Privacy policy

This policy explains what personal data we collect when you visit esimamericas.com or buy an eSIM, how we use and protect it, what browser storage we use and what you can ask of us. We are a Hong Kong company. If you are in the European Union, the GDPR applies to your data because we offer our services to people in the EU and monitor how the site is used (Article 3(2) GDPR). Section 9 also sets out the rights you have in Brazil and Argentina.

1. Who we are

esimamericas.com is run by Roamworks Limited 漫行有限公司, Unit 1603, 16th Floor, The L. Plaza, 367 - 375 Queen’s Road Central, Sheung Wan, Hong Kong, Hong Kong Business Registration number 81414783. We are the controller of the personal data described here.

For every question, request or complaint about personal data, write to contact@esimamericas.com.

2. What we collect

When you visit esimamericas.com

• Your browser sends technical data with every request: IP address, browser and device type, the page asked for and the page you came from. Cloudflare, which delivers our pages, uses it to deliver them and to protect the site from attacks.

How we measure

• The pages you view, the site and campaign that brought you, the plans you select and when you start a checkout, your browser and device type, and an approximate location worked out from your IP address. We measure this with Umami, which we run on our own server: it sets no cookies and does not store your IP address, no analytics company receives this, we keep no visitor id, and nothing is stored on your device for it.

When you buy an eSIM

• What you enter on the Stripe payment page: email address, name on the card, billing country and, for some cards, postal code. Card numbers are handled by Stripe and never reach us.
• Order data: the plan, price, currency, language, time of purchase, the version of the Terms of sale you accepted, and the eSIM delivered to you (its ICCID and activation code, which we store encrypted).
• Where the order came from: the campaign parameters of the link that brought you (for example utm_source), the site you came from and the page you bought on. We keep these with the order to know which channels bring customers.
• When your order page is opened, we record the time and a one-way hash of the IP address, to protect your eSIM code against misuse.
• When you start a checkout, your IP address is used to limit repeated attempts. It is not stored for that purpose.

When you write to us

• Your email address, name and the content of your message.

3. Why we use it and on what legal basis

Purpose	Legal basis under the GDPR
Selling and delivering the eSIM, support and refunds	Performance of the contract with you (Article 6(1)(b))
Accounting and tax records	Our legal obligations (Article 6(1)(c))
Preventing fraud, securing payments and eSIM codes, protecting the site	Our legitimate interest in a secure shop (Article 6(1)(f))
Answering your questions	Our legitimate interest in answering you, or steps before a contract you ask for (Article 6(1)(f) or (b))
Measuring how the website is used and which pages and channels bring visitors and customers	Our legitimate interest in understanding how the website is used (Article 6(1)(f))

We use personal data only for these purposes. We do not sell personal data. The checkout reminders are described below.

4. Automated decisions

Stripe screens payments for fraud with automated risk scoring. A payment judged high risk may be blocked or may need an extra check such as 3D Secure. If you think a payment was blocked by mistake, write to us and a person will look at it.

5. Who receives your data

• Stripe processes payments and screens them for fraud, under its privacy policy at stripe.com/privacy.
• Cloudflare, Inc. delivers and protects the website.
• Resend delivers our support replies and the checkout reminders described below.
• Our hosting provider runs the website, the order system and our Umami on servers in the European Union.
• The company we buy eSIM profiles from receives no personal data from us. We buy eSIM profiles without sending your details.
• Our accountants and legal advisers, and public authorities where the law requires it.

6. Transfers outside the European Economic Area

The website, the order system and our analytics run on servers in the European Union. Our team in Hong Kong can access order data to provide support and operate the store. Stripe, Cloudflare and Resend may process data in the United States and other countries. The European Commission has not adopted an adequacy decision for Hong Kong. When personal data leaves the European Economic Area, we rely on the safeguards the GDPR provides: the European Commission's standard contractual clauses, or an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards that apply.

7. How long we keep it

We keep personal data only as long as we need it for the purposes above or as the law requires:

• Order and payment records, including the encrypted eSIM details: as long as accounting and tax law requires, normally 5 years from the end of the year of purchase.
• Order page access records (hashed IP address): 12 months.
• Email correspondence: as long as needed to handle the matter and related claims, and no longer than 3 years after it is closed.
• Analytics data: no longer than 14 months.

8. Cookies and browser storage

The site sets no cookies of its own. Our analytics is cookieless and needs no consent, and we run no advertising pixels.

• Cloudflare may set strictly necessary security cookies to tell people from automated traffic.
• The Stripe payment page, which Stripe serves, uses its own cookies for payment processing and fraud prevention; see stripe.com/legal/cookies-policy.

Your browser also keeps, for itself only: whether you turned down our offer of a page in your language (esimamericas:language-hint), in local storage; and, while the tab is open, the campaign parameters and the site that brought you (esimamericas:attribution) and the currency your prices were shown in (esimamericas-buyer-currency-v1 and, when a currency link is used, esimamericas-qa-currency), in session storage, so the checkout can record which channel brought the buyer and the price you saw. Closing the tab clears the session storage, and none of it leaves your browser.

Your cart (americas-cart-v1) is kept in local storage too: only the plans you added and how many of each, never a price, a name or anything else about you. It stays until you empty it or an order paid from it is complete. When you open the cart, the ids of the plans in it are sent to our site so it can show today's names and prices; how many of each you want reaches us only when you go to payment from it. While a cart is being paid, the tab keeps a copy of it in session storage under the same name, so the order page can empty the cart once the order is paid.

You can delete or block cookies in your browser settings; blocking Stripe's cookies may prevent payment.

9. Your rights

Under the GDPR you can ask us:

• for access to the personal data we hold about you and a copy of it;
• to correct data that is wrong or incomplete;
• to delete data we no longer need or have no basis to keep;
• to restrict how we use your data while a question about it is settled;
• for the data you gave us in a portable format;
• to stop using data we process on the basis of our legitimate interests (you can object).

Write to contact@esimamericas.com. We reply within one month, or tell you within that time why we need longer.

You can complain to the supervisory authority of the EU country where you live or work, or where the alleged infringement took place.

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) also gives you the right to confirm that we process your data, to access, correct and delete it, and to withdraw consent where consent is the basis, and you can contact the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd).

If you are in Argentina, Law 25.326 also gives you rights of access, rectification and suppression, and you can contact the Agencia de Acceso a la Información Pública (AAIP, argentina.gob.ar/aaip).

You can use all of these rights the same way, by writing to us.

10. Security

Card data stays with Stripe. eSIM activation codes are encrypted when stored. Access to the order system is restricted, and every time an eSIM code is shown to an administrator it is logged. The site is served only over HTTPS. If a data breach is likely to put your rights at risk, we tell the supervisory authority within 72 hours and, where the risk is high, you as well, as the GDPR requires.

The public pages never ask for an activation code, and we never want a real eSIM QR code sent to us in a chat tool.

11. Children

esimamericas.com is not aimed at children under 16, and we do not knowingly collect their data.

12. Changes

When our processing changes, we update this policy.

Checkout reminders

If you give your email address at checkout and do not finish the order, we may send one reminder about that order and, a day later, one email with a 10% single-use code. We rely on our legitimate interest in helping you complete the purchase you started (Article 6(1)(f) GDPR); you can unsubscribe from either email at any time. This section replaces any earlier statement that we do not send marketing messages.

Last updated: 1 November 2026.