Privacy Policy

1. Who we are, and our two roles

Eivero operates eivero.com, the client console and the provisioning API. This policy explains what we do with personal data. It applies to visitors to this site, to businesses with an account, and to the people whose details pass through us when a profile is provisioned.

1. For your Account, we are the controller. We decide what we collect about you and your business, and why.
2. For End Customer data, we are the processor. The business that sold the plan decides why the data is processed and for how long. We process it on their instructions, and their privacy notice governs their relationship with the individual. If you are an End Customer reading this, the business you bought from is your first point of contact; this page explains the part we play.
3. We do not sell personal data, and we do not use it for advertising.

2. Scope of this policy

1. This policy covers eivero.com, app.eivero.com and admin.eivero.com, and any communication with us by email, console chat or post.
2. It does not cover a third-party site you reach from ours, or the privacy practices of a business that sold you a plan.
3. Where a client's data processing agreement sets different terms for End Customer data, that agreement prevails for that data.

3. What we collect

When you visit this website

1. The server that answers your request records the IP address, the time, the page requested and the browser identification string. We use it to keep the site running and to spot abuse.
2. We run no advertising or analytics cookies on the public site, and we build no profile of visitors.

When you open an account

1. Business details: company name, registration details where you give them, billing address, contact name and email, telephone number, and a tax registration number where a reverse charge applies.
2. Login details: your email address, and a password stored only as a salted hash. We never store the password itself and we cannot recover it.
3. Security data: the time and address of sign-ins and, where you enrol it, a one-time code from an authenticator app. We store the shared secret for that code, encrypted.
4. Correspondence: support tickets, chat transcripts and emails, kept so a problem can be traced and answered.

When you submit an Order

1. End Customer name and email address, and, where you provide them, telephone number, country and device identifiers such as the IMEI or eSIM identifier.
2. The Plan, the term, the Order reference and the provisioning status.
3. Activation data: the string or image that installs the profile. It is personal data, because it is tied to a named subscription.

When we issue or charge a payment instrument

1. The name on the instrument, its limits, its status, and the charges made to it.
2. Card details we hold are encrypted at rest and are not shown in the console. Full card numbers are not displayed to staff in the ordinary course of support.

Technical and security data

1. API request logs, rate-limit counters, error traces and audit records of administrative actions.
2. Where fraud or abuse is suspected, the indicators that led to that conclusion and what we did about it.

4. What we do not collect

• No advertising or analytics cookies on this site, and no tracking pixels in our emails.
• No special category data. We do not ask for health, biometric, political, religious or sexual orientation data, and you should not send it.
• No identity documents, unless a specific verification procedure requires one and we ask in writing.
• No bank credentials. We never ask for the password to a bank account or a payment app.
• No data about children. The Service is sold to businesses and we do not knowingly hold data about an account holder under 18.

5. Why we hold it, and our legal bases

Where we rely on legitimate interests we have weighed the effect on the individual and limited the data to what the purpose needs. You may object to that processing, as explained in section 10.

6. How long we keep it

When a retention period ends we delete the record or turn it into statistics that cannot be tied to a person. A legal hold, a dispute or a regulatory request can extend a period; we keep only what the hold needs.

7. Who we share it with

1. The partners who deliver the service. We use suppliers in defined categories, each bound by a written agreement that limits them to our instructions:
   1. connectivity and mobile network partners, who need the data to activate and operate a profile;
   2. card issuing and payment processing partners, who need it to issue and charge a payment instrument;
   3. cloud hosting and storage providers, who keep our systems and backups running;
   4. email delivery providers, who send service messages and invoices;
   5. support and monitoring tooling, used by our staff to answer tickets and watch the platform.
2. A current list of the recipients in each category is available to clients on request, and we give notice before adding one that processes End Customer data.
3. Professional advisers. Lawyers, auditors and accountants, where needed and under confidentiality.
4. Authorities. A court, regulator, law-enforcement body or network operator, where the law requires it or where it is necessary to prevent fraud or unlawful use. We check that a request is lawful and tell you first where we are allowed to.
5. A successor. A buyer or successor of all or part of our business, under the same terms. We tell you before your data becomes subject to a different policy.
6. We never sell personal data, and we never share it for advertising.

8. International transfers

1. Our systems, and those of our partners, may process data in a country other than the one where it was collected, because a profile can be activated in one place and used in another.
2. Where data leaves a region with transfer restrictions we rely on an approved mechanism, such as the standard contractual clauses or an equivalent framework, together with the measures described in section 9.
3. You can ask which mechanism applies to a particular data set by writing to legal@eivero.com.

