Privacy policy
AeroSims
Which personal data AeroSims processes when you visit aerosims.com, buy and use an eSIM, chat with Sky or contact us. Why we do it, who helps us and in which countries, how long we keep data, and what rights you have.
Last updated: 2 October 2026 · Applies under the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the UK GDPR
At a glance
- Controller: AeroSims Minic, Zürich, Switzerland. Contact: support@aerosims.com.
- To deliver your eSIM we need your email address. We send our technical provider only an order reference and the plan code, never your name or email address. When you open the QR code, your My eSIM page or the eSIM check, and when you install and use the eSIM, the provider also receives technical data such as your IP address, the EID of your eSIM chip and your data usage.
- We never see your card number. Payments are handled by PayPal.
- Sky is an AI assistant. Chats are processed by Anthropic. We keep them for 30 days, longer only if a chat becomes a support case.
- If you are in the EEA, the UK or Switzerland, analytics, session recording, advertising and affiliate tracking run only with your consent. In other countries they may run from your first visit. Everywhere you can change your choice at any time under Cookie settings.
- Some providers work in the USA, Singapore, Hong Kong and Vietnam. Section 11 names every provider, its country and the safeguard we use.
- We make no automated decisions with legal or similarly significant effects on you, apart from automatically cancelling new orders from people we have blocked for abuse (section 9).
- You can ask for access, correction, deletion and more, and you can object at any time. Write to support@aerosims.com.
- Who is responsible
- What we process and on which legal basis
- Buying and receiving your eSIM
- Emails we send
- Chat with Sky, our AI assistant
- Contacting us
- eSIM check and speed test
- Cookies, analytics and advertising
- Fraud prevention and security
- Affiliate programme, reviews and customer quotes
- Service providers and countries
- How long we keep data
- Your rights
- Complaints to a supervisory authority
- Other information
- Version history
1Who is responsible
| Controller | AeroSims Minic (sole proprietorship under Swiss law; the owner is named in our Legal notice) |
|---|---|
| Business identification number (UID) | CHE-382.981.482 |
| Address | c/o ExpertFid & Audit SA, Strehlgasse 2, 8001 Zürich, Switzerland |
| support@aerosims.com (subject "Privacy request") | |
| Phone | +41 76 606 30 17 |
We have not appointed a data protection officer. Please send any question about your data to the email address above.
2What we process and on which legal basis
The table gives an overview. The following sections explain each purpose. The legal bases refer to the GDPR and the UK GDPR. Under the Swiss FADP we process data in line with its principles and ask for consent where the law requires it.
| Purpose | Legal basis |
|---|---|
| Selling and delivering eSIMs, long-term plans and extensions Section 3 |
Contract, Art. 6(1)(b) |
| Withdrawals and proof of your request to start right away Section 3 |
Legal obligation, Art. 6(1)(c); legitimate interest in proving the contract, Art. 6(1)(f) |
| Order and accounting records Section 3 |
Legal obligation, Art. 6(1)(c); for duties under Swiss law, legitimate interest, Art. 6(1)(f) |
| Service emails about your order and eSIM Section 4 |
Contract, Art. 6(1)(b); legitimate interest in helping you use your plan, Art. 6(1)(f) |
| Offers for similar plans to customers Section 4 |
Legitimate interest in direct marketing, Art. 6(1)(f). You can object at any time. |
| Review invitations Section 4 |
In the EEA, the UK and Switzerland: consent, Art. 6(1)(a). Elsewhere: legitimate interest, Art. 6(1)(f) |
| Reminders about an unfinished checkout Section 4 |
In the EEA, the UK and Switzerland: consent, Art. 6(1)(a). Elsewhere: legitimate interest, Art. 6(1)(f) |
| Chat with Sky and support Sections 5 and 6 |
Contract or steps before a contract, Art. 6(1)(b); legitimate interest in efficient support, Art. 6(1)(f) |
| eSIM check and speed test Section 7 |
Legitimate interest in helping you solve problems, Art. 6(1)(f) |
| Necessary cookies, website security, bot and fraud protection, block list Sections 8 and 9 |
Legitimate interest in protecting our shop and our customers, Art. 6(1)(f) |
| Analytics, session recording, advertising measurement, affiliate tracking, our Trustpilot rating Sections 8 and 10 |
In the EEA, the UK and Switzerland: consent, Art. 6(1)(a). Elsewhere: legitimate interest in understanding how our shop is used and in measuring our ads, Art. 6(1)(f) |
| Customer quotes on our website Section 10 |
Consent, Art. 6(1)(a) |
| Legal claims and requests from authorities As needed |
Legal obligation, Art. 6(1)(c), or legitimate interest, Art. 6(1)(f) |
Your right to object
Where we process your data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time without giving reasons, and we then stop. Write to support@aerosims.com or use the unsubscribe link in any marketing email.
