Privacy policy
Last updated: 23 October 2026
This policy explains what personal data esimlounge.com collects, why, who receives it and what your rights are.
Who is responsible
The data controller is RFLKT SAS, trading as Reflekt Lab and as eSIM Lounge. Registered office: 161 avenue Thiers, 33100 Bordeaux, France. Registration: 913 330 007 R.C.S. Bordeaux. For anything about your data, write to support@esimlounge.com.
What we collect, and why
When you buy an eSIM. Your email address, the plan you chose, the price and the date. We use it to take your payment, issue your eSIM, email it to you and help you if something goes wrong. We also keep the payment references Stripe gives us, the details of the eSIM issued to you, whether you are on an iPhone or an Android phone when your browser tells us, and the website or campaign that brought you to us. We never receive your card number. Legal basis: performing our contract with you, and our legal duty to keep accounting records.
When you ask to be told when a destination opens. Your email address, the destination and the date. We use it to send you that one email. Legal basis: your consent, which you give by ticking the box on the form.
When you ask for the welcome offer. Your email address, the date, where on the site you asked, and whether and when you ticked "Also send me travel tips and offers". We use the address to give you 10% off your first eSIM at checkout and to send you one email confirming it; if a checkout of yours ends before payment, we may send you that one email instead. Only if you ticked the box may we later send you travel tips and offers, and every such email will let you stop them. Legal basis: your request for the offer, and your consent for the tips and offers.
When you write to us. Your message and your email address, to answer you. Legal basis: our legitimate interest in answering you, or our contract with you when it is about an order.
When you browse. Your IP address, to block abuse: we count requests per address for at most one hour, and we do not store the address with your order or your alert. Legal basis: our legitimate interest in keeping the site secure.
Analytics. On esimlounge.com we measure how the site is used: which pages are visited, which buttons are clicked, how visitors arrive. We use PostHog, hosted in the European Union, which we reach through our own server. It stores an anonymous visitor identifier in a cookie and in your browser's local storage. We do not send your email address to it. Legal basis: our legitimate interest in understanding how the site is used. You can turn it off for your browser just below.
We measure your visits in this browser.
We do not measure your visits in this browser.
Your choice is saved in this browser only. In another browser, on another device or after you clear your cookies, we have no way to know you turned it off, so measuring starts again and you need to turn it off again here.
Who receives your data
We share it only with the companies that run part of the service for us, under contracts that oblige them to protect it:
- Stripe, for payments.
- Twilio SendGrid, which sends our emails, including your eSIM.
- Google Cloud, which hosts the site and its database in its Paris region.
- PostHog, for analytics.
- Sentry, which receives technical error reports. We remove email addresses, IP addresses and cookies from them first.
Our eSIM supplier does not receive your name or email address.
We do not sell your data.
Transfers outside the European Union
Stripe, Twilio SendGrid, Google (for Google Cloud) and Sentry are based in, or may process data in, the United States. These transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
How long we keep it
- Orders: 10 years from the order, as French law requires for accounting records.
- Launch alerts: until we have sent the one email you asked for, or until you ask us to delete it.
- Welcome offers: until you ask us to delete it, or withdraw your consent to tips and offers.
- Messages to support: for as long as we need to answer you, and at most 3 years after your last message.
- IP addresses used against abuse: at most one hour.
- Analytics: at most 25 months.
Your rights
You can ask us to access, correct or delete your data, to restrict or object to how we use it, or to send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to support@esimlounge.com. We answer within one month.
If you think we have not respected your rights, you can complain to the CNIL, the French data protection authority, at cnil.fr.
Your order page
The link to your order page works without a password, so anyone who has it can see your eSIM details. Keep it private, like a password.
Changes to this policy
We may update this policy. The date at the top shows the last change.