Japan
South Korea
Thailand
United States
China
France
Singapore
United Kingdom
Privacy policy
Privacy policy
What we collect when you visit veela.io, talk to the assistant or buy an eSIM, why, who helps us process it, how long we keep it, and your rights.
Last updated: November 11, 2026
Who we are
Veela (“we”) sells travel eSIMs at veela.io. For any privacy question or request, write to [email protected].
What we collect, and why
| What | Why | Kept |
|---|---|---|
| Orders: email, plan, amount, currency, country, payment reference, eSIM identifiers (ICCID, activation code), partner code if any | To deliver your eSIM, support you, handle refunds, pay partner commissions, keep tax records (contract, legal obligation) | As long as tax law requires, up to 10 years |
| Account: email, name if you give it, language, sign-in sessions, passkeys (public keys only) | To let you sign in and manage your eSIMs (contract) | Until you delete the account |
| Usage of your eSIM: data used and remaining, status, as reported by the network | To show usage, warn you before it runs out, and troubleshoot (contract) | Up to 2 years after the plan ends |
| Conversations: chat and voice questions (transcribed; audio isn't stored), emails, questionnaire answers | To answer you and improve answers (legitimate interest; contract when it's about an order) | Chats without a ticket: 90 days. Tickets, emails and questionnaires: 3 years |
| Visits: pages viewed, time on page, referring site, approximate location (country, region, city) and network name, device type. No raw IP address: only a keyed hash | To understand which pages help and to spot abuse (legitimate interest) | 13 months |
We don't sell personal data, don't use advertising trackers and don't use third-party analytics. Visitors in the EU/EEA, the UK and Switzerland, and browsers sending Global Privacy Control, get a visit identifier that changes every day and is not stored on their device. Everyone else gets a random identifier kept in the browser's local storage, which you can clear at any time.
Who processes data for us
- Cloudflare: hosting, database, the AI models behind the assistant and voice transcription, email routing.
- Stripe: card, Apple Pay and Google Pay payments, receipts.
- payOS: VietQR bank transfers, for payments in Vietnam.
- Our eSIM supplier: issues the eSIM profile and reports usage. It receives the order reference, not your name.
- Our email provider: sends sign-in codes and order emails.
These providers may process data outside your country, including in the United States, Singapore and Hong Kong. Where the law requires, we rely on standard contractual clauses or your consent.
Your rights
You can ask for a copy of your data, its correction or deletion, object to processing based on legitimate interest, and withdraw a consent at any time (it doesn't affect what was done before). Write to [email protected] from the address concerned. We answer within one month at most, sooner where local law requires.
Country-specific information
European Union, EEA and Switzerland (GDPR, FADP)
The legal bases are listed in the table above. You can complain to your data protection authority. Transfers outside the EEA use the European Commission's standard contractual clauses.
United Kingdom (UK GDPR)
Same rights as above; you can complain to the Information Commissioner's Office (ICO). Transfers use the UK International Data Transfer Addendum.
United States
We don't sell or share personal information for cross-context behavioural advertising, and we honour Global Privacy Control. Residents of California and other states with privacy laws can exercise access, deletion and correction rights by writing to [email protected]; we won't discriminate against you for doing so.
Canada and Quebec
Our privacy contact is the person reachable at [email protected]. Quebec residents may also request information about automated decisions; none of our decisions about you are fully automated.
Mexico and Latin America
You can exercise ARCO rights (access, rectification, cancellation, opposition) by writing to [email protected].
Australia
We handle personal information under the Australian Privacy Principles. You can complain to the OAIC if you aren't satisfied with our answer.
Vietnam
We process personal data with your explicit consent, given at checkout or when you send a request, under the Personal Data Protection Law (Law 91/2025/QH15). Your data may be transferred abroad to the providers listed above; we keep the transfer impact assessment the law requires. You can withdraw consent or ask for deletion at [email protected].
Mainland China
We ask for your separate consent before transferring personal information outside mainland China, as required by the Personal Information Protection Law. You can ask how to exercise your rights with the overseas recipients at [email protected].
Japan
Under the APPI, we ask for your consent before providing personal information to providers in other countries. Information about their countries' protection systems is available on request at [email protected].
South Korea
Under PIPA we list separately what we collect, why, and how long we keep it (table above), ask your consent for transfer abroad, and ask separately for marketing consent, which is optional.
Children
Veela isn't for children under 16 without a parent's involvement. Parents buying for a child should use their own email.
Changes
When this policy changes, we update the date above, and signed-in customers are asked to accept material changes.