Privacy Statement

This statement covers the personal data TropiTrade processes when you use our website or the TropiTrade app, create an account, buy an eSIM or use credit, contact us, or work with us as a partner. It explains what that data is, why we collect it, who we share it with, how long we keep it, and what rights you have. It goes together with our Terms and Conditions; together they describe the agreement between you and TropiTrade.

The party responsible for processing your data is TropiTrade LLC, registered in the State of Delaware, United States. For all privacy questions and requests, contact [email protected].

• We only collect the data needed to deliver your eSIM, help you, and run our shop.
• We never sell your data to anyone.
• Our shop and customer data run on servers within the European Union (Germany).
• Our own visitor statistics run on our server. On the website, we also use advertising measurement from Google and Meta if you consent to it.
• Your payment is processed by Stripe; we do not store full card numbers ourselves.
• You can request account deletion in the app or through our request page. For access, corrections and other privacy questions, contact [email protected].

The rest of this statement sets this out in detail.

What we record about you depends on how you use TropiTrade.

When you place an order or create an account. Your name, email address, phone number and billing address, together with your order details (which eSIM, amount, date). If you create an account, we also store your password as a secure hash, not as a readable password.

When you pay. Your payment is handled by our payment provider Stripe. Stripe processes your card or payment details directly; TropiTrade receives the payment status and information needed to link the payment to your order. If you choose a saved payment method, we retain a reference to that method at Stripe and may display details such as the card brand and last four digits. We do not store full card numbers or card security codes ourselves. If fraud is suspected, payment information from Stripe may be used to prevent misuse.

Your eSIM itself. To deliver and manage your eSIM, we link technical data to your order and email address, such as the serial number (ICCID), the activation code, the QR code and the network identification number (IMSI). Your remaining data and balance belong here too, so we can help you if something goes wrong. When providing support, we can see through our eSIM supplier which mobile network and country your eSIM was last active on; this is country-level information, not a precise location.

When you contact us. Whether you email us, message us on WhatsApp or use the contact form, we keep the content of those messages and the related details (name, email or phone number, date) so we can answer your question and find our earlier contact with you. Our customer service uses an AI assistant that helps prepare replies; this happens under human oversight.

When you use our website or app. We collect technical data such as your IP address, device and browser type, and how you use our site (which pages you view, how you arrived). The website may use cookies for this; see the Cookies section below. When you use the app, our servers also process technical request information, such as IP address and request time, to provide the service and investigate faults or misuse.

When you become a partner or affiliate. For our partner and affiliate programme, we record which business we work with, who the contact person is, and what is needed to pay out commissions, including bank details and an overview of outstanding and paid amounts.

When you sign up for offers or leave a review. If you sign up for our messages, we keep your email address and preferences. If you leave a review, for example through Trustpilot, that platform's terms also apply.

We do not ask for sensitive data (such as health, religion or ethnicity) and do not need it. If you share such information with us anyway, for example in a message to customer service, we only use it to help you.

If you choose Google or Apple sign-in, we receive confirmation of your identity, a stable identifier for your account with that provider, and the name and email address made available to us. Apple may supply a private relay address if you hide your email. We use this information to sign you in securely and recognise your TropiTrade account.

Your Google or Apple password is not shared with TropiTrade. This connection does not give us access to your messages, contacts or photos held by that provider. Information needed to validate or revoke your Apple connection is stored securely on our server for that purpose. You can manage access through Google or Apple; to request deletion of your TropiTrade account, use the process under Your rights.

If you allow push notifications, we link a technical push address and your device platform to your account. We use it for service messages, for example about eSIM usage and remaining data. For delivery, we share the push address, message content and the necessary reference to your eSIM with Expo and, depending on your device, Google or Apple.

You can turn notifications off in your device settings. This does not immediately remove the push registration from our server. The app unregisters it on logout when that request reaches the server. We also remove registrations reported as invalid by the push service and registrations when your account is deleted. A valid push registration has no fixed automatic expiry date and may remain while your account exists. You can also ask us to remove it.

The app stores information locally to keep you signed in, remember preferences and display previously retrieved content. On mobile devices, the session token is kept in the operating system’s secure storage. Other app information, such as preferences and cached content, is kept in local app storage. This also lets you read the last retrieved terms and privacy text offline.

Protect your device with a passcode or biometrics, especially if others can use it. Uninstalling the app alone is not a request to delete your TropiTrade account.

We only process your data where we have a valid basis:

• To perform our agreement with you: processing your order, delivering and activating your eSIM, tracking your balance and providing customer service.
• On the basis of a legitimate interest in running our shop well and securely: preventing fraud and misuse, fixing faults, improving our services, and understanding how our site is used. In doing so, we always balance our interest against your privacy.
• To comply with legal obligations, such as keeping administrative and transaction records.
• On the basis of your consent, for example for marketing messages or non-essential cookies. Any consent you give can be withdrawn at any time.

