Privacy policy

This policy explains what personal data KurdistanEsim ("we") collects when you use our website and our app, why we use it, who else receives it, how long we keep it, and how you can delete it.

In short

• We collect what we need to sell you an eSIM, deliver it and help you with it.
• Our eSIM suppliers never receive your name, email address or phone number.
• We never see your full card details.
• There are no advertising, analytics or crash-reporting tools in our app or on our website.
• We do not sell your personal data.
• You can delete your account at any time in Profile.

1. What we collect

Your account

• Your phone number, if you sign in with it.
• Your email address, if you give it to us or sign in with email, Google or Apple.
• Your name, if you add it.
• Your password, if you set one. We keep only a scrambled form of it (a hash) that the password cannot be read back from. We never store the password itself.
• If you sign in with Google or Apple, the account ID they give us, so that you return to the same account.
• Your language, and the countries you mark as favourites.

Your orders and payments

• What you bought, the price, the amount paid, the dates and the status of each order.
• Which version of our terms of sale you accepted.
• The payment reference, and the payer's name and account number or masked card number, as the payment provider reports them to us.
• Refund records.

Your eSIM

• The eSIM's identifiers (such as its ICCID) and its activation code.
• How much data you have used and how much is left, which we read from the supplier.

The phone check

When the app checks your phone before you pay, we keep the result with your order: the type of phone and its system version, the phone model, the country of the SIM already in your phone, the result of each check, and any warning you accepted and when.

Support

• The messages you send us about an order, and our replies.
• If you contact us by email, WhatsApp or phone, what you tell us.

Notifications

• If you allow notifications, a token that lets us send notifications to your phone.
• The notifications we send you, which also appear in the app's inbox.

Technical data

When you connect, our servers receive your IP address, as with any website or app. We use it to run the service and to protect it, for example to limit repeated sign-in attempts.

What we do not collect

Your date of birth, home address, passport or ID number, card number, location or contacts, or any advertising or analytics identifier.

We also count what people search for in the shop, to learn which destinations they look for. These counts are not linked to you or your device, and anything that looks like an email address or a phone number is removed from them.

2. Why we use it

• To create your account, sign you in and keep your account secure.
• To take your payment, deliver your eSIM and show it in My eSIMs.
• To check your phone before you pay.
• To send you messages about your orders and eSIMs, such as "your eSIM is ready", "data running low", "plan ending soon", a finished top-up or a refund, by notification, by email or in the app's inbox.
• To help you when you contact us, and to handle refunds.
• To keep financial records, solve payment problems and meet our legal duties.
• To send you offers and news, unless you switch them off (section 6).

We do not use your data for advertising.

3. Who receives it

We share with each service only what it needs to do its job for us.

• eSIM suppliers (eSIM Go, Zendit, TripoSIM and eSIM Access), to buy your eSIM, read its usage and add top-ups. They receive our own order reference, the plan and the eSIM's identifier. They do not receive your name, email address or phone number. When the eSIM connects abroad, the partner networks handle that connection as any mobile network does.
• Payment providers (the one you choose at checkout, for example FIB or QiCard). They receive the order reference and the amount. You enter your card or wallet details with them, not with us. They send us back the payer's name and account number or a masked card number.
• Sign-in services. When you sign in with your phone number, the app sends the number to Firebase Authentication (Google) so that it can send you a code. When you sign in with Google or Apple, we check the sign-in with them; we do not send them your data.
• Notifications. Firebase Cloud Messaging (Google) receives your notification token and the message, to deliver it.
• Email. An email delivery service receives your email address and the message, to send your eSIM, receipts and account emails.
• Hosting and storage. The providers that run our servers, our database and our backups store data on our behalf.
• Our team's alerts. When an order needs attention, our on-call team receives an alert with the order reference and the amount, never your name, email address or phone number.
• Authorities, when the law requires us to share data.

What the app sends to Google directly. Three things go from the app to Google, and we never receive them: an ID that Firebase gives each installation of the app, delivery statistics for notifications, and anti-abuse checks (reCAPTCHA and Play Integrity) during phone sign-in.

Outside Iraq. Some of these services, including Google (Firebase), Apple and eSIM Go, process data outside Iraq.

4. The app on your phone

• Internet and network status: to connect, and to show you when you are offline.
• Notifications: for messages about your orders, and for offers. You can turn notifications off in your phone's settings.
• Face ID or fingerprint: to protect your eSIM details in the app. The check happens on your phone; we never receive your face or fingerprint data.
• Camera and photos (iPhone): only for your profile photo. On Android, the app uses the system photo picker and needs no permission. Your profile photo stays on your phone and is never uploaded.
• The app can copy text to your clipboard, such as an activation code, but it never reads the clipboard.
• The app never reads an advertising ID, your location or your contacts.

5. The website

The website uses only the cookies and browser storage it needs to work: to keep you signed in, to remember your language and currency, and to keep a checkout you have started. It uses no advertising or analytics cookies.

6. Offers and notifications

• Messages about your orders and eSIMs are part of the service. You cannot switch them off in the app's settings, but you can turn off notifications for the app on your phone.
• We may send you offers and news, of four kinds: promotions, loyalty rewards, product news and travel ideas. For each kind, you can choose whether and how we send it, in your notification settings in Profile.

7. How long we keep it

• Your account: until you delete it.
• Orders, payments and eSIM records: kept after you delete your account, without your name, because they are financial records we need for accounting, refunds and disputes. Support messages about an order are kept with that order.
• Sign-in sessions and codes: deleted when you sign out, when they expire, or when you delete your account.
• Messages we receive from payment providers and suppliers about your order: deleted after 90 days. The order itself keeps the payment reference, the amount and the dates.
• Purchases made through a travel agency: kept with the agency's order records.

8. Deleting your account

You can delete your account at any time in Profile. When you do:

• we delete the links to your Google and Apple sign-in, your sessions, your notification tokens and your favourite countries;
• we remove your name, phone number and password, and replace your email address with an anonymous one, so that you can sign up again with it later;
• we remove the payer's name and account number from your orders;
• we keep your order history (amounts, dates, references and eSIM details) without your name, because it is a financial record.

Please note:

• You cannot delete your account while an order is still being paid, delivered or refunded. Wait until it is finished, then try again.
• Deleting your account does not delete what other services keep under their own rules, such as Google (Firebase) or the payment provider you used.
• eSIMs already installed keep working until they expire, but you will no longer see them in the app. Deleting your account does not give you a refund.

9. Your requests

• You can see and change your details in Profile.
• To ask for a copy of your data, to correct something, or with any question about your data, contact our support team. There is no automatic download: our team handles these requests by hand.
• If a travel agency sold you your eSIM, the agency gave us your name, your phone number and, if given, your email address, so that it can hand your eSIM over to you (on a printed voucher, by WhatsApp, or by an email we send when the agency asks). We do not contact you on our own. To change or remove these details, ask the agency that sold you the eSIM.

10. Keeping your data safe

• Data between your phone or browser and our servers travels encrypted.
• Passwords are stored only as hashes. Card details never reach us.
• eSIM details are hidden in our logs, and our staff see them only when their role allows it.

11. Children

KurdistanEsim is for people aged 18 and over. Younger people need permission from a parent or guardian.

12. Changes to this policy

We may update this policy. The date of the latest update is shown with it.

13. Contact us

For any question about your data, use the support contacts on our Help page or in the app.