Privacy policy

Effective date: October 28, 2026

This policy explains what personal data EzyHop collects when you visit ezyhop.com, buy an eSIM or top-up, or contact us. It also explains why we use it, who we share it with, how long we keep it and what your rights are.

The short version: we collect what we need to sell you an eSIM, deliver it and support it. We don’t sell your data, we don’t run advertising trackers, and we never see your card details.

Who we are

EzyHop is the controller of your personal data. This means we decide why and how it is used.

EzyHop
600 N Broad Street, Suite 5 #3414
Middletown, DE 19709
United States
Website: ezyhop.com

For any privacy question or request, contact us through [email protected].

The data we collect

What you give us

Your email address. You need it to buy, to receive your eSIM and receipts, and to sign in. We use email sign-in links, so there are no passwords.
Your language. English or Spanish, taken from the version of the site you use.
Your choices and consents. Your answers to the checkboxes at checkout (that your phone supports eSIM, that you want your eSIM delivered right away, that you accept our terms, and whether you want marketing emails), your email preferences and your cookie choice.
Your name, only if we receive it. We don’t ask for your name to sell you an eSIM. We may have it if you sign in with Google (see below) or if you give it to us when you contact us.
What you write to us. When you email our support team, we receive your message, your email address and anything you include, such as your order number.

What we collect when you use EzyHop

Orders and top-ups. What you bought (destination, data, days), the price, any promo code, the order number, the status of your order and the time you accepted our terms.
Your eSIM. The eSIM’s identifiers (such as the ICCID), its install details (the SM-DP+ address, the activation code and, where needed, the APN), its status, its expiry date and how much data you have used.
Sign-in and security data. Your IP address, your browser and operating system (for example “Chrome on macOS”), the sign-in method, when you were last active, and a record of security events such as sign-ins, new devices and changes to your account.
Cookies. A few cookies keep you signed in, let you open your order and remember your cookie choice. Details are in our Cookie policy.
How you found us, only if you accept analytics. If you click “Accept” in the cookie banner, we remember the page or campaign that first brought you to EzyHop (for example the referring site and any campaign tags in the link). If you reject, we don’t store it.
Email delivery data. Whether our emails were delivered, bounced or marked as spam. Depending on our email provider’s settings, this can also include whether an email was opened or a link in it was clicked.

We do not collect your precise location, and we do not see what you do online with your eSIM. From our network partner we only learn how much data you have used, not which sites or apps you used it for.

What we receive from others

Stripe, our payment provider: whether your payment went through, the amount, the card brand (for example Visa, never the card number), Stripe’s fraud risk rating for the payment, and any refund or dispute.
eSIM Access, our network partner: your eSIM’s identifiers, its status (for example installed or expired) and your data usage.
Google, only if you choose “Continue with Google”: your email address, confirmation that Google has verified it, and possibly your name and profile picture. We don’t keep any Google access tokens.
Your device, only if you add a passkey: a public key and the name of the passkey provider (for example “iCloud Keychain”). Your fingerprint or face data never leaves your device.
Cloudflare Turnstile, our bot check: whether the check was passed.

Why we use your data, and our legal bases

Data protection law in the EU and UK requires a legal basis for each use. Here are ours.

What we do	Legal basis
Take your order, deliver your eSIM, show it in your account, process top-ups and send the emails that go with them (delivery, receipts, delays, refunds)	Contract
Let you sign in, keep your account and sessions secure, and tell you about new sign-ins	Contract and legitimate interest (keeping accounts safe)
Send usage alerts (low data, plan ending, install deadline). You can turn usage alerts off.	Contract and legitimate interest (helping you avoid running out of data)
Answer your messages and fix problems with your eSIM	Contract and legitimate interest (good customer service)
Prevent fraud and abuse: bot checks, rate limits, payment risk checks, blocking disposable email addresses, freezing accounts after a payment dispute	Legitimate interest (protecting you, our customers and our business)
Keep orders, payments, refunds and receipts	Legal obligation (tax and accounting law)
Keep a record of your consents and your acceptance of our terms	Legal obligation and legitimate interest (being able to show what you agreed to)
Handle refunds, payment disputes and legal claims	Legitimate interest and legal obligation
Send news, offers and travel tips, and remind you about an unfinished checkout	Consent (you can withdraw it at any time)
Remember how you found us and measure visits with privacy-friendly analytics	Consent (through the cookie banner)
Run and improve the site, and keep technical logs to find and fix errors	Legitimate interest (a working, reliable service)

Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see “Your rights” below).

If you don’t give us your email address, we can’t sell you an eSIM, because that is how we deliver it and contact you about it.

