Privacy Policy

1. Information we collect

Account information. Your email address and a password that we store only as a salted hash. If you sign in with Google or Apple, we receive your email address and the provider’s account identifier instead of a password.

Order information. The plans you buy, quantity, order status, the amount charged in US dollars, the approximate local-currency amount shown at checkout, the Stripe checkout and payment identifiers, and the name of any coupon used.

eSIM information. To deliver and support your eSIM we store the supplier order number, the activation code and its QR image, the profile status, the ICCID, the APN settings, the activation and expiry dates, and data usage reported by the supplier. If you enter your device EID, or we detect your device model and operating system during installation, we store that too.

Mobile network data. When you use the eSIM, the mobile network operator your device connects to processes the eSIM’s identifiers (ICCID and EID), your device model, your data usage and the other connection data it needs to provide its telecom service. Each operator handles this as described in section 4.

Points, coupons and top-ups. Your points balance and a ledger of every credit, spend and adjustment, with the order it relates to. The coupons you register, when you registered them and the order you used them on. For each top-up: the eSIM it was added to, the package, the data and days added, the amount charged, its status and the Stripe identifiers.

Emails we send you. We keep a record that the emails described in section 3 were sent, but we do not keep a copy of their content ourselves. Cloudflare, which sends our emails, may keep the content of a sent email for up to about 7 days for delivery and troubleshooting before deleting it. The eSIM-ready email contains your plan, order number, a link to your QR code and your activation code, so anyone with access to your mailbox can install the eSIM.

Payment information. Payments are processed by Stripe. You enter your card and billing details on Stripe’s checkout page. We never receive or store your full card number, expiry date or security code.

Technical information. Your IP address and browser signals are processed by Cloudflare Turnstile when you sign in or register, to block automated abuse. We keep a log of events on your order (for example issuance, retries, refunds) for support and troubleshooting.

2. Cookies

We use one cookie, patime_session, to keep you signed in. It is signed, HTTP-only, restricted to same-site requests, sent only over HTTPS, and expires after 14 days. It is strictly necessary for the service and cannot be turned off while you are signed in.

Cloudflare Turnstile may set its own short-lived cookie to verify that a request is not automated. We do not use advertising, profiling or third-party analytics cookies.

3. Why we use your data

• To perform our contract with you: creating your account, issuing the eSIM, sending the eSIM-ready email with your QR code and activation code, adding top-ups, showing your orders, handling refunds, and providing support.
• To run points and coupons: crediting points when you choose them instead of a card refund, applying points and coupons at checkout, and returning any balance as described in the Terms of Service.
• To send service emails: verifying your email address, and delivering your eSIM. These are part of the service and are not marketing.
• For our legitimate interests: preventing fraud and automated abuse, keeping the service secure, and diagnosing faults.
• To comply with legal obligations: tax, accounting, consumer-protection and record-keeping requirements.
• With your consent, where consent is required — for example optional communications. You can withdraw consent at any time.

4. Who we share it with

We share personal data only with the providers needed to run the service, and only for that purpose:

• Stripe — payment processing, refunds and fraud prevention. Stripe processes personal data on our instructions for payment processing, and as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations. For those purposes, Stripe’s privacy policy applies.
• Cloudflare — hosting, database and file storage, delivery of our emails (email verification and the eSIM-ready email), and bot protection.
• Google or Apple — only if you choose to sign in with them.

Mobile network operators are not on this list because we do not send them your data. When your device uses the eSIM, it connects directly to the network of an operator such as Singtel, IIJmio, CMLink, SK Telecom, LG Uplus, Airtel, NTT Docomo, Verizon, AT&T or Three. Which operator depends on the plan and the destination, and the plan page shows the networks. To provide the mobile service, that operator processes your eSIM’s identifiers (ICCID and EID), your device model, your data usage and other connection data itself, under the law of its country.

