Privacy Policy

1. Who We Are

Wanderly ("we", "us", "our") operates the global eSIM marketplace at getwanderly.com. For the purposes of applicable data protection law, Wanderly is the data controller of your personal information. Contact: privacy@getwanderly.com.

2. What Information We Collect

We collect the following categories of personal data:

• Account information: name, email address, password (hashed)
• Purchase information: email address, order details, plan type, country selected
• Payment information: card and PayPal payments are processed by Zotlo (Z3P LLP, London, UK, merchant of record for Zotlo purchases) or by Stripe; cryptocurrency payments by our crypto payment processor. We never receive or store full card numbers or security codes. We receive a transaction reference, amount, billing country and, where the processor provides them, the card brand, last four digits and country.
• Free eSIM fraud-prevention data: to stop the free-eSIM offer being claimed repeatedly, we process an app device identifier, app-integrity (attestation) results from Apple or Google, IP address and approximate location, and, if a card check is requested (processed by Stripe, with no charge), a one-way fingerprint of the card together with its brand, last four digits, card type (credit, debit or prepaid) and country. These are used only to assess eligibility and prevent abuse.
• Device and technical data: IP address, device type, operating system, browser type, eSIM EID (if provided for compatibility checks)
• Usage data: pages visited, search queries on our site, referral source, session duration
• Communications: emails or messages you send to our support team, including conversations with our AI support assistant (see Section 5)
• App notifications: if you allow push notifications in our app, a push token for your device
• Cookies and tracking technologies: see Section 8 below

3. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): to deliver your eSIM, manage your account, and provide support
• Legal obligation (Art. 6(1)(c)): to comply with tax, fraud prevention, and financial regulations
• Legitimate interests (Art. 6(1)(f)): to improve our services, prevent fraud, send transactional communications, and analyse usage patterns — where these interests are not overridden by your rights
• Consent (Art. 6(1)(a)): for marketing emails (where required by law) and non-essential cookies. You may withdraw consent at any time.

4. How We Use Your Information

We use your personal data to:

• Process and deliver eSIM purchases
• Create and manage your account
• Send order confirmations, QR codes, and support responses
• Send marketing emails (only with your consent, and you may unsubscribe at any time)
• Detect and prevent fraud and abuse, including repeat claims of the free eSIM offer
• Answer support questions through our AI support assistant
• Measure the effectiveness of our advertising (only with your consent, see Section 8)
• Improve our website, products, and customer experience
• Comply with applicable legal obligations
• Respond to legal requests from competent authorities

5. Information Sharing and Third-Party Processors

We do not sell your personal data. We share data only with trusted third-party processors who are contractually bound to protect it:

• Zotlo (Z3P LLP) and Stripe — payment processing. Zotlo is the merchant of record for Zotlo purchases. Their privacy policies govern the payment data they collect.
• Supabase — database and authentication infrastructure (data hosted on servers within the EU or US; see Section 6)
• eSIM network providers — we share minimal data (email, plan details) with our upstream eSIM suppliers to provision your plan
• Email service providers (Resend) — to send transactional and marketing emails
• AI support assistant — messages you send in our support chat, and for signed-in users the order details needed to answer them, are processed by a third-party AI service provider to generate replies. This provider may process the data outside the EEA and UK, including in the People's Republic of China. Please do not include card numbers, passwords or installation QR codes in chat. A human can take over the conversation on request.
• Advertising partners — only if you accept advertising cookies: Meta (Facebook/Instagram) receives page-view and purchase events from our website and, when you buy, a one-way hashed copy of your email address and phone number so the purchase can be matched to an ad; Trybe receives attribution events. If you decline or opt out, neither receives your data.
• Notification and operations tools — Expo to deliver app push notifications; internal alerting tools used by our staff to monitor orders and fraud

We may also disclose data to law enforcement or regulators where required by law.

6. International Data Transfers

Some of our third-party processors (including Supabase, Stripe and Meta) process your data outside the European Economic Area (EEA) or United Kingdom, mainly in the United States. Our AI support assistant provider may process chat messages in other countries, including the People's Republic of China. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy:

• Account data: retained for the duration of your account, plus 2 years after closure
• Purchase and transaction records: 7 years (legal and tax compliance)
• Support communications: 3 years
• Marketing preferences and consent records: 5 years from last interaction
• Cookies and analytics data: see Section 8
• Sign-in security logs (IP address, approximate location, device/browser): 90 days, kept to protect your account from unauthorised access (GDPR Art. 6(1)(f) legitimate interest; CCPA security exception)

You may request earlier deletion subject to our legal retention obligations.

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. These include:

• Strictly necessary cookies: required for the site to function (e.g. authentication tokens, session management). These cannot be disabled.
• Analytics cookies: help us understand how visitors use our site (e.g. pages visited, traffic sources). These are only placed with your consent where required by law.
• Preference cookies: remember your settings (e.g. theme, recently viewed destinations).
• Advertising cookies and pixels: the Meta Pixel and the Trybe attribution pixel, plus the matching server-side purchase event described in Section 5. These load, and are sent, only after you click "Accept" in our cookie banner. Choosing "Essential only", or using our Do Not Sell or Share page, turns them off.

You can manage cookie preferences through your browser settings or our cookie consent tool. Note that disabling certain cookies may affect site functionality.

9. Your Rights

If you are located in the EEA, UK, or another jurisdiction with similar laws, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data ("right to be forgotten"), subject to legal retention obligations
• Right to restriction: request that we limit how we process your data in certain circumstances
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: withdraw marketing or cookie consent at any time without affecting prior processing
• Right to lodge a complaint: if you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, contact your national data protection authority.

To exercise any of these rights, email privacy@getwanderly.com. We will respond within 30 days.

9A. California Privacy Rights

If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect and why, to access, correct and delete it, and to opt out of its "sale" or "sharing". We do not sell personal information for money. Sending purchase and page-view events to Meta and Trybe for advertising, described in Sections 5 and 8, may count as "sharing" for cross-context behavioural advertising; it happens only with your cookie consent, and you can opt out at any time on our Do Not Sell or Share My Personal Information page. We honour Global Privacy Control signals as an opt-out where your browser sends them. We do not use sensitive personal information to infer characteristics about you, and we will not discriminate against you for exercising these rights. Requests: privacy@getwanderly.com.

10. Data Security

We implement appropriate technical and organisational security measures to protect your personal data, including encryption in transit (TLS/HTTPS), hashed passwords, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@getwanderly.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email (if you have an account) or by posting a notice on our website. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions or to exercise your rights:

Email: privacy@getwanderly.com
Postal:
Wanderly Technologies LLC
4464 Lone Tree Way #3093
Antioch, CA 94531
United States
Entity No. 202253719897 (California LLC)