Privacy policy

1. Controller and contact

This policy covers visiting MyTripSim, creating an account, purchasing, receiving an eSIM and obtaining support. YellowCat Enterprises LLC is responsible for the MyTripSim operations described here. Address: 1209 Mountain Road Pl NE, Albuquerque, New Mexico 87110, United States.

Contact hello@mytripsim.com for privacy requests. Describe your request and identify the email related to your account or purchase. Do not attach identity documents or full financial information unless a proportionate check is requested through an appropriate channel.

2. Information and sources

• Account information: email, first and last name you provide, authentication and session information. Passwords are handled by the authentication system; support does not need to know them.
• Purchases and recipients: purchaser and recipient email, plans, quantities, amounts, currency, references, payment and delivery status and optional marketing preferences. A purchaser may supply another person's email for delivery.
• Payment information: Stripe processes information entered into its payment interface, payment method and device information. MyTripSim receives the identifiers and status needed to manage an order; our own form does not receive the full card number or CVC.
• eSIM service information: profile and supplier identifiers, installation credentials, status, validity and available usage information. Connectivity providers and networks may process network and device information necessary for the service. This does not mean MyTripSim can access all traffic or browsing content.
• Support: messages, language, selected topic and authorized order, team responses and optional rating and comment. Avoid unnecessary sensitive or third-party information in free text.
• Technical information: server requests, IP addresses or derived identifiers, browser and infrastructure security information, session identifiers and storage explained in the cookie policy.

Information comes from you, a purchaser who names you as recipient, your use of the website and payment or connectivity providers necessary to process the service.

3. Purposes

We use necessary information to operate and protect accounts, carts and payments; check amounts and availability; issue and deliver eSIMs; show status and usage; provide support; and address complaints, incidents and refunds.

Limited information is also used to prevent fraud and abuse, secure access, keep transaction evidence and meet legal obligations. If you expressly opt in, your email may be used for MyTripSim news and offers. This is optional and does not condition a purchase.

Purchase information is not general permission for third-party advertising. A new incompatible purpose or new processing category requires the information and, where appropriate, legal basis or permission required by law.

With your optional consent, we measure destination views, cart additions, payment starts and confirmed purchases to improve our website. We use a random 30-minute session identifier and store only its HMAC in Supabase; events do not contain email, QR codes, installation credentials, full URLs or order references. A protected temporary order association allows payment attribution; it is removed upon withdrawal or session cleanup. These data are pseudonymous, not necessarily anonymous. Refuse or withdraw consent through “Privacy preferences” in the footer without affecting your purchase. We respect Do Not Track and Global Privacy Control. Sessions and events are retained for 30 days, with daily cleanup that may take up to 24 additional hours. We use no external advertising or analytics providers for this measurement. Abuse controls use separate hourly network-address hashes, without storing raw IP addresses in these tables. Those controls and withdrawal markers expire after one hour and 30 minutes respectively and are purged daily. Withdrawal removes the current session’s events and order association when the data service is available; it cannot by itself locate earlier unlinked sessions. Contact hello@mytripsim.com for other requests.

4. Legal grounds where applicable

Where the applicable law requires a legal basis, we distinguish performance of a contract or steps you request before contracting; legal obligations; legitimate security, fraud-prevention and claims-handling interests, subject to the appropriate assessment; and consent for optional processing that requires it.

Deletion requests or withdrawal of marketing consent do not remove legal retention requirements or cancel pending orders. Merely visiting the site is not consent to every form of processing.

5. Providers and disclosures

• Supabase provides authentication and databases for accounts, orders, eSIMs, support and optional statistics.
• Vercel hosts and delivers the website, runs the server and processes technical infrastructure logs.
• Stripe and payment participants process and authenticate payments and prevent fraud. Stripe's controller or processor role depends on the activity.
• eSIM Access and participating mobile networks prepare profiles and provide connectivity. Our current issuance request sends a plan code and transaction reference, not the recipient email in that request.
• Resend sends account, delivery and service emails. Delivery messages contain private installation information.
• Zoho receives and handles email sent to our support contact.
• OpenAI generates SIM responses as explained below.

Access is limited to the relevant function. Information may also be disclosed under a valid legal obligation, to handle a claim or to advisers under appropriate confidentiality duties. A request does not authorize disclosure of another person's order.

6. SIM and AI

When you message SIM, MyTripSim may send OpenAI your message, recent conversation and limited facts from an order you select after authorization checks. The selected topic provides conversational context.

The system filters certain sensitive patterns, but cannot guarantee detecting all private information. Do not send passwords, cards, QR or installation credentials. SIM has no tools to issue eSIMs, charge, cancel, refund or change orders; an AI answer is not confirmation of a transaction.

The integration requests no persistent response state through store:false. This does not mean zero provider retention: OpenAI may keep abuse-monitoring logs under its service terms and configuration. Its API documentation states that API data is not used for model training by default unless the customer opts to share it.

Answers may be incorrect. Human help and email support are available. SIM is not assigned final decisions on consumer rights, complaints or refunds.

7. Retention

• The guest-chat browser identifier lasts seven days. Closed guest conversations are removed from our system after thirty days without activity by the automated cleanup process. Backups may retain information until their technical replacement cycle completes.
• AI chat closes after ten minutes without messages. This does not erase its history or close pending human-support tickets.
• Account information is retained as needed for the relationship and requests. Order, payment and related evidence needed for tax, accounting, fraud prevention or claims is kept according to those needs and applicable legal periods.
• Account-linked support tickets and ratings are kept as needed to address and document the issue and responsibilities. We do not advertise a fixed automatic deletion period that the system does not apply.
• Withdrawing marketing permission stops that use; minimum suppression evidence may be kept to avoid adding you again improperly.

8. International processing

Infrastructure and providers may process data outside your country. Locations and safeguards depend on the service and operation concerned. Where additional transfer safeguards are required, the applicable mechanisms, such as adequacy decisions or contractual clauses where appropriate, apply. Ask hello@mytripsim.com about countries and relevant safeguards for your information. We do not offer hosting exclusively in your country of residence.

9. Choices and rights

Contact hello@mytripsim.com to request access, correction, deletion or information about your data. Depending on the law protecting you, you may also have objection, restriction, portability, consent-withdrawal and supervisory-authority complaint rights.

We make proportionate identity or authorization checks before releasing private information. Responses and deadlines follow applicable law. Where retention or another legal reason prevents part of a request, we will explain the reason and scope.

You may withdraw marketing permission and still receive messages strictly necessary for an account, delivery or complaint. Recipients may contact us about their own data even if another person placed the order.

10. Security, children and changes

We use access controls, separation of accounts, encrypted communications and limited interface disclosures. No system is infallible. Keep your delivery email, QR and account access private and report incidents to our contact.

The service is not directed to children under thirteen and we do not knowingly seek their information. Purchasers must have legal capacity or appropriate representative authorization. Contact us if a child may have provided information improperly so we can investigate and act under applicable law.

Material changes will carry a new date and version, with any additional notices or permissions required. Provider policies describe their own processing and do not replace MyTripSim's obligations.