Privacy Policy

AirtoSim ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. It applies to all users of the AirtoSim website, mobile applications and services.

1. Data we collect

Data you provide directly

• Account information: email address, password (hashed), full name, country, preferred currency, language
• Identity verification (when required): proof of identity (passport, ID card, driver's license), proof of address — only collected when AML/KYC requires it
• Payment information: processed by our PCI-DSS-compliant payment partners (Stripe, PayPal). We never store full card numbers — only a tokenized reference
• Transaction details: recipient phone numbers, top-up amounts, currencies, timestamps
• Customer support: any messages, screenshots or files you send when requesting help

Data we collect automatically

• Device information: IP address, browser type, operating system, device identifiers
• Usage data: pages visited, features used, time on page, referrer URL
• Cookies & similar: we use cookies to keep you logged in, remember your language preference, and measure traffic

2. How we use your data

We process personal data for the following purposes:

• Provide the Service: account management, processing top-up transactions, sending receipts
• Comply with legal obligations: AML, fraud prevention, tax reporting, response to lawful authority requests
• Improve the Service: analytics on aggregate usage, A/B testing of features, debugging
• Communicate with you: transactional emails (receipts, password reset), service announcements, customer support replies
• Marketing (with consent): newsletters, promotional offers — only if you have opted in

3. Legal basis (GDPR / UK GDPR)

We process your personal data based on:

• Contract performance: to deliver the top-ups you request
• Legal obligation: for AML/KYC, tax and fraud reporting
• Legitimate interest: to secure the platform and improve our services
• Consent: for marketing communications and non-essential cookies

4. Sharing your data

We share data only with the following categories of recipients:

• Mobile network operators & aggregators: recipient phone number and amount, required to deliver the top-up
• Payment processors: tokenized payment data (Stripe, PayPal, etc.)
• Cloud and infrastructure providers: AWS, Google Cloud — under data-processing agreements
• Fraud prevention partners: MaxMind minFraud and similar services to detect fraudulent transactions
• Legal authorities: only when legally compelled (court order, regulator request)

We do not sell your personal data to third parties.

5. International transfers

Your data may be transferred to and processed in countries outside the EU/EEA, including the United States, where some of our infrastructure providers operate. When we transfer data outside the EU/EEA, we use European Commission Standard Contractual Clauses or other approved safeguards.

6. Data retention

We retain personal data only as long as necessary:

• Account data: for the lifetime of your account, plus up to 5 years after closure for legal/regulatory compliance
• Transaction records: retained for 5-10 years to comply with AML and tax obligations
• Support tickets: retained for 2 years
• Marketing preferences: until you opt out or your account is closed

7. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") — subject to our legal retention obligations
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent for marketing or non-essential cookies at any time
• Lodge a complaint with your local data protection authority (e.g. CNIL in France, ICO in the UK, BfDI in Germany)

To exercise these rights, email privacy@airtosim.com with a description of your request. We will respond within 30 days.

8. Cookies

We use the following types of cookies:

• Essential cookies: required to operate the site (session, authentication, language). Cannot be disabled.
• Analytics cookies: help us understand site usage. Disabled by default in EU/EEA; enabled with consent only.
• Marketing cookies: used only with explicit opt-in consent.

You can manage cookie preferences anytime in your browser settings or via the cookie banner shown on your first visit.

9. Security

We protect your data with industry-standard measures: HTTPS/TLS encryption in transit, encrypted storage at rest, access control, audit logs, and regular security audits. Despite these measures, no system is 100% secure. If we ever detect a breach affecting your personal data, we will notify you and the relevant authorities within 72 hours, as required by GDPR.

10. Children

AirtoSim is not intended for users under 18. We do not knowingly collect data from minors. If we learn we have collected data from someone under 18, we will delete it promptly.

11. Changes to this Policy

We may update this Privacy Policy as our practices evolve. Material changes will be communicated by email or in-app notification at least 30 days before they take effect.

12. Contact us

For any privacy-related question or concern, contact our Data Protection Officer at privacy@airtosim.com.