Privacy privacy

The controller of personal data collected via the website soraesim.com is soraesim, publisher of the eSIM data plan sales service, reachable at support@soraesim.com — Paris, France.

1. Data we collect

1.1 Account data

• First and last name (if provided)
• Email address
• Password (stored hashed, never in plain text)
• Login history and session identifier

1.2 Order and eSIM data

• Order number, selected plan, destination, data volume, and duration
• eSIM installation / activation status
• Technical identifiers needed to issue the eSIM profile (QR code / activation data provided by our wholesale partner eSIM Access)

1.3 Payment

Payments are processed by STRIPE. soraesim does not store the full credit card number. We receive transaction information from Paddle (amount, currency, status, payment ID) needed for billing and support.

1.4 Support and communication

• Content of emails sent to support@soraesim.com
• Order number and technical details useful for troubleshooting (device model, OS, screenshots you may provide)

1.5 Technical data

• IP address, browser type, pages viewed, timestamps
• Cookies and local storage required for the site to function (see our Cookies policy)

2. Purposes and legal bases

Audience or advertising tools (Google Analytics, Google Ads, Meta) are enabled only after you consent, via the cookie banner.

3. Recipients and processors

Your data is accessible only to authorized soraesim personnel and strictly necessary providers:

• Paddle — payment processing
• eSIM Access — provisioning of eSIM profiles and partner network access
• Hosting / infrastructure — hosting of the website and the database
• Email provider — sending transactional messages

These providers act on our instructions and under appropriate confidentiality / security commitments. No personal data is sold.

4. Transfers outside the EU

Some providers (including STRIPE or the eSIM partner) may process data outside the European Union. In that case, appropriate safeguards are put in place (European Commission Standard Contractual Clauses, or equivalent recognized mechanisms).

5. Retention periods

• Account : for the duration of use, then deletion or anonymization on request, subject to legal obligations
• Orders and billing : up to 10 years (accounting obligations)
• Support : for the duration of ticket handling + a maximum of 3 years for quality monitoring / disputes
• Technical logs : for the limited period required for security (in practice a few months)
• Session cookies : for the duration of the session or as specified in the Cookies policy

6. Security

We apply appropriate technical and organizational measures: HTTPS, password hashing, access control, payments handled by Paddle, and restricted access to order data.

7. Your rights (GDPR)

In accordance with Regulation (EU) 2016/679, you have the following rights:

• Right of access, rectification, and erasure
• Right to restriction of processing and to data portability
• Right to object (including to processing based on legitimate interest)
• Right to withdraw your consent where processing depends on it (e.g. non-essential cookies, where applicable)
• Right to lodge a complaint with the CNIL (www.cnil.fr)

To exercise your rights, write to support@soraesim.com stating your account email address and, if possible, your order number. We reply within one month.

8. Data relating to minors

The soraesim service is intended for adults or persons with legal capacity to contract. If you are under 15, the purchase must be made with the consent of the holder of parental authority.

9. Amendments

This policy may be updated to reflect changes to the service or to applicable law. The date at the top of the page is authoritative. In the event of a material change, a notice may be displayed on the site or sent by email.