Privacy policy
Last updated
In short
We collect the email address you buy with, your order history, and — if you consent — anonymous analytics. We do not sell your data. We can see how much data an eSIM has used, but not what you did with it.
Who is responsible
[Company legal name] is the data controller for personal data collected through Roamly. Questions and requests: support@kqord.com.
What we collect, and why
Only what an order needs, plus what you choose to give us.
- Email address — to deliver your eSIM and its receipt. Required: there is nowhere else for a purchase to go.
- Order and eSIM records — what you bought, when, for how much, and the profile issued. Kept as a financial record.
- Account details, if you create an account — your name, if you give one, and your language and currency preferences.
- Payment metadata — the last four digits and card brand as reported by Stripe. Card numbers never reach our servers.
- Technical logs — IP address and browser, for security, fraud prevention and rate limiting.
- Device signals — when you register, a fingerprint computed by your browser (a hash, not personal content); when you pay, the same fingerprint with your timezone, languages, screen size and IP address. Used only to detect payment fraud, such as a payment from a device other than the one the account was registered on, stolen cards or VPN-masked locations.
- Analytics — only if you consent, and never linked to your name or address.
What we can see about your usage
We receive from the network the total amount of data an eSIM has used, and whether it is active, expired or depleted. That is all. We do not receive and cannot see the sites you visit, the apps you use, your messages, or your location.
Legal bases
Under the GDPR we rely on: performance of a contract, for everything needed to sell and deliver an eSIM; legal obligation, for tax and accounting records; legitimate interests, for security, fraud prevention and keeping the service running; and consent, for analytics, advertising and marketing email.
Where we rely on consent you can withdraw it at any time, and withdrawing is as easy as giving it.
Who we share it with
Only the parties needed to fulfil your order, each acting under contract and only for that purpose.
- Our eSIM supplier, to issue the profile you bought.
- Stripe, to take the payment.
- Our order and payment management system, and ipapi.is, which checks the IP address used at checkout for VPN, proxy or hosting use — for fraud prevention only.
- Our email provider, to deliver the QR code and receipts.
- Our hosting and infrastructure providers.
- Analytics and advertising platforms — only if you consented.
- Authorities, where the law requires it.
Where your data is held
Our servers are in the European Union. Some processors — payment, email, analytics — may process data outside it, under the safeguards the GDPR requires, such as standard contractual clauses.
How long we keep it
Order and payment records are kept for as long as tax and accounting law requires, typically several years, and cannot be deleted on request before then — this is why closing an account does not erase your invoices.
Account details are kept until you ask us to delete them. Technical logs are kept for a short period. Analytics data follows the retention set on the platform.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete what we are not legally required to keep, object to processing based on legitimate interests, and withdraw consent. Write to us and we will respond within one month.
If you are not satisfied with our answer, you can complain to your national data protection authority.
Children
This service is not intended for children under 16. We do not knowingly collect their data.