3Buying and receiving your eSIM
- Shop and checkout. Shopify runs our shop and checkout. We process your email address, your name and billing details as you or PayPal provide them, what you ordered, the price, the order number, the language of our website and technical data of the order such as IP address and browser type.
- Payment. PayPal processes your payment as an independent controller under its own privacy statement. We receive the payment status, a transaction ID and the payer details PayPal passes on, such as name, email address and country. We never see your card number.
- Creating your eSIM. An automation service (Make) passes your order to our technical provider in Hong Kong, whose systems run in Singapore. From us the provider receives only the order reference and the plan code, and it creates your eSIM profile. The QR code in your delivery email and on your My eSIM page is loaded from the provider's server, which then receives your IP address. When your device installs the eSIM, it connects to the provider's server and transmits the EID of the eSIM chip. When you use the eSIM, the provider and the local mobile networks process connection and usage data under their own responsibility, as every mobile network does.
- Data we receive about your eSIM. From the provider we receive the eSIM number (ICCID), its status, the times of installation and first connection, the data used, the expiry date and the EID, a technical identifier of the eSIM chip in your device. We use these to deliver your eSIM, to show it on your My eSIM page, to offer extensions, to send usage and expiry notices and to help you when something does not work.
- Order record. We keep an order record (order number, name, email address, billing country, destination, plan, eSIM number, provider transaction number, status, price, discount code, how you found our shop and our cost) in a spreadsheet at Google, so that we can deliver, support and account for orders.
- Withdrawal. If you withdraw through our online form, by email or in the chat, we store your name, email address, order number, the content of your withdrawal and the date and time of receipt at Cloudflare, send you a confirmation and check your withdrawal against your order. For 90 days after a withdrawal we send you no offers and no review invitations. We also keep the record of your request at checkout to start right away (tick box, with date and time) as proof. To check a withdrawal, we use the billing country of your order and the status and usage of your eSIM, and we keep a record of our decision, the amount and our emails to you.
- My eSIM link. Your delivery email contains a personal link. Anyone with the link can see your eSIM, so please do not share it.
- Language. We remember the language in which you ordered for 400 days, so that later emails reach you in that language.
4Emails we send
Service emails
We send the emails you need for your purchase: order confirmation, eSIM delivery, installation help, a notice if your eSIM has not been used, notices when data is running low or your plan is about to end, and confirmations of extensions. Shopify sends the order confirmation, the delivery notice and refund confirmations. Our other emails come from support@aerosims.com: our automation service (Make) passes them to our Google Workspace account, which sends them.
Offers and review invitations
As a customer you may receive emails about similar AeroSims plans, for example an offer to extend your plan or a discount for your next trip. We ask you to review your purchase by email, either ourselves or, on our behalf, through Trustpilot and Judge.me; for this we pass them your name, email address and order reference. If you are in the EEA, the UK or Switzerland, we send review invitations only if you agreed to receive marketing emails at checkout.
You can object at any time, free of charge. Our own emails contain an unsubscribe link; review invitations from Trustpilot and Judge.me contain their own. If you write to support@aerosims.com, we stop all of them, including the invitations, and keep your address on a block list so that it stays that way.
Reminders about an unfinished checkout
If you enter your email address at checkout but do not complete the order, we may send you up to two reminders: the first a few hours later with a 5% discount code, the second one to three days later with a 10% discount code. In the EEA, the UK and Switzerland we send them only if you agreed to receive marketing emails at checkout. Every reminder contains a link to unsubscribe.
To avoid sending the same email twice, we keep a record of which emails we have sent for 200 days. Discount codes we send you are kept with your email address, name and order number for 370 days.
5Chat with Sky, our AI assistant
- Sky is an AI assistant. It answers questions about plans, setup and your order and can resend your delivery email. For this we process your messages, the page you are on, your language and a random chat ID.
