1. Scope and Controller
This Privacy Policy applies to the Linko eSIM website, iOS/Android apps, and services relating to browsing, purchasing, payment confirmation, digital delivery, installation, activation, status and usage queries, top-ups, refunds, fraud prevention, and customer support (collectively, the “Services”). The controller/operator is 上海澜境联数字科技有限公司 (Shanghai Lanjinglian Digital Technology Co., Ltd.), registered at Room 1, 10th Floor, Building 1, No. 188 Changyi Road, Baoshan District, Shanghai, China. Privacy and data-rights requests may be sent to support@linkoesim.com.
2. Information We Process
We process information reasonably necessary for stated purposes, which may include: (a) account and identity data, such as email address, account identifiers, nickname, and Apple/Google sign-in identifiers only where those sign-in features are enabled; (b) order and eSIM data, including order number, SKU, destination, plan, validity, ICCID, eSIM status, activation status, remaining usage, top-up records, QR code, SM-DP+ address, activation code, and other required installation information; (c) payment and refund data, such as amount, currency, payment status, transaction identifiers, and refund status, while full card numbers, CVV codes, and payment-account passwords are ordinarily handled by payment providers and are not stored by Linko eSIM; (d) technical and security data, such as IP address, device type, operating system, app/browser version, request logs, security events, anti-fraud information, and diagnostic data; (e) support data voluntarily supplied by users, including screenshots, error messages, device model, system version, APN/network-selection information, location at country/region level, and communications; and (f) browser local/session storage used for language preferences, secure order access, and necessary session functions.
3. Sources
We primarily obtain data directly from users. We may also receive payment status and transaction identifiers from payment providers; eSIM status, ICCID, usage and technical status from eSIM infrastructure and network partners; and necessary request, security, or diagnostic information from infrastructure and security providers.
4. Purposes and Legal Bases
We process data to manage accounts; receive and fulfill orders; provision and deliver eSIMs; provide installation, status, usage and top-up functions; confirm payments and process refunds; provide customer support; prevent fraud and unauthorized access; secure accounts, transactions and systems; comply with accounting, tax, regulatory and consumer-protection obligations; and maintain service reliability. Where the GDPR or UK GDPR applies, our legal bases depend on the activity and may include performance of a contract, compliance with legal obligations, legitimate interests in securing the Services and preventing fraud, and consent where consent is legally required. Acceptance of these Terms is not treated as blanket consent for non-essential analytics, advertising tracking, sensitive permissions, or other processing that legally requires consent.
5. Service Providers and Recipients
Depending on the features actually enabled in production, recipients may include: (a) eSIM Access and its network partners for plan queries, provisioning, status synchronization and top-ups; (b) Cloudflare for website/CDN, Workers, database/edge infrastructure, security, email routing and, where enabled, AI-support infrastructure; (c) PayPal and any other payment provider actually enabled and shown at checkout; (d) Cloudflare email services or Resend for transactional order and delivery emails where configured; and (e) Apple/Google platform services only where the relevant app sign-in, push, or platform feature is actually enabled. Our public disclosures, Apple App Privacy answers, Google Play Data Safety answers, and production code/SDK behavior must remain aligned.
6. Sale, Sharing and Targeted Advertising
As of the last-updated date, the current website implementation does not deploy cross-site behavioral advertising, advertising pixels, or third-party advertising analytics SDKs. We do not sell personal information for monetary consideration and do not currently share personal information for cross-context behavioral advertising as those concepts are defined by applicable U.S. state privacy laws. If this changes, we will update notice and provide any legally required opt-out or consent mechanism before the relevant processing begins.
7. Device Permissions
We apply data minimization and least-privilege principles. The app should not request precise location, contacts, microphone, photo library, or other sensitive permissions unless a specific feature requires it and an appropriate just-in-time notice/permission request is provided. Refusal of a non-essential permission should not block unrelated core functionality.