9. Security

1. Traffic to this site and to the console is encrypted in transit. HSTS is enabled, so a browser will not fall back to an unencrypted connection.
2. Passwords are stored as salted hashes with a deliberately slow function. They cannot be reversed, and we cannot tell you what yours was.
3. Administrative access requires a second factor. Access to production data is limited to staff who need it, and administrative actions are written to an audit log.
4. Stored card details and activation secrets are encrypted at rest, with keys held separately from the database.
5. We take an encrypted backup every hour, keep it off-site, and restore one automatically every week to prove the backup works. Backups roll off within 8 weeks.
6. No system is perfect. If a breach affects your data we tell you without undue delay and within 48 hours of becoming aware, saying what happened and what we recommend you do.

10. Your rights

If you are an individual whose data we hold, you have the rights below. They are not absolute: a legal obligation or a legitimate interest can limit them, and we explain why if we refuse.

1. Write to legal@eivero.com. We answer within 30 days, and tell you if we need longer and why.
2. We may ask for proof of identity before acting, so that we do not give data to the wrong person. We do not charge for a request unless it is manifestly unfounded or repetitive.
3. If you are an End Customer, your request goes to the business that sold you the plan, because they are the controller. If you write to us directly we pass the request on and assist them in answering it.

11. Self-service controls in the console

1. Download. In Billing, "Download JSON" returns everything we hold about the account: company details, orders, the eSIM accounts we provisioned and the cards attached to them. Card numbers and activation secrets are excluded on purpose.
2. Cancel. Stops the subscription. Profiles keep working until the end of the period already paid for, and no further renewal is attempted.
3. Delete. Closes the account. It requires the word DELETE and the account password, because a stolen session should not be enough to destroy an account.

12. What deletion does, and what it does not

Deletion removes you as a person from our records without destroying the evidence that a service was sold. Concretely:

1. We keep the order skeleton because tax law requires a record of what was sold, and because a chargeback can be brought years later. It no longer identifies anyone.
2. Backups are immutable for their retention period, so a deletion reaches them only when they expire. We do not restore deleted data except to recover from a disaster.
3. We cannot delete a record under a legal hold, a court order or an active investigation. We delete it when the hold ends.
4. If you need a deletion confirmed in writing, ask us and we will send a short statement naming the date and what was removed.

13. Cookies and similar technologies

1. This website sets no cookies for advertising, analytics or profiling.
2. The client console and the admin console each set one strictly necessary session cookie. It is httpOnly, Secure and SameSite=Strict, it holds a random session token rather than your details, and it expires after 12 hours or when you sign out.
3. We use your browser's local storage for interface preferences, such as whether a panel is open. That data stays on your device and is not sent to us.
4. Because the only cookies are strictly necessary, no consent banner is required. If we add a cookie that is not strictly necessary, we will ask first.

14. Automated decisions

1. Some decisions are automated: a renewal charge that fails leads to suspension when the grace period ends, and a request pattern that looks like abuse can be rate-limited or blocked. These are operational rules, not profiling.
2. Automation does not decide whether to enter a contract, and it does not use special category data.
3. You can ask for a human review of any automated decision by writing to ops@eivero.com with the order reference. We answer within 5 business days.

15. Children

The Service is sold to businesses and is not directed at children. We do not knowingly collect data about anyone under 18 as an account holder. If you believe a child's data has reached us, write to legal@eivero.com and we will remove it.

16. Marketing

1. We send service messages, such as an outage notice, a security alert or a change to these Terms, because they are part of the service. They are not marketing, and you cannot opt out of them while you hold an account.
2. Product news is sent only where you asked for it, and every message has a one-click unsubscribe.
3. We do not buy contact lists, and we do not add an address to a marketing list because it appeared on an invoice.

17. Changes to this policy

1. We review this policy when the Service or the law changes, and update the date at the top.
2. Where a change materially affects what we do with your data we tell you by email at least 30 days before it takes effect, and describe the change rather than republishing the page silently.
3. Earlier versions are available on request.

18. How to contact us

Privacy questions, access requests and objections go to legal@eivero.com. Security reports go to security@eivero.com and are read at any hour.

If you are not satisfied with our answer you may complain to the supervisory authority in the country where you live or work. We will cooperate with it.

This policy was last updated on 24 October 2026.