Privacy Policy

1. Who is responsible for your data

Isohel Group Limited, Gladstonos 12-14, 8046 Paphos, Cyprus (“we”), is the controller of the personal data described below. Contact for any privacy question: the contact form on this website.

2. What we collect and why

• Order data: your email, the plan you bought, the amount, dates and the status of your eSIM and VPN subscription. Used to process and deliver your order, send receipts and activation emails, handle refunds and support. Legal basis: performance of the contract.
• Payment data: entered on Stripe’s page. We never see or store your card number. We receive from Stripe a payment reference, your billing country and the tax amount.
• Contact messages: your name, email and message, plus a one-way hash of your IP address (not the address itself) used to limit spam. Used to answer you. Legal basis: our legitimate interest in answering requests and preventing abuse.
• Offers related to your eSIM: if you have bought an eSIM from us, we may email you about that eSIM, for example to offer a data top-up when most of your data is used. We tell you about this when you order and every such email contains an unsubscribe link. Legal basis: our legitimate interest in offering similar products to our customers, and the exception for existing customers in email-marketing law. You can object at any time.
• Reminders for unfinished payments: if you start a payment, do not finish it and ticked the reminder box on our order form before paying, we send you two reminder emails (about 1 hour and 24 hours later) with a link back to your order. We store your email only for that purpose, for at most 30 days. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in each email. If you do not tick the box, we send nothing.
• Accounting and legal records: invoices and payment records we must keep by law. Legal basis: legal obligation.

We do not sell your data and we do not use it for advertising.

3. Who receives your data

We share data only with the providers needed to run the service:

• Stripe: payments, subscriptions, receipts and invoices.
• Supabase: database hosting for orders and contact messages.
• Vercel: website hosting.
• Resend: sending our emails (receipt, activation, contact replies and, when you have agreed to them, payment reminders and offers related to your eSIM).
• Cloudflare Turnstile: anti-spam check on the contact form (it may process your IP address and browser signals).
• Our eSIM supplier: receives the plan reference needed to issue your eSIM, not your email.
• Our VPN provider (only if you add the VPN): receives an alias of your email address and the order reference to create your VPN account.

Some of these providers are located outside your country, including outside the EU/UK. Where this happens, transfers rely on safeguards such as the European Commission’s standard contractual clauses.

4. How long we keep it

• Order and payment records: for the period required by accounting law in our country, then deleted.
• Contact messages: up to 12 months after the last exchange.
• Reminder emails for unfinished payments: up to 30 days (an unsubscribed address is kept only to remember your choice).
• Activation links stop working after 45 days, but the order record is kept as stated above.

5. Cookies and local storage

We do not use advertising or analytics cookies. The site only uses what is strictly necessary: a session cookie for the administrator area, a small entry in your browser to remember the 60-second delay between two contact messages, and the cookies Cloudflare Turnstile and Stripe may set to protect the contact form and the payment page. No consent banner is needed for these.

6. Your rights

You can ask us to access, correct, delete, export or restrict the use of your data, and object to processing based on our legitimate interest, by writing to the contact form on this website. We answer within one month. We may keep what the law requires us to keep. You may also lodge a complaint with your data protection authority.

7. Security

Data is transmitted over HTTPS and stored with providers that apply access controls. Activation links contain a long random token: do not share your emails.

8. Changes

We may update this policy; the date above shows the latest version.