Privacy Policy

When you create an account: your email address and name, your mobile number if you choose to sign in with it, and your Google identifier if you sign in with Google. While you use the Platform: your language, display currency and preferred country, your IP address and browser type in the session log and the contact form, and your purchase history and wallet entries.

We never collect card details: all payments happen on Stripe's secure page and no card number passes through our servers. We do not collect your device's geolocation.

To fulfil purchases and deliver eSIMs, to send receipts and eSIM alerts, to protect accounts from fraud, and to meet accounting and legal obligations. We do not sell your data or use it for third-party advertising.

Stripe (payment processor): email, name and a customer identifier — to process payments and prevent fraud. The Provider (eSIM network): receives no personal data; an eSIM order carries only a transaction identifier and a plan. Email service: your address, to send the messages you requested. Hosting and backup providers: store data encrypted on our behalf.

We use exactly four items: the session cookie (required to stay signed in), the proalo_ref cookie linking your visit to a reseller's link for 30 days, the proalo_announcement_dismissed cookie remembering that you dismissed an announcement for 30 days, and your theme preference (light/dark) in the browser's local storage. No analytics or advertising cookies at present.

When you request account removal, an undo window of 7 days starts; your identity is then anonymised: name, email, phone and login identifiers are cleared and sessions and tokens are deleted. The order and wallet history is kept anonymised for the period required as required by applicable law. Backups are encrypted and kept for up to 90 days before deletion. An account with a positive balance or an active eSIM cannot be removed until it is settled.

You can access and correct your data on your profile page, request account removal from its settings, and object to processing or request a copy of your data by contacting us. We respond under UK GDPR, and under KVKK for customers in Türkiye.

Each eSIM has a tracking page with a private link that carries neither your name nor your email, so you can reach the installation code from any device. Do not share the link with anyone you do not want to install your eSIM. The page remains after account removal because it holds no personal data.

Activation codes and PIN/PUK numbers are encrypted in the database, all traffic runs over HTTPS, and keys are never stored in code. Still, no system is perfectly secure; tell us immediately if you notice unauthorised access to your account.

For any question about your data: support@proalo.app, or the "Contact us" form on the site.