Wakavi logowakavi
Destinations

Privacy Policy

Last updated 2 November 2026

This policy explains what personal data Wakavi collects when you use wakavi.com, buy an eSIM (including through an AI assistant connected to Wakavi), or contact us, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is Wakavi. For any privacy question or request, email [email protected].

2. What we collect

  • Email address. To log you in with a one-time code, deliver your eSIM QR code, send order updates and answer support requests.
  • Order details. The plan, destination, price, quantity and order reference, and the eSIM details our network partner returns: ICCID, activation code, status and data usage.
  • Time zone. Your browser's time zone, so times in our emails match your clock.
  • Technical data. Your IP address and basic browser information, used to keep the site secure, limit login-code requests and prevent fraud.
  • Payment information. Payments are handled entirely by Stripe. We never see or store your full card number; we receive the payment status and a payment reference.
  • Messages you send us, for example support emails.
  • Purchases through an AI assistant. The assistant passes us the email address and plan you chose. Your conversation itself stays with the assistant's provider.

We do not sell your personal data, and we do not use it for advertising.

  • To provide the service (contract): creating your account, processing orders, delivering eSIMs, showing your data usage and handling refunds.
  • Security and fraud prevention (legitimate interests): rate-limiting login codes, protecting accounts and stopping abuse.
  • Legal obligations: keeping order and payment records as tax and accounting law requires.
  • Service messages (contract or legitimate interests): emails about your orders and account. We will only send marketing emails if you agree to them, and you can opt out at any time.

4. Who we share it with

We share personal data only with service providers that help us run Wakavi, under contracts that require them to protect it:

  • Stripe processes payments. Stripe is independently responsible for some data it uses to prevent fraud; see stripe.com/privacy.
  • Our eSIM network partner issues your eSIM. We send it only an order reference and the plan you bought, not your name or email address.
  • Customer.io sends our emails, so it processes your email address and the content of those emails.
  • Cloudflare delivers and protects our website, so it processes your IP address and request data.
  • Our hosting provider runs the servers where our database is stored.
  • Authorities or advisers when the law requires it, or to protect our rights.

5. International transfers

Some of these providers, such as Stripe, Customer.io and Cloudflare, may process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

6. How long we keep it

  • Account data is kept until you ask us to delete your account.
  • Order and payment records are kept for as long as tax and accounting law requires, then deleted.
  • Login codes are stored only in hashed form and expire after 10 minutes.
  • Security logs are kept only for a short period.

7. Cookies

We use one essential cookie, wk_session, which keeps you logged in for up to 30 days. Cloudflare may set strictly necessary security cookies to protect the site from abuse. Stripe sets its own cookies on its checkout page, under Stripe's policy.

We do not use advertising or tracking cookies. If we ever add analytics, we will update this policy and ask for your consent where the law requires it.

8. Your rights

Under the GDPR you can ask us to:

  • give you a copy of your personal data (access);
  • correct inaccurate data (rectification);
  • delete your data (erasure), unless we must keep it by law;
  • restrict or object to how we use it;
  • give your data to you in a portable format;
  • withdraw consent you have given, at any time.

To use any of these rights, email [email protected]. We will reply within one month. You can also complain to the Information and Data Protection Commissioner (IDPC) in Malta (idpc.org.mt), or to the data protection authority in the country where you live.

9. Children

Wakavi is not intended for children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

If we change this policy, we will update it on this page and change the "Last updated" date above. For significant changes we will let you know by email.