Privacy notice

This notice explains what STISH GO does with your personal data when you visit the store, buy an eSIM, or contact support. Plain language, no dark patterns.

Who is responsible

STISH GO is the controller for the data described here. Contact details and the legal entity are on the Imprint page. For privacy questions write to [email protected].

What we collect

Order data: email address, the plans you bought, price, currency, invoice, and payment status.
eSIM data: masked identifiers (ICCID/SM-DP+), activation state, expiry, and the aggregate usage counters the supplier reports. We do not see the websites you visit, your messages, or your location while roaming.
Account preferences: language, currency, theme, and whether you want usage and expiry alerts.
Support data: the tickets and chat messages you send us, plus the order they relate to.
Technical data: IP address, device and browser type, and basic security logs used for fraud prevention and rate limiting.
Crew data: if you organize a crew, the participant emails you upload. You choose that list; we process it on your instruction.

What we do not collect

We do not store full card numbers — payments go straight to Stripe or PayPal. We do not run advertising trackers, we do not sell personal data, and analytics stays off until you accept it in the cookie banner.

Why we use it, and on what basis

To perform the contract: create and deliver your eSIM, send the QR and invoice, run top-ups, and handle refunds.
For our legitimate interests: preventing fraud and trial abuse, keeping the service secure, and improving the catalog with aggregated statistics.
With your consent: analytics cookies, marketing email, and optional push or usage alerts. You can withdraw consent at any time.
To comply with the law: tax, accounting, and VAT records.

Payment processors (Stripe, PayPal) — they are separate controllers for the payment itself.
Wholesale eSIM aggregators — they receive the minimum needed to provision and maintain your profile.
Email, hosting, and error-monitoring providers acting as processors under contract.
Authorities, when we are legally required to.

Affiliate links do not pass your email to the partner. Our B2B outreach tooling only ever uses public business addresses with a stored source URL — it never touches personal inboxes.

International transfers

Some processors operate outside your country. Where that happens we rely on the European Commission's standard contractual clauses or an adequacy decision, and we keep a record of them.

How long we keep it

Orders, invoices, and tax records: as long as accounting law requires, typically 7-10 years.
eSIM and usage records: for the life of the profile plus 12 months for disputes.
Support tickets: 24 months.
Marketing consent and unsubscribes: until you withdraw, plus a suppression record so we do not email you again.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. Account export and deletion are self-service in Account; anything else, email [email protected]. We answer within 30 days and never charge for a first request.

You can unsubscribe from marketing at /unsubscribe or from any campaign email. Transactional mail — order confirmation, QR code, expiry warning — keeps sending because it is part of the service.

Security

Data is encrypted in transit. Admin access is role-based with optional two-factor step-up, and eSIM identifiers are masked in the interface. If a breach ever affects you, we notify you and the supervisory authority within the legal deadline.

Children

The store is not intended for people under 16 and we do not knowingly create accounts for them.

Complaints

Tell us first — we would rather fix it. You also have the right to complain to the data protection authority where you live or work.