To issue an eSIM, we send our eSIM supplier (a mobile network operator) an internal transaction number and the plan details needed for issuance. We do not send it your name or email address. Order and profile identifiers can still identify you when combined with other information, so we protect them as personal data under the law that applies.

We do not sell your personal data and we do not share it for advertising. We disclose it to authorities only where the law requires us to.

5. International transfers

We operate from the United States, and your data is processed there and in the other locations our providers use. If you are outside the United States, this means your data is transferred across borders.

Where data is kept for the long term and where it is processed briefly are different things. Our data is kept in the database and file storage systems that Cloudflare provides, in the storage region Cloudflare assigns. Stripe keeps payment data in its own systems, mainly in the United States. Requests to the service, our emails and short-lived caches may pass through, or be held briefly in, Cloudflare data centres worldwide.

Where the law of your country requires safeguards for these transfers, we rely on the data processing terms that Stripe and Cloudflare include in their contracts with us, which limit them to processing data on our instructions and require security measures. Sections 14 and 15 give the details required in Korea and Japan.

6. How long we keep it

• Account information: until your account is deleted at your request.
• Order, payment, points, coupon and top-up records: 5 years from the date of the transaction.
• Records of complaints and disputes: 3 years.
• Installation codes (activation code and QR image): 30 days after the plan ends, or after the eSIM is cancelled, refunded or expires without being installed. After that they no longer work and are not needed.
• Other eSIM information (ICCID, profile status, activation and expiry dates, data usage, EID and device details): 1 year after the plan ends, for support, supplier settlement and disputes.
• Security and abuse-prevention logs: 90 days.

We delete data within 30 days after its retention period ends. When you ask us to delete your data, we delete it without delay, except records we must keep by law, which we keep only for the period above and use only for that legal purpose. Deleted data may remain in encrypted backups for up to 30 more days before it is overwritten.

7. Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent. To exercise any of these, contact abuse@elysia-root.com. We may need to verify your identity first.

Deleting your account does not remove records we must keep by law, such as invoices.

8. United States state privacy rights

We are a United States company. Several states — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — give their residents privacy rights. This section explains how we handle them.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. Because we do not sell or share, an opt-out preference signal such as Global Privacy Control has nothing to opt out of.

In the twelve months before the date above, we collected the categories of personal information described in section 1: identifiers (such as your email address and IP address), customer records (such as order history and amounts paid), commercial information (the plans and top-ups you bought, and your points and coupons), internet activity needed to operate and secure the service, and account credentials, which California treats as sensitive personal information. We collect these from you, from your use of the service, and from our payment provider and eSIM supplier. We use them only for the purposes in section 3 and disclose them only to the providers in section 4. We do not use sensitive personal information to infer characteristics about you.

Depending on your state, you may have the right to know what we collect, to access a copy, to correct it, to delete it, to obtain it in a portable form, to opt out of sale, sharing, targeted advertising or certain profiling, and to limit the use of sensitive personal information. We will not discriminate against you for exercising any of these rights.

To make a request, email abuse@elysia-root.com. We will verify your identity against the information on your account before we act, and we will respond within the time your state allows — 45 days in most states, which we may extend once where the law permits. An authorised agent may act for you if you give them written permission and we can verify it.

If we decline your request, you may appeal by replying to our decision with the word “appeal”. We will review it and tell you the outcome and our reasons. If we deny the appeal, you may contact your state attorney general.

9. Wherever you live

We are a company established in the United States and we provide the service internationally. Depending on where you live and where you use the service, the privacy and consumer protection laws of that place may apply to us. We respect the rights those laws give you, and nothing in this policy limits a right the law guarantees you. We also apply the rights in section 7 to everyone who asks.

Send any request or question to abuse@elysia-root.com. If the law of your country gives you the right to complain to a data protection authority, you can do that as well.

10. Security

Passwords are stored as salted PBKDF2 hashes and are never kept in readable form. Traffic is served over HTTPS, session cookies are signed, and access to order data is restricted to the account that placed the order and to authorised administrators. No system is perfectly secure, but we work to protect your data and will notify you if a breach affects you and the law requires it.