Marketing emails

We only send marketing emails if you ticked the box at checkout or turned them on in your account. We send them at most once a month. Every marketing email has an unsubscribe link, and you can also change your choice in your account. Emails about your orders, eSIMs, sign-ins and account security are always sent, because they are part of the service.

Fraud checks and held orders

Stripe checks every payment for fraud. If Stripe rates a payment as elevated or high risk, we hold the order before ordering the eSIM, so a member of our team can review it. If the order is not approved within 60 minutes, we refund the payment in full automatically. If a payment is disputed or reported as fraud, your account is frozen so no further purchases can be made until we review it. If you think we got it wrong, contact us and a person will look at it.

Who we share your data with

We share data only with companies that help us run EzyHop, and only what they need. We don’t sell your personal data, and we don’t share it with advertisers.

Stripe (payments, fraud checks, refunds and disputes). You pay on Stripe’s secure page, so Stripe collects your card or wallet details, and we never see them. We send Stripe your email address, a description of what you are buying and our order reference. Stripe also collects information about your device and connection for fraud prevention. Stripe acts as a service provider for us and, for some purposes such as fraud prevention and legal compliance, as an independent controller under its own privacy policy.
eSIM Access, operated by Redtea Mobile (our network partner, which issues your eSIM and provides the mobile data). We send it our order reference and the plan you chose. We don’t send it your name or email address. When you install the eSIM, your phone connects directly to its servers to download the eSIM profile. As with any mobile service, the networks that carry your data handle your connection while you use it. Some plans route your internet traffic through Hong Kong, and we show this on those plans.
Resend (sends our emails). It handles your email address and the content of our emails. This includes your eSIM install details when we deliver your eSIM. Resend keeps its own logs of the emails it sends for a limited time, under its own retention settings.
Railway (hosts our website and database, on servers in the Netherlands).
Cloudflare (protects and speeds up our website, runs the Turnstile bot check, and forwards emails sent to our addresses to our support inbox). It handles your IP address, technical request data and the emails you send us.
Google (only if you use “Continue with Google”). You sign in on Google’s own page.
Analytics provider (only if you accept analytics and we have analytics turned on). Either Plausible Analytics or Cloudflare Web Analytics. Both are cookieless and measure page visits without building a profile of you.
Apple and Google eSIM setup pages. If you tap a one-tap install link, your phone opens Apple’s or Google’s eSIM setup page with your activation code, so your phone can install the eSIM.

We may also share data:

with professional advisers, such as accountants and lawyers, under a duty of confidentiality;
with authorities, courts or other parties when the law requires it, or to protect our rights, our customers or the public;
with a buyer or successor, if EzyHop’s business is sold or reorganized. Your data would stay protected under this policy.

International transfers

EzyHop is based in the United States, and some of our service providers are in the United States or other countries outside the European Economic Area (EEA) and the UK. This means your data may be handled in countries whose data protection laws differ from yours.

When personal data from the EEA or UK goes to a country without an adequacy decision, we rely on one of these safeguards:

an adequacy decision, including the EU–US Data Privacy Framework and its UK extension where the recipient is certified under it;
the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data, in the provider’s data protection terms;
where no other safeguard applies, the transfer being necessary to perform our contract with you, for example to deliver the eSIM you ordered.

You can ask us for more information about these safeguards.

How long we keep your data

We keep data only as long as we need it. Our systems delete or anonymize much of it automatically.

Data	How long
Account (email, name, language, preferences)	Until you ask us to delete your account
Orders, top-ups, payments, refunds and disputes	As long as tax and accounting law requires. If you delete your account, we keep these records without your email address.
eSIM install details (activation code)	Deleted once the eSIM has expired or been cancelled. Copies in emails we sent stay in your mailbox until you delete them.
eSIM identifiers and usage	With your order records
Sign-in sessions (including IP address and browser)	A session stops working after 30 days at most. Its record is deleted when you sign out, when you remove it from your account’s security page, or when your account is deleted.
Security log (sign-ins, account changes, order lookups)	IP address and browser details removed after 90 days; the rest deleted after 395 days
Our stored copy of the details in emails we sent	Sign-in links removed as soon as the email is sent; other details removed 60 days after sending. We keep a record that the email was sent.
Email delivery events (delivered, bounced, opened, clicked)	180 days
Records of payment and network partner notifications	180 days
Order access links sent by email	Valid for 7 days, deleted 30 days after they expire
Rate-limit counters (used to block abuse)	1 day
Marketing preferences and proof of consent	Until you withdraw your consent or delete your account, and afterwards only as long as we need to show we had your consent
Unsubscribe and do-not-email list	Until you ask us to email you again, or until your account is deleted
“How you found us” cookie	90 days, and deleted if you reject analytics
Support emails	As long as needed to handle your request and any follow-up
Records of actions our team takes on orders and accounts	Kept with the order records, for security and accounting
Your privacy requests (export or deletion)	Kept to show we handled them; without your email address once your account is deleted
Technical server logs	A short period set by our hosting provider. They don’t contain install codes, sign-in links or full email addresses.

