Privacy policy

1. Data controller

• Owner: Ignacio Bausa Edo
• Tax ID (NIF): 29213467V
• Registered address: Calle Cofrentes, 1, 46010 Valencia (España)
• Email: info@etilion.com
• Phone: +34 635 581 685

2. Data we process

• Order data: email, plan purchased, amount, currency, date and language.
• eSIM data: identifier (ICCID), activation codes and, if you check it, usage data provided by the operator.
• Payment data: processed by PayPal. We only receive the method used, the payer's country and the 3-D Secure result; never your card number.
• Technical and security data: IP address, approximate country, browser and an anonymous device identifier (technical cookie) used to detect fraud.
• Help assistant conversations: what you write in the chat and its replies, to help you and, if you ask, pass your case to a person.
• Etilion app: if you sign in with your email, one session per device (platform, language and currency) and, if you turn on notifications, the token Apple or Google assigns to your phone to deliver them. The app also uses a random installation ID to limit abuse of the assistant, and keeps your preferences and the orders you place without signing in on your phone.

We need your email to sell and deliver your eSIM: without it we can't complete the purchase.

3. Purposes and legal bases

• Selling and delivering your eSIM, emailing installation details and answering your questions: performance of a contract (GDPR art. 6.1.b).
• Preventing payment fraud and protecting the service: legitimate interest (art. 6.1.f).
• Detecting and fixing technical errors: legitimate interest. Error reports exclude your email, cookies and form contents.
• Tax and accounting obligations: legal obligation (art. 6.1.c).

We do not use your data for advertising and never sell it.

4. Automated decisions

To stop stolen cards, an automated system assesses the risk of each payment (for example, too many attempts from one device). It may hold an order for review or reject it, in which case we refund you in full. You can ask for a person to review the decision and give your view by writing to info@etilion.com.

5. Who we share data with

• PayPal (Europe) S.à r.l. et Cie, S.C.A., to process the payment, as an independent controller of that data.
• Vercel (hosting; server functions in Frankfurt), Neon (database in Frankfurt), Resend (email delivery, Ireland) and Sentry (error monitoring, EU), as processors.
• Anthropic (United States), which provides the help assistant's AI, as a processor. It does not use the conversations to train its models.
• Expo (650 Industries, Inc., United States), which delivers the app's notifications through Apple and Google, as a processor.
• eSIM operators and wholesalers: they only receive technical order references, never your name or email.

Where a provider accesses data from outside the European Economic Area, it does so under GDPR safeguards (EU standard contractual clauses or adequacy frameworks).

6. Retention

• Order and billing data: 6 years, as required by commercial and tax law.
• Security and anti-fraud logs: 12 months.
• Technical error reports: up to 90 days.
• Help assistant conversations: 90 days.
• App sessions and notification tokens: until you sign out or delete your account, and at most 180 days.

7. Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to info@etilion.com. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

In the app you can delete your account from Settings: we sign you out on all your devices and delete the app's data; orders are kept for as long as the law requires.

8. Cookies

We only use strictly necessary cookies. See the Cookie policy.