11. Children

The service is not directed at children. We do not knowingly collect personal information from anyone under 13, as defined by the US Children’s Online Privacy Protection Act, or under 16 where local law sets that age. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes

We may update this policy. We will change the date at the top, and for significant changes we will give notice in the service before they take effect.

13. Contact

Elysia Root L.C., a Wyoming limited liability company (Wyoming Filing ID 2022-001141349). Mailing address: 533, 2FL, 447 Broadway, New York, NY, United States. Privacy enquiries: abuse@elysia-root.com.

14. For users in Korea

This section sets out the information required by the Personal Information Protection Act of the Republic of Korea. Where it is more specific than the rest of this policy, it applies to users in Korea.

Items, purposes and retention

The personal information we process and why are described in sections 1 and 3, and how long we keep each item in section 6. The 5-year period for order, payment, points, coupon and top-up records and the 3-year period for complaint and dispute records follow the Act on the Consumer Protection in Electronic Commerce, etc.

Provision to third parties and outsourcing

We do not provide your personal information to third parties, except where the law requires it. We entrust processing to Cloudflare, and to Stripe for payment processing, under contracts that limit them to providing that service to us. For some purposes, such as fraud prevention and meeting its own legal obligations, Stripe processes data as an independent controller under its own privacy policy. Mobile network operators are not our processors: when your device uses the eSIM, it connects to the operator’s network directly, and the operator processes the connection data itself, as the provider of the telecom service, under the law of its country.

Transfer of personal information overseas

We are based in the United States, and your personal information is collected and stored outside Korea. We entrust its processing and storage overseas because it is necessary to conclude and perform our contract with you, and we disclose the details below in this policy as Article 28-8(1)(iii) of the Personal Information Protection Act permits. The overseas recipients are:

• Stripe, Inc. (United States) — Items we send: order number, plan name and amount. Items you enter directly on Stripe’s checkout page, which Stripe collects and we never receive: email address, card and billing details. Purpose: payment processing and refunds (on our instructions), and fraud prevention and Stripe’s own legal obligations (as an independent controller). When and how: at checkout, over an encrypted connection. Retention: as long as Stripe must keep payment records by law, and no longer than 5 years for our records in section 6. Contact: stripe.com/privacy.
• Cloudflare, Inc. (United States) — Items: the information in section 1 except card details, and the content of the emails we send you. Purpose: hosting, database and file storage, email delivery and bot protection. Where: our database and QR image files are kept in one storage region Cloudflare assigns; requests and emails pass through Cloudflare data centres worldwide, and cached plan data and short-lived request counters may be copied worldwide (see section 5). When and how: whenever you use the service, over an encrypted connection. Retention: for the periods in section 6; Cloudflare may keep the content of sent emails for up to about 7 days. Contact: cloudflare.com/privacypolicy.
• For information only — this is not processing we entrust to anyone: mobile network operators such as Singtel (Singapore), IIJmio and NTT Docomo (Japan), CMLink (China Mobile International), SK Telecom and LG Uplus (Korea), Airtel (India), Verizon and AT&T (United States) and Three process the following when your device connects to them — Items: the eSIM’s identifiers (ICCID and EID), device model, data usage, and the other connection data each operator needs to provide its telecom service. Purpose: providing mobile data service in your destination. When and how: whenever your device connects to the operator’s network with the eSIM. Retention: as set by each operator under the law of its country. The operator and its country depend on the plan and destination you choose, and the plan page shows the networks.

You may refuse the overseas transfer by not creating an account, or by asking us at abuse@elysia-root.com to delete your account. Because the service runs entirely on these providers, we cannot then sell or deliver an eSIM to you. Records we must keep by law are kept as described in section 6.

