# Privacy Policy

> What personal data Surfalo collects when you buy a travel eSIM, why, who processes it and how to exercise your rights.

1. [Home](https://surfalo.com/)
2. Privacy Policy

# Privacy Policy

Last updated: 24 September 2026

This policy explains what personal data we collect when you visit surfalo.com or buy a Surfalo eSIM, why we need it and what your rights are.

## Who is responsible

The data controller is **DS MAKER LTD**, Efesou 9, Paralimni 5280, Cyprus (company number HE465492). Contact: [support@surfalo.com](mailto:support@surfalo.com).

## What we collect

- **Your email address**, from the checkout or from Apple Pay / Google Pay, to send you your eSIM and help you with it.
- **Order details**: the country, days, plan and number of eSIMs you bought, the amount and currency, and the date.
- **Your country**, from your billing details, your card and your IP address. We keep it because tax law requires us to know where our customers are.
- **eSIM details**: the eSIM identifier (ICCID) and, from our connectivity partner, its status and the data it has used, to show you your usage and to give support.
- **Messages you send us**, when you write to support.

We **do not** receive or store your full card number: payments are handled by Stripe. We do not ask for your name, address or phone number, and we do not sell your data.

## Why we use it

- To deliver and support the service you bought (performance of the contract).
- To keep accounting and tax records (legal obligation).
- To prevent fraud and keep the service secure (legitimate interest).

## Who processes it for us

We share only what each provider needs to do its job:

- **Stripe**: payments.
- **eSIM Access (Redtea Mobile)**: creating and running your eSIM.
- **Resend**: sending your eSIM email.
- **Cloudflare**: hosting this website and protecting it.
- **Fastmail**: our support mailbox.

Some of these providers process data outside the European Economic Area. When they do, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard.

## Cookies and analytics

We do not use advertising or tracking cookies. We measure visits with privacy-friendly analytics that does not use cookies and does not identify you. Payment pages from Stripe may set their own cookies needed for secure payment.

## How long we keep it

Order and payment records are kept for as long as tax and accounting law requires. Support messages are kept while they are needed to help you, and then deleted.

## Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to how we use it. Write to [support@surfalo.com](mailto:support@surfalo.com). If you are not happy with our answer, you can complain to the Commissioner for Personal Data Protection in Cyprus or to the data protection authority where you live.

## Changes

If we change this policy, we will update the date at the top of this page.

---

Surfalo · support@surfalo.com · Paralimni
Canonical: https://surfalo.com/privacy/
All pages: https://surfalo.com/llms.txt