Privacy Policy
Last updated: 01.10.2026
This Privacy Policy explains how ESIM MADALIN LLC, operating the Flash Sim eSIM service (the "Website"), collects, uses and protects your personal data. We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable national data protection law. This policy contains the information required by Articles 13 and 14 GDPR.
1. Data controller
ESIM MADALIN LLC
Registered address: 30 N Gould St, STE R, Sheridan, WY 82801, USA
Registration number: to be completed
VAT number: to be completed
Contact e-mail: clienti@flashsim.com
As a company established outside the European Union that offers services to individuals in the EU, our EU representative under Article 27 GDPR is: to be completed.
2. What personal data we process
- Contact data: e-mail address, mobile phone number (with country code) and, if you provide it, your name. We derive your country from the dialling code of your phone number and remember your language.
- Order data: the plan purchased, order number, price, discount or promo code, the activation date you chose, order status and history, the date and time you accepted the Terms and, for the 100 GB plan with calls and SMS, the IMEI of the phone on which you install the eSIM (required by the network operator).
- eSIM data: the identifier of your eSIM (ICCID), the installation data (QR code / activation code) and the status, remaining data and expiry of your plan, which we receive from our eSIM supplier.
- Payment data: you enter your card or wallet details directly on the payment page of Stripe; we never receive or store your full card number or security code. From Stripe we receive the payment status, amount, fees and technical transaction references (and, where Stripe provides them, the card brand and country of issue).
- WhatsApp data: if you keep the WhatsApp option ticked at checkout, or open a support request verified with your phone number: your phone number, your name as given in the order or request (or, if you gave none, the order or request number), the order or request number and plan, the content of the service messages we send you, their delivery status (sent, delivered, read) as reported by WhatsApp, your replies to our messages and any request to stop the messages. Where we enable it, the contact we keep in WhatChimp also holds your e-mail address, order number, plan, language, country and the ICCID of your eSIM.
- Newsletter data: if you subscribe, your e-mail address and language, the date, source and IP address of your subscription and of your confirmation, your subscription status and whether you open our newsletters and click their links, and, if you start an order but do not complete the payment, the plan and amount of that unfinished order.
- Free-offer data: if you claim the free plan, a pseudonymised (hashed) form of your e-mail address and phone number, the IP address used and the date of the claim.
- Support data: the messages, attachments and details you send us through the chat, by e-mail or in a support request, including the ICCID, e-mail address or phone number you give us to verify a request made without an account.
- Technical data: IP address, browser and device type, browser language, session identifiers and security logs (for cookies, see our Cookie Policy). To suggest your language and the dialling code preselected at checkout we use your browser's language setting and, where the Website is served through the Cloudflare network, the country that Cloudflare derives from your IP address and passes to us with the page request. We never send your IP address to a geolocation service.
Traffic measurement: we measure traffic on the Website anonymously, without cookies or any other information saved in your browser: the number of visits, the pages opened, where visitors come from (the referring website and any campaign) and the type of device, browser and operating system. Your IP address is used only at the moment of the visit to derive an approximate location (the country and, for Romania, the county) from a database kept on our own server, and it is not stored. A visit is recognised by an anonymous code that changes every day, so we cannot identify you or follow you from one day to the next. The detailed data is kept for 90 days; after that only daily totals remain. The legal basis is our legitimate interest in understanding how the Website is used and improving it (Art. 6(1)(f) GDPR).