How we protect your data

All traffic to our website is encrypted with HTTPS, and our database only accepts encrypted connections.
eSIM activation codes are encrypted in our database.
We don’t use passwords. Sign-in links expire after 15 minutes, and we store them only in hashed form, like other access tokens.
Card details go straight to Stripe. We never see or store them.
Our logs leave out install codes, sign-in links, cookies and full email addresses.
Only a small number of staff can access customer data, using two-step verification, and their actions are logged.
We use bot checks and rate limits to stop abuse.

No system is perfectly secure. If a data breach affects you, we will tell you and the relevant authorities when the law requires it.

Your rights

Everyone

You can always:

Download your data. In your account, go to Privacy and choose “Download my data”. You get a file with your account, orders, payments, eSIMs, top-ups and the emails we sent you. For your security, it doesn’t include install codes or sign-in tokens.
Delete your account. In your account, go to Privacy and request deletion. We complete it within 30 days, usually within a few days. eSIMs you already installed keep working, but you won’t be able to see their usage or top them up here. We keep order and payment records without your name or email address, as long as tax law requires.
Stop marketing emails with the unsubscribe link in any marketing email or in your account preferences.
Change your cookie choice with “Cookie settings” in the footer of every page.

For anything else, contact us through [email protected]. We may ask you to confirm the request from the email address on your account, so we know it is really you.

If you are in the EEA or the UK

Under the GDPR and the UK GDPR, you have the right to:

access your personal data and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict how we use your data;
receive your data in a portable format;
object to uses based on our legitimate interest, and to direct marketing at any time;
withdraw your consent at any time, without affecting what we did before;
ask for a person to review a decision made automatically, such as a held order.

We reply within one month. We may extend this by two more months for complex requests, and we will tell you if we do. Using your rights is free.

You can also complain to the data protection authority where you live or work. In the UK, this is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to sort out your concern first.

If you are in California

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

Categories we collect. In the last 12 months, we have collected:

identifiers, such as your email address, IP address, order numbers, eSIM identifiers and device identifiers;
customer records, such as your name (if you gave it) and payment status (never your card number);
commercial information, such as the plans and top-ups you bought;
internet or network activity, such as sign-in records, your browser and, with your consent, how you found us;
inferences limited to fraud risk ratings for payments.

We collect these from you, from your device and from the providers listed in “What we receive from others”. We use them for the purposes in “Why we use your data”, and we keep them for the periods in “How long we keep your data”.

Disclosures. We disclose these categories for business purposes to the service providers listed in “Who we share your data with”, such as our payment, hosting, email and network partners.

No selling or sharing. We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done so in the last 12 months, and we have no actual knowledge of selling or sharing data of anyone under 16. Because we don’t sell or share, there is nothing to opt out of.

Sensitive personal information. We don’t use or disclose sensitive personal information for purposes that would give you a right to limit it.

Your rights. You have the right to:

know what personal information we collect, use and disclose, and get a copy of it;
delete your personal information;
correct inaccurate personal information;
not be treated differently for using these rights.

To make a request, use your account’s Privacy page or contact us through [email protected]. We will verify your request by confirming it from the email address on your account. You can use an authorized agent; we may ask for proof that the agent has your permission and ask you to confirm your identity with us directly.

Other US states. If you live in another US state with a consumer privacy law, you can make the same requests in the same way.

Children

EzyHop is not meant for children, and you must be 18 or over to buy (see our Terms). We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you think a child has given us personal data, contact us and we will delete it.

Cookies

We use a few cookies that the site needs to work, such as keeping you signed in. We only use analytics if you accept them in the cookie banner. You can change your choice at any time with “Cookie settings” in the footer. Read the details in our Cookie policy.

Changes to this policy

We may update this policy when our service or the law changes. We will post the new version here with a new effective date. If a change matters to you, we will also tell you by email or on the site before it takes effect.

Contact us

For any question about this policy or your personal data, contact us through [email protected].

You can also write to us by post:

EzyHop
600 N Broad Street, Suite 5 #3414
Middletown, DE 19709
United States