Etilion

Privacy policy

Last updated: 2 November 2026

We process the minimum data needed to sell and deliver your eSIM and to protect you and us from fraud. We never see or store your card details.

1. Data controller

  • Owner: Ignacio Bausa Edo
  • Tax ID (NIF): 29213467V
  • Registered address: Calle Cofrentes, 1, 46010 Valencia (España)
  • Email: info@etilion.com

2. Data we process

  • Order data: email, plan purchased, amount, currency, date and language.
  • eSIM data: identifier (ICCID), activation codes and, if you check it, usage data provided by the operator.
  • Payment data: processed by PayPal. We only receive the method used, the payer's country and the 3-D Secure result; never your card number.
  • Technical and security data: IP address, approximate country, browser and an anonymous device identifier (technical cookie) used to detect fraud.
  • Help assistant conversations: what you write in the chat and its replies, to help you and, if you ask, pass your case to a person.

3. Purposes and legal bases

  • Selling and delivering your eSIM, emailing installation details and answering your questions: performance of a contract (GDPR art. 6.1.b).
  • Preventing payment fraud and protecting the service: legitimate interest (art. 6.1.f).
  • Detecting and fixing technical errors: legitimate interest. Error reports exclude your email, cookies and form contents.
  • Tax and accounting obligations: legal obligation (art. 6.1.c).

We do not use your data for advertising and never sell it.

4. Automated decisions

To stop stolen cards, an automated system assesses the risk of each payment (for example, too many attempts from one device). It may hold an order for review or reject it, in which case we refund you in full. You can ask for a person to review the decision and give your view by writing to info@etilion.com.

5. Who we share data with

  • PayPal (Europe) S.à r.l. et Cie, S.C.A., to process the payment, as an independent controller of that data.
  • Vercel (hosting; server functions in Frankfurt), Neon (database in Frankfurt), Resend (email delivery, Ireland) and Sentry (error monitoring, EU), as processors.
  • Anthropic (United States), which provides the help assistant's AI, as a processor. It does not use the conversations to train its models.
  • eSIM operators and wholesalers: they only receive technical order references, never your name or email.

Where a provider accesses data from outside the European Economic Area, it does so under GDPR safeguards (EU standard contractual clauses or adequacy frameworks).

6. Retention

  • Order and billing data: 6 years, as required by commercial and tax law.
  • Security and anti-fraud logs: 12 months.
  • Technical error reports: up to 90 days.
  • Help assistant conversations: 90 days.

7. Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to info@etilion.com. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

8. Cookies

We only use strictly necessary cookies. See the Cookie policy.