Who is responsible
The controller of your personal data is Skye Digital OÜ (registry code 17624561), Tähe tn 1-4, 51010 Tartu, Estonia, info@skyesim.ee. This policy explains what data we process when you use skyesim.ee and buy an eSIM, why, and what rights you have.
What data we use and why
- Orders: your email address, the plans you buy, prices, order number, order time, language and the currency you chose to view prices in, and the payment status we receive from Stripe. We use them to deliver your eSIM and provide the service (performance of the contract, GDPR art. 6(1)(b)) and keep them as accounting records (legal obligation, art. 6(1)(c)).
- Your eSIM: the eSIM’s identifiers and installation details, and its status and data use, which we receive from our eSIM supplier, to deliver the eSIM, help you and handle refunds (contract).
- Payments: handled by Stripe. We receive the payment result, not your full card details. Stripe also checks payments automatically for fraud.
- Account (optional): your email address and sign-in records; if you sign in with Google, also the name and profile picture Google shares. Used to show your orders and keep you signed in (contract).
- Messages: what you send through the contact form or by email (name, email address, message), to answer you (our legitimate interest in replying, art. 6(1)(f), or the contract).
- Withdrawal statements: your name, email address, order number and the time you sent the statement, to process the withdrawal and refund (legal obligation).
- Technical data: your IP address and browser details in our servers’ logs, to keep the website secure and working (legitimate interest).
- Website analytics (only if you allow it): the pages you visit, where you came from, your device and browser, your approximate location (country and city) and, when you buy, the order number, amount and plans bought, collected with Google Analytics cookies, to see how the website is used and improve it (your consent, art. 6(1)(a)). We never send it your name, email address, payment details or order links, and Google Analytics doesn’t store your IP address. You can withdraw consent at any time with “Cookie settings” at the bottom of every page.
- Advertising measurement (only if you allow marketing cookies): the pages and plans you look at, adding to the cart, starting checkout and, when you buy, the order number, amount and plans, with your IP address, browser and Meta’s cookie identifiers, sent to Meta with the Meta Pixel and from our server (Conversions API), to measure our Facebook and Instagram ads and show them to people likely to be interested (your consent, art. 6(1)(a)). We never send your name, email address, payment details or order links. You can withdraw consent at any time with “Cookie settings”.
We use advertising cookies only with your consent, we don’t send marketing emails, and we don’t sell your data. Your email address is needed to order, because the eSIM is delivered by email. We don’t make decisions about you based solely on automated processing, apart from Stripe’s fraud checks on payments.
Who we share it with
Only the service providers we need to run the service, under data processing agreements:
- Stripe (Stripe Payments Europe Ltd, Ireland): payments. Stripe is also a controller of payment data under its own privacy policy.
- Supabase: database and sign-in, with servers in the EU (Ireland).
- Vercel (USA): hosting of the website.
- Resend (USA): sending our emails, from servers in the EU (Ireland).
- Google (Google Ireland Limited): Google Analytics, only if you allow analytics cookies, with advertising features turned off. Also when you sign in with Google: the sign-in page loads Google’s sign-in button from Google, which sees your IP address and may use its own cookies (Google’s privacy policy).
- Meta (Meta Platforms Ireland Limited): the Meta Pixel and Conversions API, only if you allow marketing cookies. For collecting and sending this data we and Meta are joint controllers (Meta’s Controller Addendum); Meta processes it further as a controller under its own privacy policy (Meta).
- Our email provider (Estonia): our inbox, which receives your messages.
Our eSIM supplier receives only our order reference, no personal data. Some images and country flags on the website are loaded from Unsplash and flagcdn, which see your IP address when your browser loads them. We disclose data to authorities only where the law requires it.
Transfers outside the EU
Vercel, Resend, Google and Meta are US companies or part of one, so data may be processed in the USA. Such transfers are protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
How long we keep it
- Orders, payments, refunds and withdrawal statements: 7 years, as the Estonian Accounting Act requires.
- Account: until you delete it. Your orders stay as accounting records for the period above.
- Messages: up to 3 years after the matter is closed, in case of a claim.
- Server logs: a short time, for security.
- Analytics: 2 months in Google Analytics. Its cookies expire after 2 years, or sooner if you decline analytics or delete them.
- Marketing: Meta’s cookies expire after 90 days, or sooner if you decline marketing or delete them; Meta keeps the data under its own policy.
Your rights
You have the right to:
- get a copy of your data and information about how we use it;
- have incorrect data corrected;
- have your data deleted, unless we must keep it by law;
- restrict processing, or object to processing based on our legitimate interest;
- receive the data you gave us in a machine-readable format.
Write to info@skyesim.ee; we reply within one month. You can delete your account yourself in your account settings. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority of your country.
Changes
If we change how we use personal data, we update this policy and the date at the top.
Questions about your data?
Skye Digital OÜ · Tähe tn 1-4, 51010 Tartu, Estonia