In short: we collect what we need to sell you a data plan and get it onto your phone: your name, contact details, billing address and order history. We never see or store your card number. We do not sell your data. Marketing email is opt-in only and you can stop it at any time.
1. Who we are
Sila eSIM is a service operated by Sila Global Ltd, a private limited company registered in England and Wales (company number 17209771), registered office Prime Apartments, 483 Green Lanes, London, United Kingdom, N13 4FG.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Sila Global Ltd is the data controller for the personal data described in this policy.
We are registered with the Information Commissioner's Office (ICO) as a data controller, under registration number ZC248831.
If you have any question about this policy or about how we handle your data, contact us at [email protected].
2. What we collect, and why
2.1 Information you give us
| What | When | Why we need it |
|---|---|---|
| Title (Mr, Mrs, Miss, Ms, Mx, Dr, or prefer not to say), first and last name | Creating an account | To identify you as our customer, on receipts, and for support |
| Email address | Creating an account | Signing in, sending your eSIM, receipts and service messages |
| Mobile number | Creating an account | Signing in, verifying it is really you, and contacting you about an order |
| Password | Creating an account | Securing your account. Stored only as a one-way hash. We never hold your actual password and cannot see it |
| Home address and billing address | Creating an account | Billing, tax and VAT location, and fraud prevention |
| Family member details (name, relationship, email, mobile, address) | Only if you add someone to your account | So an eSIM can be issued to them and their QR code sent to them directly. See section 4 |
| Flight number and date | Only if you use flight tracking | To show flight status and remind you to activate your eSIM before you travel |
| Reviews you write, and reviews you report | Only if you leave or report one | A review is shown to other customers alongside the plan you reviewed. A report, and the reason you chose, is seen only by us, to check the review |
| Refund requests: which plan, what went wrong, and what you tell us about it | Only if you ask for a refund | To check what happened and, if the fault was on our side, to refund you. We email you our answer |
| Feedback you send us: your name, an email address if you choose to give one, and what you tell us about your experience | Only if you fill in our feedback form | To improve Sila, and to reply to you if you ask us to. Your email address is optional and is used only for that. It is never shown to anyone else |
| Messages you send us from Help, in the app or on the website, and our replies | Only if you write to us | To answer you, and to keep the conversation in one place so you can read it again. We email you and notify the app when we reply |
| Agent applications: your business and trading name, company and VAT numbers, your name and role, contact email and phone, business address, country of tax residency, bank details, the currency you want to be paid in, and your typed signature with the time, IP address and browser it was signed from | Only if you apply to become a Sila agent | To assess your application, to form the agent agreement and keep evidence of who signed it, and to pay your commission. We also keep a record of each commission payment we make to you, with the receipt of the bank transfer |
| Marketing preference | Creating an account, or later in settings | To know whether you want to hear from us. Recorded with a timestamp so we can show what you agreed to |
2.2 Information created by using the service
| What | Why |
|---|---|
| Orders: what you bought, the price, currency, date, and any discount or credit applied | To fulfil the order, provide receipts, handle refunds, and meet our tax and accounting obligations |
| eSIM records: the ICCID, activation details and how much data has been used | To deliver the eSIM, show your remaining balance, and support you if it does not work |
| Account credit, your referral code, the people who joined with it, and your reward codes | To operate the rewards and referral programme |
| Device push token | Only if you allow notifications, to alert you when data runs low, when an eSIM is ready, when you arrive in a new country, or before a plan you have not started expires |
| Consent records | To prove what you agreed to and when, as the law requires of us |
| Technical logs | To keep the service running and secure. Passwords, tokens, API keys and full ICCIDs are automatically removed from our logs |
| The country you are using Sila from, and when you last used it | To understand where our customers are, to spot unusual account activity, and to decide which destinations and languages to invest in. Worked out as a COUNTRY only, from your phone's or browser's time zone setting, or from your internet connection when that is not available. We do not store your IP address, your city or anything more precise, and we never follow where you go |
| The country your eSIM is connected in, as our network partner reports it | To welcome you when you arrive somewhere new and tell you whether your plan works there, or how to add one that does. We keep only the latest country, replacing it each time you cross a border, so there is never a list of where you have been |
2.3 Payment information
We never receive, see or store your card number. Card payments are handled entirely by Stripe, who are certified to PCI-DSS Level 1. We receive only a payment reference and whether the payment succeeded.
2.4 What we do not collect
We do not track your movements. We record the COUNTRY you connect from and the country your eSIM is in, and nothing finer: not your city, not your GPS position, not your IP address, and never a trail of where you have been. The one exception to the IP address is signing the agent agreement: we keep the IP address and browser it was signed from, as evidence of the signature (section 2.1). Your phone is never asked for its location and the app has no location permission. We do not read, store or have any access to the content of your browsing, messages, or calls made over your eSIM. We do not buy personal data about you from third parties, and we do not build advertising profiles.