- If you give Sky your order number and the email address of the order, or open Sky from your personal My eSIM link, Sky looks up your order and eSIM: status, plan, installation and expiry times, data usage, the last digits of the EID and your My eSIM link. Sky shows order details only if the order number and the email address match, or if you opened the chat from your My eSIM link.
- To generate replies, your messages and the order details Sky looks up are processed on our behalf by Anthropic (Anthropic Ireland, Limited, with processing in the USA). Under its commercial terms, Anthropic may not use them to train its models. Anthropic deletes them within 30 days; content flagged for a policy violation can be kept for up to two years.
- We store chats in our database at Cloudflare for 30 days. Your browser keeps the conversation for one hour so that you can continue it on another page, and then deletes it.
- A member of our team may read a chat and reply in it. When a person joins, the chat says so. Replies from our team may be translated with the help of AI (Anthropic). If you ask for a person or rate an answer as unhelpful, the last messages are sent to our team by email.
- If you ask Sky to, we send you one email with the plans you discussed. If you leave your email address so that we can get back to you, we use it only for that.
- Please do not enter passwords, card numbers or health information in the chat.
6Contacting us
When you write to support@aerosims.com, use our contact form, call us or message us on WhatsApp, we process your contact details, your message and the order details you give us, so that we can answer you.
- Emails are handled in Google Workspace. The contact form is provided by Shopify.
- Letters to our business address are received by ExpertFid & Audit SA in Zürich, the company that provides this address. It scans each letter on the day it arrives and emails the scan to us. It then shreds the original, unless we ask it to keep it.
- WhatsApp is operated by WhatsApp Ireland Limited (Meta). If you contact us there, WhatsApp's own terms and privacy policy apply to that channel.
- Our team answers personally in your language. For this, messages may be translated with the help of AI (Anthropic).
7eSIM check and speed test
Our eSIM check helps you find problems with your connection. When you use it:
- your browser measures the speed with Cloudflare's speed test servers;
- your browser checks whether popular services are reachable by contacting them directly;
- our server shows you the name of your network and the approximate location of your connection, based on your IP address. We do not store this, apart from our server logs, which are deleted after 7 days;
- if you open the page from your My eSIM link, your browser loads the status and usage of your eSIM directly from our technical provider's server (servers in Singapore) with the key in your link.
8Cookies, analytics and advertising
We use cookies and similar technologies such as browser storage and pixels. Necessary ones always run. If you are in the EEA, the UK or Switzerland, everything else runs only if you agree in our cookie banner. In other countries, analytics and advertising tools may run from your first visit. You can change your choice at any time under Cookie settings, at the bottom of every page of our shop.
| Tool and provider | Purpose and when it runs |
|---|---|
| Shopify Shopify International Limited, Ireland; Shopify group, Canada |
Shop, cart, checkout, security, storing your cookie choice. Always (necessary). |
| Shopify analytics Shopify International Limited, Ireland; Shopify group, Canada |
Statistics about visits and purchases in our shop. EEA, UK and Switzerland: only with consent (Analytics). Elsewhere: from your first visit until you switch it off. |
| AeroSims settings AeroSims |
Your cookie choice, the currency you picked, your chat history (one hour) and whether the chat teaser was already shown in this browser session; stored only in your browser. Always, or when you use the feature. |
| Blockify Cyber Software Joint Stock Company (OmegaTheme), Vietnam |
Detects bots, fraud and anonymising services and may block them. For this it receives technical data of your visit (IP address, approximate location, browser) and, when you order, your name, email address and phone number. The security check always runs. Its tracking pixel follows your analytics choice. |
| Trustpilot Trustpilot A/S, Denmark |
Shows our Trustpilot rating. EEA, UK and Switzerland: only with consent (Marketing). Elsewhere: from your first visit until you switch it off. |
| Google Analytics 4 Google Ireland Limited; Google LLC, USA |
Visitor statistics. EEA, UK and Switzerland: only with consent (Analytics). Elsewhere: from your first visit until you switch it off. |
| Microsoft Clarity Microsoft Ireland Operations Limited; Microsoft Corporation, USA |
Session recordings and heatmaps: clicks, scrolling and mouse movement. Numbers and email addresses are masked. Clarity does not run on your My eSIM page and on the eSIM check. EEA, UK and Switzerland: only with consent (Analytics). Elsewhere: from your first visit until you switch it off. |
| Judge.me Judge.me Ltd, United Kingdom |
Review widgets and review statistics. EEA, UK and Switzerland: only with consent (Analytics). Elsewhere: from your first visit until you switch it off. |
| Meta Pixel and Conversions API Meta Platforms Ireland Limited; Meta Platforms, Inc., USA |
Measuring and improving our ads on Facebook and Instagram. Through the Conversions API, Shopify also sends events from its servers, including your email address and phone number in hashed form. Meta uses the data to match visits to Meta accounts and to optimise and personalise ads. EEA, UK and Switzerland: only with consent (Marketing). Elsewhere: from your first visit until you switch it off. |
| UpPromote Secomus Technology JSC, Vietnam |
Recording referrals from affiliate partners for 30 days. EEA, UK and Switzerland: only with consent (Marketing). Elsewhere: from your first visit until you switch it off. |
- Meta: we and Meta are jointly responsible for collecting the data on our website and passing it to Meta (Art. 26 GDPR). Meta is responsible for its own processing afterwards. You can exercise your rights with us or with Meta. The essence of our arrangement with Meta: Meta Controller Addendum.
