Privacy Policy

Last updated: September 10, 2026

Vaya Con Data (“we”, “our”, “us”) is a Canadian sole proprietorship operating under the laws of Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit vayacondata.com, use our order lookup tool, or purchase our eSIM products (including plans with real mobile phone numbers).

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada. Where you are located in the European Economic Area (EEA), UK, or other jurisdictions with similar laws, we also aim to comply with the General Data Protection Regulation (GDPR) and equivalent rules as applicable.

1. Information We Collect

We collect the following categories of information in connection with eSIM sales and website use:

• Account and order information: email address, name (if provided), device type/operating system, selected plan, quantity, coupon or referral codes, order reference or Stripe session ID.
• Payment information: Processed entirely by Stripe. We do not receive or store full credit card numbers, CVV, or bank details.
• eSIM provisioning and activation data: ICCID, SIM ID (sim_id), QR code payload, universal links, SMDP address, and other metadata required to activate and install your eSIM.
• Real phone numbers (Voice + SMS plans only): When you purchase a Voice+SMS plan, we assign and deliver a real mobile phone number (French +33 MSISDN) through our wholesale partner and the Orange network. This includes the phone number itself and associated identifiers (e.g. MSISDN).
• Technical and usage data: IP address, browser/user-agent, device information, timestamps, and logs of checkout, webhook events, and order lookups (used for security, fraud prevention, and troubleshooting).
• Support and communications data: Information you provide when contacting us by email, the order lookup tool, or live chat (tawk.to), including messages and any order details shared.
• Analytics and tracking data: Events collected by Google Analytics (page views, conversions) and Meta Pixel (for advertising and remarketing).

2. How We Collect Information

• Directly from you during checkout and account interactions.
• From Stripe (webhooks for successful payments).
• From our eSIM wholesale provider (eSIMCard / portal.esimcard.com) during provisioning — they return ICCID, phone number (for voice plans), QR codes, and activation details.
• Automatically through cookies, server logs, and analytics tools when you visit the site or use order lookup.

3. How We Use Your Information

• To process payments via Stripe and fulfill eSIM orders (including provisioning real phone numbers and delivering activation credentials).
• To send you order confirmation, fulfillment emails (containing phone number, ICCID, QR code, and installation instructions), and support responses.
• To allow you to look up past orders and activation details via our order-lookup tool.
• To query usage information from the provider using your sim_id/esim_id when you request support.
• To prevent fraud, abuse, chargebacks, and security incidents.
• To comply with tax, accounting, and legal obligations (including Canadian GST/HST requirements).
• To improve the website, product, and customer experience.
• For limited analytics and advertising (Google Analytics, Meta Pixel).

We do not sell your personal information. We do not access or store the content of calls or SMS messages — those are handled solely by the Orange network provider.

4. Sharing and Processors

We share personal information only with service providers under contract who help us operate the business, or when required by law. Key processors include:

• Stripe, Inc. — payment processing (PCI-DSS compliant). Located in the United States.
• eSIMCard (portal.esimcard.com) and underlying network operators (including Orange) — eSIM provisioning, phone number assignment, and delivery of real mobile numbers for Voice+SMS plans.
• Cloudflare — DNS, security, and infrastructure.
• tawk.to — optional live chat support.
• Google — analytics (Google Analytics).
• Meta Platforms — advertising pixel and conversion tracking.
• Email infrastructure providers for sending transactional emails (containing sensitive activation data).

When we share data with eSIMCard / Orange for provisioning, this is necessary to deliver the eSIM and real phone number you purchased.

5. International Data Transfers

Your information is primarily processed in Canada. It may be transferred to or accessed from:

• The United States (Stripe payments, some analytics).
• The European Union / France (Orange network for real phone numbers and eSIM provisioning).

We use reputable providers and rely on appropriate safeguards (such as Standard Contractual Clauses where required under GDPR).

6. Retention of Information

We retain information for as long as necessary to:

• Fulfill your order and provide ongoing support (typically 90+ days for activation details).
• Comply with tax, accounting, and legal record-keeping requirements in Canada (financial records are generally retained for at least 6–7 years).
• Resolve disputes, prevent fraud, or enforce our agreements.

After these periods, we delete or anonymize personal information where feasible.

7. Security

We use reasonable technical and organizational measures, including:

• HTTPS/TLS encryption for the website and API.
• Stripe-hosted checkout (we never see full payment card data).
• Restricted access to order data and provider APIs.
• Server-side processing of sensitive provisioning data.

Important note on eSIM activation data: Phone numbers, QR codes, and links are delivered to you by email. Email is not always secure — we recommend protecting your email account and not sharing these details.

No system is 100% secure. We continuously work to reduce risks.

8. Your Privacy Rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Request correction or deletion of your data.
• Request restriction or portability of your data.
• Withdraw consent (where processing is based on consent).
• Object to certain processing (e.g., analytics).

To exercise these rights, email [email protected]. We may need to verify your identity. Note that we may retain certain data where required by law (tax records, fraud prevention) or to complete an ongoing transaction.

Canadian residents can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) if they have concerns.

EEA/UK residents can contact their local supervisory authority.

9. Cookies and Tracking Technologies

We use:

• Essential cookies for basic site functionality and security.
• Google Analytics for understanding site usage and improving the experience.
• Meta Pixel for advertising measurement and remarketing.
• tawk.to cookies for the optional live chat feature.

You can manage cookies through your browser settings. Disabling certain cookies may affect features like chat or accurate analytics.

10. Children’s Privacy

Our services are not directed to children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change. Continued use of the site or services after changes constitutes acceptance of the updated policy.

12. Contact Us

Vaya Con Data
Privacy inquiries: [email protected]
X: 𝕏 @VayaConData
Business address available upon request for privacy matters.