American eSims ("we") is the controller of the personal data described here. We process data in line with the EU General Data Protection Regulation (GDPR). Questions or requests: hello@americanesims.com.
What we collect
- Order data: email address, name (if provided), selected plan, travel dates, number of travelers, order history.
- Account data: email and securely hashed password, if you create an account.
- eSIM data: ICCID, activation status and data usage provided by our network partner.
- Payment data: handled by our payment processor. We receive only a payment reference and limited card details (e.g. brand, last 4 digits).
- Technical data: IP address, device/browser type and basic logs for security and fraud prevention.
Why we use it (legal bases)
- To deliver your eSIM, send confirmations and activation instructions, and provide support — performance of a contract.
- To prevent fraud and secure our service — legitimate interests.
- To meet tax and accounting obligations — legal obligation.
We do not sell your data, and we don't send marketing emails without your consent.
Who we share it with
- Our eSIM supplier and its US network partners, to provision and operate your eSIM.
- Our payment processor, to take payment.
- Hosting, database and email-delivery providers acting as processors under data processing agreements.
Some providers may process data outside the EEA; where they do, we rely on adequacy decisions or Standard Contractual Clauses.
How long we keep it
Order and invoice data: up to 7 years (tax law). Account data: until you delete your account. Support emails: up to 2 years.
Your rights
You can request access, correction, deletion, restriction, portability, or object to processing. Email us and we'll respond within one month. You also have the right to lodge a complaint with your national data protection authority.
Cookies
We use essential cookies and local storage to keep you signed in, remember privacy choices, secure checkout and prevent fraud. These are necessary to provide the service and do not require consent. Optional analytics technologies are used only after you opt in through the cookie banner; none are active at launch.
You can accept optional cookies, choose essential-only use, or change your choice at any time using “Cookie preferences” in the footer. Withdrawing consent does not affect processing that occurred before withdrawal.
International transfers & safeguards
Where personal data is transferred outside the EEA or UK, we use an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard. You may ask us for information about the applicable safeguard.
Automated decisions
We do not make decisions that produce legal or similarly significant effects solely by automated means. Automated fraud checks may help us protect payments, with human review available where appropriate.
Complaints and supervisory authority
You may complain to the data protection authority in the EU/EEA country where you live or work, or where you believe an infringement occurred. UK residents may contact the Information Commissioner's Office. We would appreciate the opportunity to address your concern first.