- Microsoft Clarity: we and Microsoft are jointly responsible for collecting the data on our website and passing it to Microsoft. Microsoft then uses it for its own purposes, including advertising, as an independent controller.
- US state privacy laws: if you live in a US state with such a law, see Your privacy choices. We respect Global Privacy Control signals as described there.
9Fraud prevention and security
- To protect our customers and ourselves from fraud, we check orders for warning signs, such as several orders from the same IP address within a short time, disposable email addresses or Shopify's risk assessment. These checks only alert us, and a person decides what happens.
- If a person has abused our service, we may put their email address, name and the EID of the device they used on a block list. We decide this individually. New orders that match the block list are cancelled and refunded automatically, and the eSIM is deactivated. If you think this happened by mistake, write to support@aerosims.com and a person will review it.
- Blockify checks visits automatically and can block a visit from a suspicious connection (section 8). If you were blocked by mistake, please write to us.
- We protect data with encrypted connections, personal keys for My eSIM links and access controls with two-factor authentication for our team. We remove the key from the page address before any analytics or advertising tool loads. If a data breach is likely to put you at high risk, we inform you and the authorities as the law requires.
10Affiliate programme, reviews and customer quotes
- Partners who recommend us receive a commission. If you arrive through a partner link and accept marketing cookies, UpPromote records the referral for 30 days and links it to your order, so that we can pay the commission. For this UpPromote receives the order number, the order amount and your name and email address.
- If you join our affiliate programme yourself, UpPromote processes your account and payout details under the programme terms.
- Reviews you write on Trustpilot or Judge.me are published with the name you enter. The platforms process them under their own terms. We may reply to reviews and report reviews that break the rules of the platform.
- With the customer's permission we publish short quotes from messages customers sent us, with the first name, the initial of the surname, the country and the month. Customers can ask us to remove their quote at any time.
11Service providers and countries
Processors act only on our instructions under a data processing agreement. Independent controllers are responsible for their own processing.
| Provider and role | Country and safeguard |
|---|---|
| Shopify International Limited and Shopify Inc. Shop, checkout, order data, contact form (processor). For fraud prevention and to improve its services across shops, and for its Shop app and Shop login, Shopify acts as an independent controller under its own privacy policy. |
Ireland; Canada (adequate); other countries under Shopify's binding corporate rules and Standard Contractual Clauses |
| PayPal Payment (independent controller) |
The PayPal company responsible for your account, for example PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg |
| Technical eSIM provider Creates and runs your eSIM; for the mobile service an independent provider |
Hong Kong; servers in Singapore (Amazon Web Services). Transfer necessary to perform our contract with you (Art. 17(1)(b) FADP, Art. 49(1)(b) GDPR) |
| Cloudflare, Inc. Hosting of our chat, the My eSIM data service and our databases (processor) |
USA and Cloudflare's data centres worldwide. Data Privacy Framework and Standard Contractual Clauses |
| Anthropic Ireland, Limited AI for Sky and for translating replies (processor) |
Processing in the USA. Standard Contractual Clauses |
| Make (Celonis) Automation of order delivery and emails (processor) |
EU data region |
| Google Ireland Limited, Google LLC Email and order spreadsheet (Google Workspace), Google Analytics (processor) |
Ireland and USA. Data Privacy Framework and Standard Contractual Clauses |
| ExpertFid & Audit SA Business address: receiving and scanning our letters and forwarding them by email (processor) |
Switzerland |
| Microsoft Ireland Operations Limited; Microsoft Corporation Clarity session recording (joint controller for collection, then independent controller) |
Ireland and USA. Data Privacy Framework and Standard Contractual Clauses |
| Meta Platforms Ireland Limited, WhatsApp Ireland Limited Ad measurement (joint controller); WhatsApp messages (independent controller) |