Most of these data come directly from you. The payment status comes from Stripe, the status and usage of your eSIM from our eSIM supplier, and the delivery status of WhatsApp messages from the WhatsApp Business Platform. We do not ask for identity documents for the plans currently sold.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Taking and managing your order, delivering the eSIM (e-mail with QR code, order page) and informing you about your order | Performance of a contract (Art. 6(1)(b)) |
| Sending you service messages on WhatsApp about your own order or request, never advertising: the installation video tutorial and the link to your order, a confirmation when a top-up is applied and, for support requests verified with your phone number, a notice when we reply; you can untick the option at checkout or stop the messages at any time | Performance of a contract (Art. 6(1)(b)) |
| Processing payments, refunds and chargebacks, and preventing payment fraud | Contract / legitimate interest (Art. 6(1)(b), (f)) |
| Customer support, including verifying requests made without an account (ICCID + e-mail address or phone number) | Contract / legitimate interest in protecting your order data (Art. 6(1)(b), (f)) |
| Checking eligibility for the free 1-day offer and preventing abuse (one claim per e-mail address, phone number and IP address) | Legitimate interest (Art. 6(1)(f)) |
| Newsletter and offers by e-mail, sent through Mailchimp after you confirm your subscription (double opt-in), including tailoring them to your purchases (for example a reminder before your plan expires) and, if you start an order but do not complete the payment, a reminder e-mail with a link to resume it | Consent (Art. 6(1)(a)) |
| Keeping proof of your consents and of your requests to stop messages | Legal obligation / legitimate interest (Art. 6(1)(c), (f) and Art. 7(1)) |
| Accounting, tax and record-keeping | Legal obligation (Art. 6(1)(c)) |
| Website security and prevention of misuse (logs, rate limits), suggesting your language from your browser's language setting or the country reported by Cloudflare (see section 2), and aggregate statistics about the order process (without tracking cookies) | Legitimate interest (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Measuring and improving our TikTok ads (TikTok Pixel), only if you accept optional cookies | Consent (Art. 6(1)(a)) |
| Optional cookies, if you accept them | Consent (Art. 6(1)(a)) |
Where we rely on our legitimate interests, you may object at any time on grounds relating to your particular situation (see section 8). Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing before the withdrawal.
4. Is providing your data mandatory?
To buy an eSIM you must give us a valid e-mail address and mobile phone number and accept the Terms & Conditions: we need them to conclude and perform the contract, to contact you about your order, to verify support requests and to apply the limits of the free offer. Without them we cannot accept your order. Your name, the WhatsApp service messages and the newsletter are optional, and the purchase never depends on subscribing to the newsletter.
5. Recipients and service providers
We share personal data only with the recipients below and only as far as needed for the purposes above. Service providers act as our processors under data processing agreements (Art. 28 GDPR), unless stated otherwise.
- Stripe (Stripe, Inc., USA, and its affiliates): payment processing, refunds and fraud prevention. For certain purposes, such as fraud prevention and compliance with financial regulations, Stripe acts as an independent controller under its own privacy policy (stripe.com/privacy). If you choose to use Stripe's Link service, Stripe's own terms apply to it.
- eSIMCard (esimcard.com): our eSIM supplier, which issues the eSIM profiles and data packages. We share only what is needed to issue and manage your eSIM (the package and the eSIM identifiers and, for the 100 GB plan with calls and SMS, the IMEI you enter at checkout), not your name, e-mail address or phone number. The partner mobile network operators process technical connection data (for example network registration and data usage) as providers of electronic communications services.
- WhatChimp: the WhatsApp Business messaging platform we use to send the WhatsApp service messages and to receive your replies. It keeps a contact with your phone number and name and, where we enable it, your e-mail address, order number, plan, language, country and ICCID (see section 2).
- Meta Platforms (WhatsApp Business Platform): transmits the WhatsApp messages. WhatsApp also processes data under its own terms as the provider of your WhatsApp account.
- Mailchimp (The Rocket Science Group LLC d/b/a Mailchimp, an Intuit company, USA): sending the newsletter and managing subscriptions. We send Mailchimp only the data of people who subscribed or asked to be informed about our launch, namely their e-mail address, name, phone number, language and country and information about their purchases (plan, order date and value, plan end date), used to tailor our e-mails. If a confirmed subscriber starts an order but does not complete the payment, we also send Mailchimp that unfinished order (plan, amount and a link to resume it), so that Mailchimp can send a reminder e-mail; it is removed from Mailchimp when the order is paid, cancelled or expires. Mailchimp records whether a newsletter is opened and which links are clicked.
- TikTok (TikTok Technology Limited, Ireland): only if you accept optional cookies, receives through the TikTok Pixel your IP address, browser and device information, the pages you visit and your actions on the Website, to measure and improve our ads. We are joint controllers with TikTok for the collection and transmission. TikTok may transfer data outside the European Economic Area on the basis of the standard contractual clauses approved by the European Commission.
