ESIM FREE · PRIVACY
Privacy, in plain language.
Updated 30 September 2026
Who we are, the data controller
Esim Free (esimfree.io) sells data-only unlimited-5G eSIM plans for use in the United Arab Emirates over the E& and du networks. The data controller for personal data processed through this website is ESIM FREE, a limited liability company organized in the State of the United States. Where this policy says ‘we’, ‘us’ or ‘our’, it means ESIM FREE acting as controller, deciding why and how your personal data is processed.
If you have any question about how your data is handled, contact our privacy point of contact at support@esimfree.io, the same team that answers support messages, normally within 24 hours..
What we collect, account and contact details
When you create an account, start a subscription, log in, or contact us, we collect the details you give us: your name, email address, and phone number where provided, plus your login credentials in hashed form and your language and communication preferences. We use this data to identify your account, deliver your eSIM, send receipts and service messages, and answer you when you write in. Providing accurate contact details matters, because QR delivery, renewal notices and support replies all travel to the address you give us.
If you use the referral program, we also process the referral link or code you used or shared, the resulting referral credit (5% to each side, matched to the referred plan’s duration, uncapped), and the linkage between referrer and referred accounts so credits apply correctly. We do not collect government identity numbers, and we ask you never to send us passwords, full card numbers, or identity documents by email or chat.
What we collect, checkout, billing and payment data
When you subscribe, we process your chosen plan term, 1 month at 440 AED, 6 months at 2,040 AED, or 12 months at 2,880 AED, all priced in UAE dirhams (AED) with no VAT charged on the basis that this is a US digital supply. Your subscription renews automatically on each anniversary minus 2 days unless you cancel; cancelling stops future renewals and your service stays on until the end of the paid period, and each of these events generates the corresponding billing record.
Card payments are processed by Stripe acting as our payment processor. We receive confirmation of payment, the amount, currency, timestamps, the last four digits and card brand for receipt and fraud-prevention purposes, and your saved payment-method reference for renewals, we never see or store your full card number or CVC. Failed renewal charges are retried for 48 hours before service consequences follow, and each retry generates the usual payment records. Stripe processes your payment data under its own terms and privacy policy as well as ours.
What we collect, eSIM delivery and service data
To provision your plan we process the eSIM profile issued to you, including the personal QR code, its activation and installation status, the associated mobile-network identifiers generated by our connectivity partners on the E& and du networks, and the plan term and service dates attached to that profile. This data is what turns a checkout into working data on your phone, and it is what support checks when setup stalls, so keeping it accurate is part of delivering the service at all.
We also keep service-event records such as QR issuance, renewal dates computed on the anniversary-minus-2-days rule, cancellation requests and their effective end-of-period dates, and refund-related notes reflecting our position that monthly plans are refundable only before the eSIM QR is issued while longer terms are considered pro-rata at the company’s discretion.
What we collect, support communications
Every message you send to support@esimfree.io, through the contact page, or through site chat, including attachments you choose to add such as screenshots of error screens, is stored as a support ticket together with your name, email address, account reference, and our replies. We use these records to resolve your issue, to follow up where a fix needs checking, and to learn from recurring problems such as installation failures or renewal queries. Our support team aims to reply within 24 hours.
If you contact us about someone else (for example, buying for a family member or asking on a colleague’s behalf), we process the details you share about that person only to handle your request, and you confirm you have their permission to share them. Support records are kept for up to 24 months from the last message in the thread, then deleted or anonymized, unless a longer hold is needed for an unresolved dispute or legal obligation.
What we collect, technical, device and cookie data
When you visit esimfree.io we automatically receive basic technical data needed to run and secure the site: IP address, device type and model characteristics relevant to eSIM compatibility, operating system and browser type and version, pages visited and actions such as starting checkout, and coarse location derived from IP for fraud screening and language defaults. This data is logged by our hosting infrastructure and security tooling, and it is kept on short retention windows described below.
We use cookies and similar storage as described in our Cookies page: strictly necessary cookies keep login, checkout and consent choice working, while any optional measurement stays off unless you accept it through the cookie banner. Cookie identifiers and consent records (what you chose and when) are personal data and are handled under this policy; the per-cookie detail of name, purpose and expiry lives on the Cookies page rather than being duplicated here.
Purposes and lawful bases
We process your data only for defined purposes, each tied to a lawful basis under the EU/UK General Data Protection Regulation (GDPR) where it applies to you. Performance of a contract covers creating and administering your account, provisioning and renewing your eSIM plan on its anniversary-minus-2-days cycle, processing payments through Stripe, issuing QR codes and providing support, without this processing we simply cannot deliver the service you bought.
