# Privacy policy What Veela collects when you visit, chat or buy a travel eSIM, why, who processes it, how long we keep it, and your rights in each country. # Privacy policy Privacy policy What we collect when you visit veela.io, talk to the assistant or buy an eSIM, why, who helps us process it, how long we keep it, and your rights. Last updated: November 11, 2026 ## Who we are Veela (“we”) sells travel eSIMs at veela.io. For any privacy question or request, write to [contact@veela.io](mailto:contact@veela.io). ## What we collect, and why What | Why | Kept | **Orders**: email, plan, amount, currency, country, payment reference, eSIM identifiers (ICCID, activation code), partner code if any | To deliver your eSIM, support you, handle refunds, pay partner commissions, keep tax records (contract, legal obligation) | As long as tax law requires, up to 10 years | **Account**: email, name if you give it, language, sign-in sessions, passkeys (public keys only) | To let you sign in and manage your eSIMs (contract) | Until you delete the account | **Usage of your eSIM**: data used and remaining, status, as reported by the network | To show usage, warn you before it runs out, and troubleshoot (contract) | Up to 2 years after the plan ends | **Conversations**: chat and voice questions (transcribed; audio isn't stored), emails, questionnaire answers | To answer you and improve answers (legitimate interest; contract when it's about an order) | Chats without a ticket: 90 days. Tickets, emails and questionnaires: 3 years | **Visits**: pages viewed, time on page, referring site, approximate location (country, region, city) and network name, device type. No raw IP address: only a keyed hash | To understand which pages help and to spot abuse (legitimate interest) | 13 months | We don't sell personal data, don't use advertising trackers and don't use third-party analytics. Visitors in the EU/EEA, the UK and Switzerland, and browsers sending Global Privacy Control, get a visit identifier that changes every day and is not stored on their device. Everyone else gets a random identifier kept in the browser's local storage, which you can clear at any time. ## Who processes data for us - **Cloudflare**: hosting, database, the AI models behind the assistant and voice transcription, email routing. - **Stripe**: card, Apple Pay and Google Pay payments, receipts. - **payOS**: VietQR bank transfers, for payments in Vietnam. - **Our eSIM supplier**: issues the eSIM profile and reports usage. It receives the order reference, not your name. - **Our email provider**: sends sign-in codes and order emails. These providers may process data outside your country, including in the United States, Singapore and Hong Kong. Where the law requires, we rely on standard contractual clauses or your consent. ## Your rights You can ask for a copy of your data, its correction or deletion, object to processing based on legitimate interest, and withdraw a consent at any time (it doesn't affect what was done before). Write to contact@veela.io from the address concerned. We answer within one month at most, sooner where local law requires. ## Country-specific information ### European Union, EEA and Switzerland (GDPR, FADP) The legal bases are listed in the table above. You can complain to your data protection authority. Transfers outside the EEA use the European Commission's standard contractual clauses. ### United Kingdom (UK GDPR) Same rights as above; you can complain to the Information Commissioner's Office (ICO). Transfers use the UK International Data Transfer Addendum. ### United States We don't sell or share personal information for cross-context behavioural advertising, and we honour Global Privacy Control. Residents of California and other states with privacy laws can exercise access, deletion and correction rights by writing to contact@veela.io; we won't discriminate against you for doing so. ### Canada and Quebec Our privacy contact is the person reachable at contact@veela.io. Quebec residents may also request information about automated decisions; none of our decisions about you are fully automated. ### Mexico and Latin America You can exercise ARCO rights (access, rectification, cancellation, opposition) by writing to contact@veela.io. ### Australia We handle personal information under the Australian Privacy Principles. You can complain to the OAIC if you aren't satisfied with our answer. ### Vietnam We process personal data with your explicit consent, given at checkout or when you send a request, under the Personal Data Protection Law (Law 91/2025/QH15). Your data may be transferred abroad to the providers listed above; we keep the transfer impact assessment the law requires. You can withdraw consent or ask for deletion at contact@veela.io. ### Mainland China We ask for your separate consent before transferring personal information outside mainland China, as required by the Personal Information Protection Law. You can ask how to exercise your rights with the overseas recipients at contact@veela.io. ### Japan Under the APPI, we ask for your consent before providing personal information to providers in other countries. Information about their countries' protection systems is available on request at contact@veela.io. ### South Korea Under PIPA we list separately what we collect, why, and how long we keep it (table above), ask your consent for transfer abroad, and ask separately for marketing consent, which is optional. ## Children Veela isn't for children under 16 without a parent's involvement. Parents buying for a child should use their own email. ## Changes When this policy changes, we update the date above, and signed-in customers are asked to accept material changes.