8. Security
We use risk-appropriate technical and organizational safeguards, including HTTPS/TLS, access controls, authentication, privilege separation, security logging, incident monitoring, and secret management. Supplier API credentials, payment secrets, and other server-side credentials must not be embedded in public clients. QR codes, activation codes, order-access tokens and similar credentials are treated as sensitive business credentials and should not appear in public logs or repositories.
9. International Processing and Transfers
Users, Linko eSIM, cloud providers, payment providers, eSIM providers and mobile-network partners may be located in different jurisdictions. We arrange international processing only on an applicable lawful basis and use appropriate contractual, technical and organizational safeguards. Where GDPR Chapter V applies to a restricted transfer from the EEA, a valid mechanism must be in place before the transfer, such as an applicable adequacy decision, the European Commission Standard Contractual Clauses together with supplementary measures where appropriate, or another valid mechanism. Where UK GDPR restricted-transfer rules apply, an applicable UK IDTA, UK Addendum, adequacy arrangement or other valid mechanism will be used. This paragraph does not state that a contract or transfer tool that has not actually been executed is already in place.
10. Retention
We do not retain personal data indefinitely. Retention is determined by category and purpose: account data is generally retained until deletion or until no longer needed; order, payment, refund, accounting and tax records are retained according to applicable statutory requirements, limitation periods and dispute needs; security and anti-fraud logs are retained according to risk and investigation needs; support records are retained for the period reasonably needed to resolve service and potential disputes. Data that is no longer needed is deleted, anonymized, de-identified or restricted. Where applicable law requires a specific period or retention criterion to be disclosed, we will provide it in the relevant regional notice.
11. Your Rights
Depending on applicable law, you may have rights to access/know, correct, delete, restrict or object to processing, portability, withdraw consent, obtain a copy, delete your account, and exercise privacy rights without unlawful discrimination. Requests may be submitted through in-app settings, the account-deletion page, or support@linkoesim.com. We may reasonably verify identity. Where GDPR applies, you may complain to a competent data-protection authority in your place of habitual residence, place of work, or place of the alleged infringement. Where UK GDPR applies, you may complain to the UK Information Commissioner's Office (ICO).
12. U.S. State Privacy Supplement
Where a U.S. state privacy law applies to Linko eSIM, including the CCPA if its statutory applicability thresholds are met, residents may exercise the rights granted by that law, such as access/know, correction, deletion, portability/copy, opt-out of legally defined sale or sharing, and non-discrimination. The current service does not sell personal information for monetary consideration and is not configured for cross-context behavioral advertising. Where a state requires a different request method, timing, or appeal process, we will follow the applicable rule.
13. EEA and UK Representatives
Linko eSIM is established in China. If a particular EEA or UK offering triggers the legal requirement to appoint an Article 27/UK representative, Linko eSIM will complete the written appointment before carrying out the targeted processing subject to that requirement and will publish the representative’s name and contact details in this Policy or the regional privacy contact information. EEA/UK users may meanwhile contact support@linkoesim.com directly; that contact route does not replace a representative where appointment is legally mandatory.
14. Account Deletion
If the app permits account creation, users can initiate deletion in the app, and the Google Play version also provides an external web resource. Deletion removes or de-identifies account data that has no continuing lawful retention basis; freezing, disabling or hiding an account does not qualify as deletion. Payment, tax, fraud-prevention, security and dispute records may be retained only where and for as long as legally or reasonably necessary.
15. Children
The Services are not directed to children. We do not intentionally require children to provide information unrelated to the Services and will not rely solely on a child’s consent where local law requires parental authorization. If we learn that data was collected contrary to applicable age requirements, we will take reasonable steps to delete or restrict it.
16. Changes
We may update this Policy for business, technical, legal or platform-policy changes. Material changes will be communicated in a reasonable manner. Where a new use legally requires consent, we will obtain valid consent before that processing begins. We will not treat a silent privacy-policy update as consent to a materially incompatible new use of previously collected data.