3. Our legal basis for using your data
| Purpose | Legal basis |
|---|---|
| Creating and running your account, selling and delivering eSIMs, support (including the messages you send us from Help), and answering refund requests | Performance of a contract with you |
| Sending marketing email | Consent: always optional, and you can withdraw it at any time |
| Keeping records of orders and payments | Legal obligation (UK tax and accounting law) |
| Preventing fraud and abuse, keeping the service secure, and improving it | Legitimate interests: balanced against your rights, using the least data necessary |
| Reading and acting on feedback you choose to send us | Legitimate interests: you gave it to us so we could improve the service. We only write back to you if you ticked the box saying we could |
| Recording which country you use Sila from | Legitimate interests: knowing where our customers are is how a small company decides what to build and spots a stolen account. Country only, never a finer location, and you can object at any time using the rights in section 8 |
| Telling you, when your eSIM arrives in a new country, whether your plan works there | Performance of a contract: it is part of providing the data service you bought |
| Verifying your phone number or email with a one-time code | Performance of a contract and legitimate interests in preventing fraud |
| Assessing an agent application, forming the agent agreement and paying commission | Steps before a contract and performance of a contract; keeping the signed agreement and commission records is a legal obligation (UK tax and accounting law) and our legitimate interest in being able to show what was agreed |
4. If you add a family member
Our service lets you buy and manage an eSIM for someone else (a partner, parent or child) and have their QR code sent directly to them.
This means you are giving us another person's personal data. When you do:
- You confirm you have that person's permission to share their details with us.
- We ask them to confirm a one-time code sent to their own email or mobile before they are added, so we know the contact details genuinely reach them.
- They may sign in to a limited, view-only screen showing only their own eSIM, never your other eSIMs, orders, payment details or account.
- This policy applies to their data as it does to yours, and they have the same rights set out in section 8.
If you add someone under 18, you must be their parent or guardian, and you are responsible for that decision.
5. Who we share data with
We do not sell your personal data, and we never share it for anyone else's marketing. We share only what is necessary, only with the following processors, and only so the service can work:
| Who | What for | What they receive |
|---|---|---|
| eSIM Go | Issuing and managing your eSIM | Order and eSIM technical data, and the text of any message we send to your eSIM (for example a welcome when you arrive in a new country). Not your address or payment details |
| Stripe | Taking payment | Your name and email address, payment and billing details, and the order number, so each payment can be matched to its order. They handle the card data; we do not. If you delete your account, we delete your customer record at Stripe; the payments themselves stay as financial records |
| Resend | Sending email (your eSIM, receipts, verification codes) | Your email address and the message content |
| Twilio | Sending SMS verification codes, where used | Your mobile number and the code |
| Expo | Delivering push notifications | Your device push token and the notification text |
| AviationStack | Flight status, only if you use flight tracking | The flight number and date you entered, not your identity |
| Railway | Hosting our servers and database (EU West, Amsterdam) | Stores the data described in this policy |
| Sentry | Telling us when the app or website crashes, so we can fix it (EU servers) | The error and where in our code it happened, your device model and operating system version, the app version, and which screens you were on. We have configured it not to send your IP address, your account details, or the contents of anything you submitted |
| Cloudflare | Protecting and speeding up our website | Your IP address, in order to route the request. Cloudflare tells us which country it is in; we keep the country and never the address itself |
| Wise (our bank) | Paying commission to Sila agents | The agent's account holder name, bank details and the amount paid |
We may also disclose data where we are legally required to (for example to a court, tax authority, or law enforcement acting under proper authority), or to establish or defend legal claims.
