Privacy Policy
What we collect, why, who sees it, how long we keep it, and your rights.
Last updated September 21, 2026
1.Who we are
FulleSIM is built to know as little about you as a mobile network can. This policy says exactly what that is. The controller of your personal data is FulleSIM LTD.
- Privacy questions and requests: [email protected]
2.What we never collect
We do not ask for an identity document, a selfie, a home address or a date of birth, and we do not run identity checks. We do not store the content of your SMS or listen to your calls: messages and calls go to your phone, and we keep only the record that they happened. We do not use advertising trackers, we do not build profiles for marketing, and we do not sell or rent data to anyone.
3.Card or crypto: what exists about you
What exists about a purchase depends on how you pay.
| Paid by card | Paid in crypto | |
|---|---|---|
| Your name | Cardholder name, held by Stripe and your bank | None |
| Payment details | Card country and last four digits, via Stripe | The transaction, via Cryptomus |
| Country, for VAT | Card country and connection country | Country you declare and connection country |
| IP address | Recorded at checkout | Recorded at checkout |
| Identity documents | Never collected | Never collected |
A card payment is only as private as the card: your bank knows the purchase. If you want nothing tied to your name, pay in crypto.
4.What we collect, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Waitlist contact (email or Telegram username) | To tell you once when we launch | Your consent |
| Access code | To identify your line and let you sign in | Contract |
| Optional email address | To resend your access code and send notices about your line | Contract |
| Traffic data: calls, SMS and data sessions, with time, duration, volume and the network used | To route traffic, charge for it and handle disputes | Contract; legal obligation |
| Location data: the country and partner network your line is connected to | To connect you and apply the right rates; not used for anything else | Contract |
| Checkout record: IP address, country evidence, order and amount | VAT evidence and restricted-territory checks | Legal obligation |
| Payment record from Stripe or Cryptomus | To take payment, refund and prevent fraud | Contract; legal obligation |
| Support conversations | To help you and keep a record of what we agreed | Contract; legitimate interest |
| Rate-limit hash of a connecting IP | To stop automated abuse of our forms | Legitimate interest |
| Technical logs | To keep the service secure and working | Legitimate interest |
5.How long we keep it
| Data | Kept for |
|---|---|
| Waitlist contact | Until our launch message is sent, then 30 days; deleted at once if you unsubscribe |
| Access code and line record | While the line is active, then 12 months |
| Optional email address | While the line is active, then 12 months; deleted sooner on request |
| Traffic and location data | 12 months from the date of each record |
| Checkout record and VAT evidence | 10 years, as EU One Stop Shop VAT rules require |
| Support conversations | 12 months after the matter is closed |
| Rate-limit hashes | 10 minutes |
| Technical logs | 14 days |
Where a law in the jurisdiction we are registered in requires a longer period for a particular record, we keep that record for the period the law requires and no longer.
7.International transfers
Some recipients are outside the United Kingdom and the European Economic Area, and partner networks are by nature in the countries you travel to. Where data leaves the UK or EEA, the transfer relies on an adequacy decision or on standard contractual clauses, or is necessary to perform your contract, for example to connect you to a network abroad.
8.How we protect it
- Our database accepts connections only from the application on the same server, with no password stored on disk.
- Our server exposes no web ports to the internet; traffic reaches it through an encrypted tunnel.
- All traffic to this site is encrypted with TLS 1.2 or higher.
- Staff access personal data only when a support request or a legal obligation requires it.
- More detail is on our Security page.
9.Automated decisions
At checkout, an automated check refuses orders where the payment or connection points to a restricted territory. We do not otherwise make decisions about you by automated means, and we do not profile you. If an order is refused, you can ask support for a person to review it.
10.Your rights
- 10.1You can ask for a copy of your data, ask us to correct or delete it, restrict or object to its use, take it to another provider, and withdraw consent at any time where we rely on consent.
- 10.2Because we do not know who you are, we ask you to show that the data is yours before we act, for example by writing to us from your panel or giving us a one-time support code created there. We will never ask you to send us your access code.
- 10.3We answer within one month. For complex requests we may extend this by two further months and will tell you why.
- 10.4Some data we must keep by law, such as VAT evidence, cannot be deleted before its retention period ends.
- 10.5You can complain to the data protection authority where FulleSIM is registered or to the data protection authority of the country you live in.
Send requests to [email protected].
11.Children
The service is for people aged 18 and over. We do not knowingly collect data about children.
13.Changes to this policy
If we change this policy in a way that matters, we will tell you before it takes effect, through your panel and by email if you gave one. The date at the top shows the last change.