- Hosting, e-mail and IT service providers that host the Website and our mailboxes and deliver our e-mails.
- Cloudflare (Cloudflare, Inc., USA), where the Website is served through its network: as our content-delivery and security provider it receives your IP address with every page request and passes us only the country derived from it, which we use to suggest your language (see section 2). We do not use any other geolocation service.
- Providers of content embedded in the Website: Google Fonts (Google) for fonts and flagcdn.com for flag images. When a page loads, your browser connects to their servers, which receive your IP address. Icons are served from our own server.
- Professional advisers (accountants, lawyers, auditors), who are bound by confidentiality.
- Public authorities and courts, where we are legally required to disclose data.
We do not sell your personal data.
6. International transfers
We are established in the United States and operate the Website from there. When you give us your data directly, the GDPR applies to our processing in full (Art. 3(2) GDPR). When we pass personal data to recipients outside the European Economic Area, we ensure that one of the safeguards of Chapter V GDPR applies:
- for recipients in the United States that are certified under the EU-U.S. Data Privacy Framework (as listed on dataprivacyframework.gov, for example Stripe, Mailchimp/Intuit, Meta and Cloudflare): the European Commission's adequacy decision of 10 July 2023;
- for recipients in countries covered by another adequacy decision (for example the United Kingdom): that decision;
- for other recipients: the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with additional measures where needed.
You can ask us for a copy of the safeguards used by writing to clienti@flashsim.com.
7. How long we keep data
- Orders, invoices and payment records: for the period required by accounting and tax law (typically up to 10 years). The IP address stored with an order is removed automatically at the latest 12 months after the order.
- Customer and contact data, including your phone number: for the duration of our relationship and afterwards for as long as claims relating to your orders can be brought (limitation period).
- Support requests: anonymised automatically 24 months after they are closed.
- Records of WhatsApp messages: as long as the order they relate to; your phone number and the message content are removed from them when your data are erased.
- Newsletter: until you unsubscribe. Afterwards we keep only your e-mail address on a suppression list, with the proof of your consent and of your unsubscription, so that we do not contact you again and can demonstrate compliance.
- Free-offer records (hashed e-mail address and phone number, IP address): the IP address is removed automatically 30 days after the claim, when the one-claim-per-IP check no longer needs it. The rest of the record is kept while the offer runs and for up to 12 months after it ends, to prevent repeated claims, and in any case no longer than 18 months after the claim; it is then deleted or, if it still counts towards the number of free places already given, kept without any data that identifies you.
- Statistics about the order process: the IP address, browser identifier (user agent) and order link stored with each event are removed automatically at the latest 12 months after the event; only anonymous data remain (such as the device type and the referring website reduced to its domain).
- Log files of the Website (for example security, payment and message-sending logs): deleted automatically, so that no entry is kept for more than 12 months. Records of our requests to our eSIM supplier are deleted after 180 days, and the counters we use to limit repeated requests after at most 8 days. We keep a record longer only if it is needed to investigate a specific security incident.
8. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, the right to data portability and the right to withdraw consent at any time. You can object at any time, without giving reasons, to the use of your data for direct marketing. You can unsubscribe from the newsletter with the link at the bottom of every newsletter, and stop the WhatsApp service messages by replying STOP or by writing to us (we stop them at the latest within 1 business day). For full details and how to exercise your rights, see our GDPR page.
9. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The eligibility check for the free offer is automatic: it only compares the e-mail address, phone number and IP address with earlier claims. If your claim is refused, you can ask us to have the decision reviewed by a person.
10. Security
We apply appropriate technical and organisational measures (including encryption in transit (HTTPS), encryption of stored access keys, role-based access for our staff, CSRF protection and rate limits) to protect your data against unauthorised access, loss or disclosure. Card payments are handled on Stripe's payment page, which is certified to the PCI DSS standard.
11. Cookies
The Website uses cookies as described in our Cookie Policy.
12. Changes to this policy
We update this policy when our processing changes. The date at the top shows the version in force; significant changes are announced on the Website.
13. Contact and complaints
For any privacy question or to exercise your rights, contact us at clienti@flashsim.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or of the alleged infringement (list on edpb.europa.eu).