6. Sending data outside the UK
Our database is hosted in the European Economic Area (Amsterdam). Some of the providers above are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on the UK Government's adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Order and payment records | 6 years from the end of the relevant financial year, as UK tax law requires |
| Your account and profile | Until you delete it yourself (section 8) or ask us to close it, or after 3 years with no sign-in and no order |
| eSIM records and usage | For as long as you have an account. After it closes, the ICCID and data totals stay attached to the order with no name on them, because we have to reconcile what our supplier billed us |
| One-time verification codes | Usable for ten minutes. The record itself is cleared automatically by a nightly job, within two days at the outside |
| Consent records | For as long as we rely on that consent, plus 6 years, so we can evidence it |
| Refund requests | As long as the order they are about, because they explain a refund in our accounts. If your account closes, what you wrote in them is removed and the rest stays with no name on it |
| Feedback you send us | Until you ask us to delete it. If you sent it while signed in, your name and email are removed from it when your account closes; what you said about the product stays, without your name on it |
| Messages you send us from Help | For as long as you have an account, and deleted when it closes |
| Agent applications, agreements and commission payments | An application that was never signed is deleted when your account closes. A signed agreement, the commission recorded under it and the payments we made to you, with their transfer receipts, are kept for 6 years from the end of the financial year they relate to, as contract and tax records. When your account closes, the IP address and browser the agreement was signed from are removed at once. Your contact email, phone number and bank details are kept until every commission owed to you has been paid and for 12 months after the later of your last payment and the closure, in case a transfer is returned or queried, and are then removed |
| The country your eSIM is in | Only the latest one, replaced at each border, and cleared when your account closes |
| Technical logs and crash reports | Up to 90 days, on the schedules of our hosting and error-reporting providers |
| Usage counts and country, tied to your account | For as long as you have an account, and cleared when it closes. The monthly and country totals described in section 11 have no account attached, so they are anonymous statistics and we keep them |
If you ask us to delete your account, we anonymise it rather than erasing the order history outright, because we are legally required to keep records of sales. The remaining records can no longer be linked back to you.
8. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you, and get a copy.
- Correct anything inaccurate. You can change your mobile number and address yourself in the app or on the website. Your name and title are fixed once your account is open, so to correct them, contact us and we will.
- Delete your data, where we have no overriding legal reason to keep it.
- Restrict or object to how we use it, including for anything based on legitimate interests.
- Portability: receive your data in a common, machine-readable format.
- Withdraw consent at any time, including for marketing. This does not affect anything done before you withdrew it.
You can withdraw marketing consent yourself at any time in the app under Profile → Consent history, or by using the unsubscribe link in any marketing email.
To exercise any other right, including getting a copy of your data, email [email protected]. We will respond within one month.
We do not make decisions about you by automated means alone that have legal or similarly significant effects on you.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. We would rather you told us first so we can put it right.
9. Keeping your data safe
- All traffic between the app and our servers is encrypted in transit (HTTPS).
- Passwords are stored only as salted one-way hashes. They cannot be read or recovered, even by us.
- One-time verification codes are stored hashed, expire after ten minutes, and are limited to five attempts.
- Sensitive values (passwords, tokens, API keys and full ICCIDs) are automatically stripped from our logs.
- Access to production data is limited to those who need it to operate the service.
No system is perfectly secure. If a breach ever affects your rights and freedoms, we will notify the ICO within 72 hours and tell you without undue delay where the law requires it.
10. Children
Sila eSIM is for adults. You must be at least 18 to open an account, as our terms say, and we do not knowingly create accounts for anyone younger. A parent or guardian may buy an eSIM for a child using the family member feature described in section 4. If you believe someone under 18 has created an account, contact us and we will remove it.
11. Cookies, analytics and crash reports
The Sila eSIM app and website do not use advertising cookies or third-party advertising trackers, and we do not build advertising profiles. We store a secure sign-in token on your device so you stay signed in; this is necessary for the service to work and cannot be turned off separately from signing out.
How we count usage. We keep totals: how many people used Sila on a given day, whether on the app or the website, and how many visits came from each country. These are counters, not records about you, and we never store your IP address. Once a month has ended we keep only the total for it (how many accounts used Sila that month, on the app or on the website), and we keep that total indefinitely, because there is nobody in it.
Crash reports. When the app or the website fails, it sends a report so we can fix it. The report describes the fault, not you: where in our code it happened, your device model and operating system version, the app version, and which screens you visited beforehand. We have switched off the features that would attach your IP address or account details, and nothing you typed or submitted (passwords, addresses, payment or bank details) is included. These reports are processed by Sentry on servers in the European Union and kept for 90 days.
Where you use Sila from. We record the country your connection comes from each day you use Sila, against your account. It comes from your phone's or browser's time zone setting, or from your internet connection when that is not available, worked out to a country and no further, and your phone is never asked for its location. The time zone comes first because a travel eSIM's connection often appears to come from the country of the network that issued it, not the one you are in. We use it to understand where our customers are, to see which destinations matter, and to notice an account suddenly being used somewhere it never has been. We keep it for as long as you have an account, it goes when your account does, and you can object to it at any time. See section 8.
Arriving somewhere new. When your eSIM connects in a new country, our network partner tells us which country it is, and we send you a welcome that says whether your plan works there. We keep only that latest country against the eSIM, never a history, and it is cleared when your account closes.
12. Language
This policy is written in English, and the English version is the one that applies. If we show a translation or summary of any part of it, for example in the app's help pages, and it differs from this policy, this policy applies.
13. Changes to this policy
If we change this policy we will update the version and date at the top. Where a change materially affects you we will tell you in the app or by email before it takes effect. When you agree to this policy we record which version you agreed to, so a later change never silently rewrites what you consented to.