Privacy Policy
This policy explains what information we collect, how we use it, how long we keep it and the choices you have. Last updated 8 September 2026.
Who is responsible for your data
The organisation responsible for this site — the data controller, in the language of the GDPR — is HMK Inc., PO Box 77403, Markham, Ontario L3P 0C8, Canada. The same company publishes World eSIM Map.
To ask anything about this page, or to make any of the requests below, use the contact form. It reaches the people who run the site; there is no separate privacy desk.
Information we collect
When you place an order we collect your email address and order details, and your name and billing address if your payment method supplies them.
Your card number never reaches our servers — Stripe handles the card itself. Stripe does return a record of the payment, and we store that record: the card brand, the first six and last four digits, the expiry month and year, the issuing country, and Stripe’s own identifiers for the payment and the customer. We keep it to match payments to orders, to issue refunds, and to answer disputes.
When you use the contact form we keep your message and the order it relates to so we can help you.
We also keep a copy of every email we send you — the message itself and the delivery receipt from the mail provider. That is what lets us show, if a payment is ever disputed, that your eSIM really was delivered.
How we use your information
We use it to fulfil orders, deliver activation instructions, provide support, prevent fraud, and comply with legal obligations. We do not sell your information.
How long we keep it
- Orders, and the payment record described above. We do not delete these on a schedule. Canadian tax rules require business records to be kept for six years, and a card payment can be disputed months after the purchase.
- Copies of the emails we sent you. Kept for the same reason, for the same length of time.
- Support messages. Kept while the issue is open, and afterwards as a record of what was agreed.
- Analytics. Google Analytics is set to delete event-level data after 2 months — the shortest period Google offers — and user-level data after 14 months.
- Web server logs, which include IP addresses. Deleted after 14 days.
You can ask us to delete what we hold about you before those periods are up — see Your rights below. Where the law requires us to keep a record of a sale, we will tell you that rather than quietly keep it.
Cookies and analytics
We use essential cookies to operate the site: your cart, checkout, and email verification. These cannot be switched off.
We also use Google Analytics to understand how visitors use the site, and WooCommerce order attribution to record which channel an order came from. These are not essential.
Our Google Analytics property is linked to our Google Ads account, so that we can tell whether an ad led to a sale. On that link, the setting Google provides for advertising personalisation is turned off, and the property’s cross-device “Google Signals” feature is disabled. Those are switches on our side, and they are the ones Google documents as governing whether analytics data feeds advertising; what Google then does inside its own systems is answered by Google’s privacy policy, not by ours. We run no advertising cookies of our own, and we do not sell your data to anyone.
If you are in the EU, the EEA, the UK or Switzerland, we ask for your consent before any of this is set, and none of it is stored unless you accept. You can decline and the site works exactly the same. The one thing we store if you decline is a small cookie recording that choice, so that we do not ask you again. Elsewhere, including Canada and the United States, analytics runs by default and no consent bar is shown.
To turn analytics off at any time, wherever you are: set the etd_consent cookie in your browser to denied. We honour that value in every country, not only in the ones where we show the bar, and declining also deletes the analytics cookies already set. If the bar is shown where you are, deleting the cookie instead will make it ask you again. Blocking cookies for this site in your browser settings works too.
Third parties
We share information only with the service providers who help us operate, and only as far as they need it:
- Stripe — processes the payment and holds the card details.
- Cloudflare — site security, email delivery, and the bot check on the contact form.
- Google — analytics, as described above. Google may process this data outside your country.
The eSIM suppliers and network operators receive no personal data about you. Each eSIM is ordered with a plan code and our own order reference; your name and email address are never sent to them.
Your rights
Wherever you live, you can ask us to confirm what we hold about you, to give you a copy, to correct it, or to erase it. If you are in the EU, the EEA, the UK or Switzerland you can also ask us to restrict or object to its use, and to withdraw consent at any time. Under Canadian federal law (PIPEDA) you can ask for access to your information and challenge its accuracy.
Legal basis. For analytics: your consent in the EU, EEA, UK and Switzerland; legitimate interest elsewhere. For orders: performance of the contract with you, and our legal obligation to keep records of a sale.
Use the contact form for any of these. If you are not satisfied with our answer you can complain to your national data protection authority, or in Canada to the Office of the Privacy Commissioner.
Contact
Questions about this policy can be sent through the contact page. Written notice can be sent to HMK Inc. at the address above.