Consent covers optional cookies and measurement where you accept them, and any marketing emails you separately opt into; you may withdraw consent at any time with effect for the future, without affecting processing already carried out. Legitimate interests cover keeping the site secure, preventing fraud and abuse, troubleshooting compatibility, improving our plans and pages, handling disputes and chargebacks, and keeping records our business reasonably needs, in each case balanced against your rights and limited to what is necessary. Legal obligations cover tax and accounting records and responses to lawful authority requests.
Sharing and sub-processors
We share personal data only with parties who need it to run the service. Stripe processes payment data to charge subscriptions and renewals. Resend delivers transactional emails such as receipts, QR delivery messages and renewal notices. Our hosting provider stores the website, account and order data. Connectivity and eSIM-profile partners on the E& and du networks receive the identifiers needed to issue and activate your profile. Each acts under contractual data-protection terms limiting use to our instructions.
We disclose data to competent authorities only where the law requires it, for example under a valid court order or tax inquiry. In a business reorganization such as a merger or asset sale, account and order records may transfer to the successor subject to the same protections. We do not sell personal data, we do not share it with advertising brokers, and we do not let processors use it for their own marketing.
International transfers
Because the seller is a US company serving customers in the UAE, your data moves across borders by design: it is stored and administered in the United States, processed by staff and systems there, and transmitted to the UAE to provision your eSIM on local networks. Support, billing and hosting operations may each involve the US, the UAE, and any country where our named sub-processors operate infrastructure, so a single account routinely touches more than one jurisdiction.
Where GDPR applies to a transfer outside the European Economic Area or the UK, we rely on an appropriate safeguard, such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, together with supplementary measures where needed.
Retention schedule
We keep each category of data only as long as it is needed. Account records (name, email, login reference, preferences) last for the life of your account plus a reasonable wind-down period after closure for receipts and dispute handling. Order and billing records, plan term, amounts in AED, invoices, renewal and cancellation history, are kept while your account exists and then as tax and accounting law requires.
Support tickets and their attachments are kept up to 24 months from the last message. eSIM delivery records (QR issuance and installation status) follow the billing-record schedule because they evidence what was delivered. Technical logs and security records are kept for a short window, typically up to 12 months, unless an active incident requires longer. Cookie-consent records are kept to prove your choice for as long as the underlying processing continues. When a period expires we delete or anonymize the data unless a law or an unresolved claim requires a defined hold.
Security measures
We protect personal data with measures proportionate to a small digital service handling payments through a certified processor: encrypted connections (TLS) for the site and checkout, credential hashing rather than plaintext password storage, least-privilege access so only staff who need account or support data can open it, network and application logging to detect abuse, and reliance on Stripe’s PCI DSS handling for card data so full card numbers never touch our servers.
No system is perfectly secure, so we also plan for failure: we monitor for unauthorized access, restrict administrative tooling, and will notify you and the relevant authority of a personal-data breach where the law requires it. You help by keeping your login secret, using a unique password, keeping your device’s eSIM profile private, and telling us at support@esimfree.io promptly if you suspect misuse of your account.
Your rights, including GDPR rights for EU/UK visitors
You hold rights over your data. Under GDPR, visitors from the EU and the UK have the rights of access (a copy of what we hold), rectification (fixing inaccuracies), erasure (deletion where the conditions are met), restriction (pausing certain uses), portability (receiving your account and order data in a usable format), objection (including to legitimate-interest processing, with reasons specific to your situation), and freedom from solely automated decisions with legal or similarly significant effect, we do not make such decisions about your service. You may also withdraw any consent at any time, and equivalent rights may apply under other laws where you live.
To exercise any right, email support@esimfree.io from the address tied to your account and describe your request; we reply within 24 hours as a first response and complete verified requests within one month (extendable for complex cases as the law allows). We may need to verify your identity before releasing or deleting data. Deleting your account data ends active service immediately because the eSIM profile and billing records that run it are removed or anonymized, subject only to records the law obliges us to keep.
Children’s data
Esim Free plans are intended for adults who can enter a paid subscription and operate an eSIM-capable device. We do not knowingly collect personal data from children, and we ask that nobody under the age of 18, or under the age of majority where they live if higher, creates an account or contacts support without a parent or guardian.
If we learn that a child’s data was provided without proper consent, we will delete it promptly once notified at support@esimfree.io, keeping only what is needed to record the deletion itself. Parents or guardians who believe a child has shared data with us should contact us so we can act.
Changes, contact and complaints
We may update this policy as the service, our processors, or the law change; the ‘Updated’ date at the top of this page will reflect the latest version, and material changes will be announced on the site or by email where appropriate. Continued use of the service after an update takes effect constitutes acceptance of the revised policy.
For any privacy question, request or complaint, contact ESIM FREE at support@esimfree.io, we aim to reply within 24 hours and to resolve complaints promptly. If you are in the EU or UK and remain dissatisfied, you may complain to your national supervisory authority (for example the authority of your habitual residence) or seek a remedy through the courts; we will cooperate with the authority concerned as required.
Questions about this page? Contact support, replies in less than 24 hours.