This policy explains what personal data Roambee collects when you use our website, apps and eSIM services, why we collect it, and the choices you have. We keep it short and specific; where the law requires more detail, you will find it in the numbered sections.

1. 1. Who we are

   The data controller is T&T 2026 Ltd (trading as Roambee), a private limited company registered in England and Wales (company number 17490180), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Roambee", "we"). Our data protection contact is privacy@roambee.io.

2. 2. What we collect

   Account data: your email address and, if you add them, your name, phone number, country and billing details; the sign-in accounts you connect (Apple, Google, Facebook, X or Telegram).

   Order data: plans bought, prices and currency, the payment method type and, for cards, the brand and last four digits. Full card numbers go to Stripe and never reach us.

   Crypto payment data (web only): the coin and network, the deposit address we created for your order, the amount due and received, the transaction hash and its confirmations. See "Crypto payments" below.

   eSIM data: the eSIM’s ICCID (and EID where reported), its status and the data used, as reported by our eSIM supplier.

   Technical data: device model, platform, app version and language, push notification tokens, and your IP address and the country derived from it. We use the IP address for security and rate limiting; we do not store it with your account.

   Marketing preferences, referral activity, support messages and, when you arrive through a partner or invite link, the code and campaign parameters of that link.

3. 3. Why we use it

   To provide the service (take payment, deliver and activate eSIMs, show remaining data, send expiry alerts) — performance of a contract.

   To prevent fraud, secure accounts and credit referrals and partners correctly — legitimate interest.

   To understand how the website and app are used (analytics) — consent, see "Analytics" below.

   To send offers and the newsletter if you opted in — consent, which you can withdraw at any time in Settings → Notifications or with the link in every email.

   To comply with tax, accounting and telecom regulations — legal obligation.

4. 4. Analytics

   On our websites, Google Analytics runs in Consent Mode: until you choose "Accept all" in the cookie banner it sends only cookieless signals without identifiers, and no analytics cookies are set. In the app, Firebase Analytics stays off until you switch on "Usage analytics" on the first-run card or in Profile → Privacy. When you are signed in and have agreed, we send a one-way hashed account ID, never your name, email or phone number. We do not use advertising IDs or advertising cookies. You can withdraw consent at any time in the same places.

5. 5. Who we share it with

   We use these service providers. Each processes data on our instructions and only what it needs:

   Stripe — card, Apple Pay, Google Pay and Link payments and fraud checks. Supabase — our database and sign-in service, hosted in the EU (Ireland). Cloudflare — hosting, content delivery, security and spam protection. Resend — sending our emails.

   eSIM Access — our eSIM supplier. It receives our order reference and the plan, not your name, email or payment details, and reports the eSIM’s status and data use back to us.

   Google — Google Analytics and Tag Manager on our websites and Firebase Analytics in the app (both only with your consent), Firebase Cloud Messaging for push notifications on Android, and Google sign-in if you use it. Apple — push notifications on iPhone and Sign in with Apple if you use it. Expo — relays push notifications to Apple and Google; it receives your device’s push token and the notification text.

   Telegram, X and Facebook — only if you sign in with them. If you link Telegram, we can also send your notifications through our Telegram bot. Our staff receive internal payment alerts through the same bot; they contain order numbers and amounts, not your contact details.

   We may also disclose data where the law requires it, for example to tax authorities. We never sell personal data.

6. 6. Crypto payments

   Crypto payments are recorded on a public blockchain. Anyone can see the transaction, its amount, our deposit address and the address it came from, and no one — including us — can change or delete that record. Once a transaction hash or wallet address is linked to your order it can identify you, so we treat it as personal data.

   We keep the deposit address, amounts, transaction hash and confirmations with your order records (see Retention). To check for your payment we query public blockchain services (such as mempool.space, PublicNode, the Arbitrum public RPC run by Offchain Labs, TronGrid and Solana nodes) with the deposit address only. Coin prices come from Binance’s public market data; Binance receives no data about you or your order.

7. 7. International transfers

   Our database is hosted in the EU. Some providers (for example Stripe, Cloudflare, Resend, Google, Expo and the sign-in services) also process data outside the UK and EEA, mainly in the United States. Where there is no adequacy decision (such as the UK–US data bridge for certified companies), we rely on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses.

8. 8. Retention

   Account data: while you have an account; when you delete it, we delete or anonymise it as described on the "Delete your account" page. Orders, invoices and payment records, including crypto transaction data: 6 years, as UK tax law requires. Support conversations: up to 24 months. Read in-app notifications: 180 days. Partner link clicks: the hashed IP address and browser are removed after 13 months.

9. 9. Your rights

   You can access, correct, export or delete your data in Settings → Privacy & data, or by emailing privacy@roambee.io. You can object to processing based on legitimate interest and withdraw consent at any time. You may lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

10. 10. Children

    Roambee is not directed at children under 16 and we do not knowingly collect their data.

11. 11. Changes

    The date at the top shows when this version took effect. We will tell you by email or in the app at least 14 days before a material change takes effect.