Ireland and USA. Data Privacy Framework and Standard Contractual Clauses |
| Trustpilot A/S Review invitations (processor) and review platform |
Denmark |
| Judge.me Ltd Review requests and widgets (processor) |
United Kingdom (adequate) |
| Secomus Technology JSC (UpPromote) Affiliate tracking (processor) |
Vietnam. We have asked the provider for Standard Contractual Clauses. |
| Cyber Software Joint Stock Company (Blockify) Fraud and bot protection |
Vietnam; hosting by Leaseweb. We have asked the provider for the server location and for Standard Contractual Clauses. |
Switzerland, the EEA and the United Kingdom recognise each other's data protection as adequate, and all three recognise Canada. For the USA we rely on the Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses. Singapore, Hong Kong and Vietnam are not recognised as adequate; the table shows the safeguard for each provider. You can ask us for a copy of the safeguards at support@aerosims.com.
12How long we keep data
| Data | How long |
|---|---|
| Orders, invoices and payment records | 10 years (Swiss accounting law, Art. 958f Code of Obligations) |
| Order spreadsheet | Name and email address 3 years, other order data at most 10 years |
| Language of your order | 400 days |
| Discount codes we sent you (email address, name, order number) | 370 days |
| Record of service emails sent | 200 days |
| Chats in our database | 30 days |
| Chats at Anthropic | Up to 30 days; content flagged for a policy violation up to two years |
| Chat history in your browser | One hour |
| Technical logs of our servers (Cloudflare) | 7 days |
| Team alerts (chat excerpts, fraud warnings, contact requests) | 90 days |
| Support emails and messages | 3 years after the case is closed |
| Withdrawals and the record of your request to start right away | 3 years after the end of the year in which we received them |
| Opt-out list and block list | As long as needed to respect your objection or to prevent further abuse |
| Clarity recordings | 30 days; recordings we mark and a random sample chosen by Microsoft up to 9 months |
| Google Analytics data | 14 months |
| Meta browser cookie | Up to 90 days |
| UpPromote referral | 30 days |
After that we delete or anonymise the data, unless we need it for legal claims.
13Your rights
You have the right to:
- get access to your data and a copy of it;
- have incorrect data corrected;
- have data deleted or its processing restricted;
- receive the data you gave us in a common format (data portability);
- object to processing based on legitimate interests, and at any time to direct marketing (your right to object);
- withdraw your consent at any time with effect for the future, for cookies under Cookie settings;
- complain to a supervisory authority (section 14).
The Swiss FADP gives you comparable rights, in particular to access (Art. 25) and to data portability (Art. 28).
To use your rights, write to support@aerosims.com. To protect your data, we first confirm your identity, usually with your order number and the email address you used. We answer within one month, and under the FADP within 30 days. This is free of charge.
14Complaints to a supervisory authority
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.
- EEA: the data protection authority of the country where you live or work, or where the alleged infringement took place. List of authorities.
- United Kingdom: Information Commissioner's Office, ico.org.uk.
15Other information
- Required data. Without an email address we cannot deliver your eSIM. Everything else you give us is voluntary.
- Automated decisions. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR, Art. 21 FADP), with one exception: new orders from people we have blocked for abuse are cancelled automatically (section 9). Our bot protection can also block a visit from a suspicious connection automatically. In both cases you can write to us, and a person will check it.
- Children. Our shop is not intended for children under 16.
- Changes. We update this policy when our services or the law change. The date at the top shows the current version.
Version history
| Date | What changed |
|---|---|
| 2 October 2026 | New policy written by AeroSims. Replaces the automatically generated Shopify text of 7 September 2026. Names all providers and countries, adds the AI chat, session recording, retention periods and supervisory authorities. |
Questions about your data?
Write to us with the subject "Privacy request".
Email support@aerosims.comAeroSims · Switzerland · support@aerosims.com
Terms of Service · Refunds and withdrawal · Privacy · Delivery · Contact · Legal notice