Privacy Policy

Welcome to VAYO eSIM ("VAYO", "we", "our", or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what information we collect when you use our website and services, how we use it, and your rights in relation to it.

1. Who We Are

VAYO eSIM is a travel eSIM provider offering digital SIM (eSIM) data plans for international travellers. Our website is located at usevayo.com. If you have any questions about this policy, please contact us at the details provided in Section 10.

2. Information We Collect

We collect information in the following ways:

Information you provide to us

• Email address — required to deliver your eSIM QR code and send order confirmations.

• Name — if you create an account or fill in our contact form.

• Payment information — collected and processed by our payment partners (such as Viva Wallet or Worldpay). We never store your card number or bank details on our servers.

• Messages — content you submit via the contact form or support emails.

Information collected automatically

• IP address and device information — for fraud prevention and security purposes.

• Usage data — pages visited, browser type, referral source, and how you interact with our site (for example clicks and scrolling), collected via Google Analytics and Hotjar when you consent to analytics cookies.

• Cookies — see Section 7 below.

Referral program information

If you participate in our referral (invite-a-friend) program, we may also collect and store:

• Referral code — a unique code assigned to your account so you can share your invite link;

• Referral attribution — whether you arrived via someone else's invite link, including the referrer account linked to your first purchase (where applicable);

• Referral activity — records of invitations, qualifying purchases, and rewards issued under the program.

When you share your referral link, you choose who receives it. We do not publish your identity on the invite landing page.

3. How We Use Your Information

We use your personal data to:

• Process and fulfil your eSIM orders;

• Send you your QR code and order confirmation by email;

• Provide customer support;

• Detect and prevent fraudulent transactions;

• Administer our referral program — including attributing invitee discounts, issuing referrer reward coupons, and preventing abuse;

• Send transactional emails about referral rewards you have earned (if applicable);

• Improve our website and services through analytics tools such as Google Analytics and Hotjar (with your consent);

• Send you marketing communications if you have opted in to receive them.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance — to fulfil your eSIM order and administer referral discounts or rewards you qualify for.

• Legitimate interests — to prevent fraud, operate the referral program fairly, and improve our service.

• Consent — for analytics cookies and marketing emails.

• Legal obligation — where required by applicable law.

5. Sharing Your Data

We do not sell your personal data. We share it only with:

• Payment processors — such as Viva Wallet or Worldpay. Subject to their own privacy policies.

• eSIM network partners — to provision your eSIM plan (only order details, no payment data).

• Google Analytics — usage data to understand how visitors use our site (only with your consent).

• Hotjar — website analytics and session insights (such as heatmaps and session recordings) to help us improve our site. Only active if you consent to analytics cookies. Hotjar is operated by Contentsquare; see their privacy policy.

• Legal authorities — when required by law or court order.

Referral relationships (for example, which account referred you) are used internally to operate the program and are not sold to third parties.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy. Order records are kept for up to 7 years to comply with financial and tax regulations. Referral attribution and reward records are retained for as long as needed to administer the program, resolve disputes, and prevent abuse. You may request deletion of your account data at any time (see Section 8), subject to records we must keep for legal or accounting reasons.

7. Cookies

We use the following types of cookies:

• Essential cookies — required for the website to function (session management, CSRF protection). These cannot be disabled.

• Functional cookies — used to remember referral invite links you have visited (for example, our referral_code cookie) so we can apply eligible invitee discounts at checkout. These are necessary for the referral program to work and are not used for advertising.

• Analytics cookies — help us understand how visitors interact with our site (Google Analytics and Hotjar, including cookies such as ga and hj*). Enabled only with your consent.

Where session recordings are enabled, we configure Hotjar to suppress sensitive fields (such as payment details) where possible. Recordings are used only to improve our website and are not used for advertising.

Referral cookies typically expire after a limited period configured in our program settings (commonly up to 30 days). You can manage analytics cookie preferences using the consent banner displayed on your first visit. Clearing essential or functional cookies may prevent referral discounts from being applied correctly.

8. Your Rights

Under applicable data protection law (including the GDPR where applicable), you have the right to:

• Access the personal data we hold about you;

• Request correction of inaccurate data;

• Request deletion of your data ("right to be forgotten");

• Object to processing based on legitimate interests;

• Request restriction of processing;

• Data portability;

• Withdraw consent at any time (without affecting prior processing).

To exercise any of these rights, please contact us using the details in Section 10.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data is transmitted over encrypted HTTPS connections. Payment processing is handled by PCI-DSS compliant payment providers.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• By email: via our contact page

• By visiting: usevayo.com/contact

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitute your acceptance of the updated policy.