Privacy Policy

GEAR Ventures LLC, DBA Simchalo ("Simchalo," "we," "us," or "our") operates simchalo.com. This Privacy Policy describes what personal data we collect, how we use it, and your rights.

1. What We Collect

When you purchase from Simchalo, we collect:

• Email address — provided by you at checkout. Used to deliver your eSIM QR code and order confirmation.
• WhatsApp phone number — if you initiate a purchase through our WhatsApp Business channel (+1 301-200-1886). Used solely to deliver your eSIM QR code and activation details via WhatsApp and to maintain your session during the purchase flow. We do not use your WhatsApp number for marketing or share it with third parties beyond what is necessary to deliver your order.
• Order and purchase metadata — order ID, plan purchased, purchase timestamp, and provisioning status. Retained for order history and fulfillment auditing.
• IP address and device/browser metadata — collected automatically by our hosting infrastructure (Vercel). Used for security and fraud prevention.
• Payment data — we do not store your card number, CVV, or full payment credentials. All payment processing is handled by Stripe, Inc., which is PCI DSS Level 1 certified. See Stripe's Privacy Policy.

2. How We Use Your Data

• To deliver your eSIM activation code by email or WhatsApp, depending on how you purchased.
• To maintain your order record and respond to support requests.
• To detect and prevent fraud and abuse.
• If you provide explicit consent, to send you travel tips, promotions, or product updates. Each such email will include an unsubscribe link.

We do not use your data for advertising targeting, profiling, or sale to third parties.

3. Third Parties We Share Data With

• Stripe — payment processing. Receives your payment credentials directly; we receive only a token.
• Resend — transactional email delivery. Receives your email address to send your QR code and order confirmation.
• Supabase — managed database and file storage. Hosts your order record and the QR code image.
• Vercel — web hosting and serverless compute. Processes requests and collects standard server logs including IP addresses.
• eSIM Access — our eSIM provisioning provider. Receives the order request to generate your activation code. No personal data beyond what is necessary for provisioning is shared.
• Meta Platforms, Inc. (WhatsApp) — if you purchase via our WhatsApp channel, your messages and phone number are processed by Meta through the WhatsApp Business Platform. See WhatsApp's Privacy Policy. We access your phone number and message content only to the extent necessary to process your eSIM order and deliver your activation details. We do not use this data for advertising.

All third parties are prohibited from using your data for their own marketing purposes.

4. Data Retention

Order records (email, order metadata, provisioning status) are retained for 2 years from the date of purchase for customer support and fraud prevention purposes, then deleted. Server logs are retained by Vercel per their standard retention policy (typically 30 days).

5. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing support@simchalo.com. We will respond within 30 days. Note that we may retain certain data as required by law or for legitimate fraud prevention purposes.

6. California Residents (CCPA)

Simchalo does not sell or share your personal information for cross-context behavioral advertising. California residents have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. To exercise these rights, email support@simchalo.com.

7. European and UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, the following applies:

• Lawful basis for processing: We process your data to perform the contract (deliver your eSIM) and, for marketing emails, on the basis of your explicit consent.
• Your rights: You have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to withdraw consent at any time and to lodge a complaint with your supervisory authority.
• Data transfers: Your data may be processed in the United States. By using our service, you acknowledge this transfer.

To exercise any GDPR rights, email support@simchalo.com.

8. Children

Simchalo is intended for users 18 and older. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a minor, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.

10. Contact

Privacy questions or requests: support@simchalo.com. GEAR Ventures LLC, DBA Simchalo, 6650 Rivers Ave Ste 100, Charleston, SC 29406.