1. Who we are
The DRIN eSIM app and this website are operated by [operator legal name], [registered address], [company registration number] ("we", "us"). We are the controller of the personal data described in this policy.
Contact: [privacy contact email]. [If the operator is established outside the EU: name and contact details of our EU representative under Article 27 GDPR. Add a data protection officer if one is appointed.]
2. Scope
This policy covers the DRIN eSIM mobile app for iOS and Android and this website. Third-party services you use through the app, such as Google or Apple sign-in, also have their own privacy policies.
3. Data the app collects today
Account data
- Your email address and the sign-in method you used (Google or Apple), received from that provider when you sign in.
- Your name as shared by Google or Apple. Apple may share a private relay email instead of your real address, if you choose that option.
- An internal user ID and sign-in session information.
Profile data you provide
- First and last name, and your home country (required to finish setup).
- Phone number (optional, in profile settings).
- Profile photo (optional). Profile photos are stored at a web address that anyone who has the link can open.
- The date and version of the terms you accepted during setup.
Settings
- Notification choices (product announcements, promotions and offers, usage alerts).
- Display preferences: theme, accent colour, text size and language setting.
Device and push notification data
- If you allow notifications: a push notification token for your device, the device platform (iOS or Android) and when the token was last updated.
Technical data
- Our hosting and infrastructure providers may automatically record technical information such as IP address, request times and error details when the app communicates with our servers. [Confirm what logs are kept and for how long.]
The app does not currently include advertising, analytics or crash-reporting tools, and it does not access your location or contacts. It accesses your camera or photo library only when you choose to add a profile photo.
4. Data collected once purchases launch
Buying eSIM plans is not yet available. When it launches, we expect to also process the following and will update this policy before then:
- Order details: the plan, destination, price, currency, date and order status.
- eSIM details: eSIM identifiers such as the ICCID, activation or QR codes, and installation status.
- Data usage and plan validity information received from our eSIM supplier.
- Payment information, handled by [payment provider to be confirmed: Apple App Store / Google Play, or Stripe]. We do not receive or store full card numbers. [Confirm whether we receive any card details, such as the last four digits, or only a payment confirmation.]
5. This website
This website does not set cookies, does not use analytics or advertising tools, and does not load fonts, scripts or images from third parties. Our website host, [hosting provider to be confirmed, for example Vercel], may keep standard server logs, such as IP address and pages requested, for security and operation. [State the host's log retention.]
6. How we use your data
| Purpose | Data | Legal basis (where applicable) |
|---|---|---|
| Create and secure your account, and let you sign in | Account data | Performance of a contract |
| Show and manage your profile and settings | Profile data, settings | Performance of a contract |
| Send service notifications, such as plan and usage alerts | Push token, settings | Performance of a contract |
| Send product announcements | Push token, settings | [Legitimate interests or consent — to confirm] |
| Send promotions and offers (off by default) | Push token, settings | Consent, which you can withdraw in settings |
| Record your acceptance of our terms | Consent date and version | Legal obligation and legitimate interests |
| Keep the service running and secure, and fix problems | Technical data | Legitimate interests |
Because we offer the Service to people in the European Union and EEA and in Türkiye, we process personal data in line with the EU General Data Protection Regulation (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). [Legal review: KVKK explicit-consent and cross-border transfer requirements, and whether VERBIS registration is needed.]
We do not sell your personal data.
7. Who we share data with
We use service providers that process data on our behalf:
- Supabase: hosting, database, user authentication, file storage and server functions.
- Google: Google Sign-In, if you choose it, and Firebase Cloud Messaging to deliver push notifications.
- Apple: Sign in with Apple, if you choose it, and Apple Push Notification service on iPhone.
- Once purchases launch: our eSIM supplier [eSIM supplier to be confirmed], which provisions your eSIM, and our payment provider [payment provider to be confirmed].
- Website hosting: [hosting provider to be confirmed].
We may also disclose data where required by law, or to protect our rights, users or the public.
8. International transfers
Our providers may process data outside the EU/EEA and Türkiye, including in the United States. Where they do, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, and on the transfer mechanisms that KVKK requires. [State the Supabase project region and confirm the safeguards used for each provider.]
9. How long we keep data
We keep account, profile and settings data while your account exists. [Set retention periods for technical logs, and for order and payment records once purchases launch. Tax and accounting laws may require some records to be kept for a set period.]
10. Security
Data is sent over encrypted connections, and database access rules restrict each user to their own records. No system is completely secure, and we cannot guarantee absolute security.
11. Your choices and rights
- In the app: view and edit your profile, change your email address, change notification and display settings, and sign out of all devices.
- Delete your account: go to Account > Delete account. This deletes your account, profile and uploaded profile photos. [Confirm that notification tokens and settings are deleted too, and any data that must be kept.]
- Notifications: you can also turn off push notifications in your device settings.
- EU and EEA: under the GDPR you have the right to access, correct and delete your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can also complain to the data protection authority in your country.
- Türkiye: under Article 11 of KVKK you can ask whether your data is processed, request information about it, learn its purpose and recipients, request correction or deletion, object to certain results of automated analysis, and claim compensation for unlawful processing. You can also complain to the Personal Data Protection Authority (KVKK Kurumu).
- To use these rights, contact us using the details below. We reply within one month, or within 30 days for KVKK requests.
12. Children
The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has given us data, contact us and we will delete it.
13. Changes to this policy
We will update this policy when our data practices change, for example before eSIM purchases launch. If changes are significant, we will tell you in the app and may ask you to accept the updated version.
14. Contact
For privacy questions or requests: [privacy contact email]
[operator legal name], [registered address]