We do not make decisions about you based solely on automated processing that have legal effects for you. Our AI-supported customer service always works under human review.

If you signed up for offers or news, you can unsubscribe at any time: through the unsubscribe link at the bottom of every message, or by emailing [email protected]. After unsubscribing you will no longer receive marketing messages; messages needed for your order (such as your QR code or an order confirmation) will still be sent.

Essential cookies make our website work, for example for your cart, login and security. Preference cookies remember choices such as your language and cookie settings.

Our own visitor statistics run on our server without tracking cookies. The website also includes Google Ads and Meta Pixel measurement. If you consent to advertising measurement, those services may process information about your visit and purchase, such as pages viewed, technical browser information, a transaction identifier, order value and currency. This helps us measure advertising results. Google and Meta may also use this information for advertising purposes under their own privacy policies.

You choose whether to allow non-essential measurement. The relevant scripts load only after consent. You can change your choice through Cookie preferences at the bottom of the website. We retain your choice for up to 180 days, after which you may be asked again. Withdrawing consent does not automatically delete information lawfully processed earlier.

The native app does not use these website cookies for its own screens. If you open a web page from the app, that website’s cookie choices may apply.

We never sell your data. We only share it with parties needed to deliver our service, and only as far as necessary:

• Stripe to process your payment securely.
• The mobile network operators and eSIM technology partners for your destination, which create the eSIM and make it work on the network. Which party this is depends on the country or region of your eSIM.
• Our email service and WhatsApp (Meta) for the messages we exchange with you. If you use WhatsApp, WhatsApp's own privacy policy also applies.
• Trustpilot, which may invite you after a purchase to share your experience.
• Our hosting and security suppliers, which run and secure our website.
• Google and Apple if you use their sign-in option.
• Expo and Google’s Firebase Cloud Messaging or Apple’s APNs to deliver app notifications if you allow them.
• Google Ads and Meta for website advertising measurement if you consent to it.

We may also share data where the law requires us to, to protect our rights or investigate fraud, or if (part of) our business were acquired or merged. In that last case, this statement continues to apply to your data.

We only work with service providers that make appropriate arrangements to protect your data.

TropiTrade LLC is based in the United States. Our shop and customer data run on servers within the European Union (Germany). Some of our service providers, such as the payment provider and the network partners for your destination, process data in other countries, inside and outside the European Economic Area (EEA). Where data of EU residents is transferred to a country outside the EEA without an equivalent level of protection, we put appropriate safeguards in place, such as the standard contractual clauses drawn up by the European Commission.

We do not keep your data longer than needed. As a guideline:

• Order and payment records: as long as the legal retention period for administration applies, generally up to 7 years after the year of purchase.
• Account details: as long as your account exists. If you delete your account, or ask us to, we delete the data we are not legally required to keep.
• Customer service conversations (email, WhatsApp, contact form): up to 2 years after the last contact, so we know your history if you contact us again.
• eSIM data: as long as your eSIM or credit is active, plus the period needed for the administration above.

After that, we delete data or anonymise it. On your request, we delete earlier whatever we are not legally required to keep.

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted connections (HTTPS) and restricted access: only those who genuinely need your data can reach it, under a duty of confidentiality. No transmission over the internet is entirely without risk, so an absolute guarantee does not exist; we do keep our security measures up to date and limit storage to what is needed.

You have the right to:

• request access to the data we hold about you;
• request correction if data is incorrect or incomplete;
• request deletion of your data, where there is no reason to keep it;
• request a restriction on what we do with your data;
• object to processing based on our legitimate interest, and at any time to direct marketing;
• withdraw your consent where we rely on it as a basis;
• request the transfer of your data to you or another party.

Send your request to [email protected]. We respond within one month. If you are in the EU and not satisfied with how we handle your data, you can file a complaint with the privacy authority of the country where you live. In the Netherlands, that is the Autoriteit Persoonsgegevens.

To request account deletion, go to Account → Personal details → Delete account in the app, or use www.tropitrade.com/account-verwijderen/. We verify and process your request within 30 days, including a review of active services, outstanding transactions and any information that must still be retained. Submitting a request does not delete your account immediately. You receive confirmation after deletion is complete.

Our services are not directed at children. We do not knowingly collect data from children under 16. If you notice that a child has given us data anyway, let us know at [email protected] and we will delete it as soon as possible.

Our website contains links to other websites, such as those of network partners or review platforms. This statement only applies to TropiTrade. If you click through to another website, please read its privacy policy there.

We keep this statement up to date and adjust it when our services or the rules change. The date at the top shows the last change; important changes will be clearly announced. This statement is drawn up in English and Dutch; if the versions differ, the English version prevails.

Last updated: September 14, 2026.

Questions about this statement or about how we handle your data? Email us at [email protected].