Destruction procedure and method

We review stored data regularly and delete personal information whose retention period has ended, or without delay once you ask us to delete it. Records we must keep by law are kept separately from other data and used only for that purpose until their period ends. Personal information is held only in electronic form and is deleted from our database in a way that cannot be restored. We do not keep paper records.

Security measures

Our technical and administrative safeguards are described in section 10, including hashed passwords, encrypted connections and access limited to authorised administrators.

Your rights and how to exercise them

You may ask to access, correct or delete your personal information or to suspend its processing, and you may withdraw consent, by emailing abuse@elysia-root.com. A legal representative or a person you have authorised may make the request for you. We will respond without delay after verifying the identity of the person making the request.

Privacy officer

Our privacy officer is Sangmin Lee (이상민), Representative. Contact: abuse@elysia-root.com.

Remedies

If you need help with a privacy complaint, you may also contact:

• Personal Information Dispute Mediation Committee — www.kopico.go.kr, 1833-6972
• Personal Information Infringement Report Center (KISA) — privacy.kisa.or.kr, 118
• Supreme Prosecutors’ Office — www.spo.go.kr, 1301
• Korean National Police Agency Cyber Bureau — ecrm.police.go.kr, 182

15. For users in Japan

This section sets out the matters we make public under the Act on the Protection of Personal Information of Japan.

Business operator

Elysia Root L.C., a Wyoming limited liability company (Wyoming Filing ID 2022-001141349). Mailing address: 533, 2FL, 447 Broadway, New York, NY, United States. Representative: Sangmin Lee (李尙珉).

Purposes of use

We use personal information only for the purposes in section 3.

Security control measures

• Organisational: access to personal data is limited to the representative and authorised administrators, and order data is visible only to the account that placed the order.
• Technical: passwords are stored as salted hashes, connections are encrypted with HTTPS, session cookies are signed, and automated abuse is blocked with Cloudflare Turnstile.
• Physical: we keep no paper records and run no servers of our own. Data is held in Cloudflare’s data centres, which are physically secured by Cloudflare.
• Understanding the external environment: personal data is stored in the United States and in the countries where Cloudflare operates data centres. We take our security measures with an understanding of the personal data protection system of the United States.

Provision to third parties in foreign countries

We entrust the handling of personal data to Stripe, Inc. and Cloudflare, Inc., both in the United States. Stripe handles data on our instructions for payment processing, and for some purposes, such as fraud prevention and meeting its own legal obligations, handles it as an independent business operator under its own privacy policy. Under the Act, entrusting data to a recipient in a foreign country is a provision to a third party in a foreign country. We provide it on the basis that each of these recipients maintains systems equivalent to the measures the Act requires: their data processing terms, which form part of their contracts with us, limit them to handling data on our instructions and for our purposes, and require security measures and notice of breaches. We check those terms and how each recipient carries them out when we start using a provider, whenever the terms change, and in any case at least once a year, and we keep a record of each check. On request, we will tell you about those measures and how we confirm they are being carried out.

The United States has no comprehensive federal personal data protection law; protection is provided by sector-specific federal laws and by state laws such as the California Consumer Privacy Act.

Mobile network operators — such as Singtel, IIJmio, CMLink, SK Telecom, LG Uplus, Airtel, NTT Docomo, Verizon, AT&T or Three — are not recipients we provide data to. When your device uses the eSIM, it connects to the operator’s network directly, and the operator processes the eSIM’s identifiers (ICCID and EID), your device model, your data usage and other connection data itself, as the provider of the telecom service, under the law of the country where it is based.

Requests for disclosure, correction or suspension of use

You may ask us to notify you of the purposes of use, or to disclose, correct, add to, delete, stop using or stop providing to third parties your retained personal data, or to disclose records of provision to third parties, by emailing abuse@elysia-root.com. We will verify your identity against the information on your account and reply by email. A legal representative or a person you have authorised may make the request for you.

Enquiries and complaints

Send enquiries and complaints about how we handle personal information to abuse@elysia-root.com.