage lasts only for the browser session unless cleared sooner.
Account, order, payment, support, and legal records are retained only for the period required to provide the service, resolve disputes, and meet legal obligations. Contact us for the retention period that applies to a specific record. Client-side remote debug telemetry is disabled.
6. International transfers
Some providers may process data outside your country. Where GDPR requires it, we use an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. You may request information about the safeguard used for your data.
7. Your rights
Depending on the law that applies, you may request access, correction, deletion, restriction, portability, or object to certain processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send requests to privacy@simplify-esim.com. We may need to verify your identity. EEA and UK users may also complain to the data protection authority in their place of residence or work.
8. Changes and contact
We will update this notice when our processing changes and will show the effective date below.
Privacy: privacy@simplify-esim.com
Support: support@simplify-esim.com