Legal

Privacy Policy

Effective 27 October 2026

This Privacy Policy explains how eSIM Grab handles information when you use our eSIM comparison website or an AI assistant connected to our MCP connector, follow links to providers, or contact us.

Optional advertising measurement. Depending on the visitor's country and privacy choices, we load OpenAI's ChatGPT Ads Measurement Pixel on public comparison pages and individual provider promo code pages during identifiable journeys from our OpenAI ads and measure when you follow a link to a provider. This records checkout intent, not a completed purchase or revenue. The Pixel may process your browser and device information, IP address, event time, website origin, and advertising attribution identifiers. We do not pass contact-form information, account details, or the provider's affiliate URL in these events. We do not load the Pixel on contact, sign-in, registration, or account pages. When OpenAI's automatic advanced matching is enabled, the Pixel can detect supported customer information present on a page and send normalized SHA-256 hashes; our measurement pages have no customer-information forms.

1. Information we collect

We may collect the following categories of information:

  • Information you submit. When you use our contact form, we receive your name, email address, company name if supplied, and the contents of your message.
  • Usage and device information. Our hosting, security, and analytics services may process your IP address, browser and device type, referring pages, pages viewed, approximate location, and event timestamps.
  • Preferences. We may store choices such as your selected currency or language in your browser so the site works as expected on later visits.
  • Assistant connector requests. The MCP connector processes the tool arguments sent by your assistant, such as destination searches, plan identifiers, countries in travel order, days in each country, data preferences, display currency, language, and continuation cursors. The public comparison tools do not require your name, booking documents, payment information, account credentials, or eSIM activation code. Avoid sending that information in tool requests.

2. How we use information

We use information to:

  • provide, maintain, secure, and improve the comparison service;
  • remember site preferences and present relevant plan information;
  • respond to messages and support requests;
  • measure site performance and understand aggregate usage; and
  • detect abuse, prevent fraud, and comply with legal obligations.

3. Affiliate links and provider websites

eSIM Grab contains links to independent eSIM providers. A provider may identify that you arrived through our referral link and may pay us a commission if you complete a purchase, at no extra cost to you. When you leave eSIM Grab, the provider's privacy policy applies. We do not receive your payment-card details or manage the eSIM order placed with that provider.

4. Cookies and local storage

Multi-country search drafts use this browser tab's session storage to remember country codes, stay lengths, and your data-use choice when you change language or switch search mode. Currency follows your separate saved preference. A comparison request sends the selected countries, days, data-use estimate, currency, and language; drafts contain no booking documents, traveler names, or reservation numbers.

We and our service providers may use cookies, local storage, or similar technologies that are necessary for security, core functionality, preference storage, and measurement. You can remove or block these using your browser settings, although some features may then work differently.

5. How information is shared

We use hosting and database service providers to process MCP connector requests, return comparisons, and protect the service against abuse. Your assistant platform operates under its own privacy policy. The public connector does not require access to your assistant account or complete conversation history. If you follow a provider link from a comparison, the provider's privacy policy applies as described above.

A small consent banner appears automatically only for identifiable OpenAI ad journeys in the European Union, European Economic Area and United Kingdom. Measurement there stays off until you select Allow. For US ad visitors, measurement can start without a consent banner after a fresh country-policy check, with a notice and Ad privacy choices in the footer. Other countries and unknown locations receive no automatic banner; measurement stays off unless you explicitly select Allow in the footer. Ordinary visitors without an identifiable ad journey are not measured by this Pixel. We use approximate country information supplied by our hosting provider to apply this policy; we do not infer permission from your language or currency. We store only your explicit Allow or Decline choice in local storage, never automatic regional permission. You can decline or withdraw permission at any time using Ad privacy choices in the footer. Do Not Track and Global Privacy Control signals keep this measurement off even if a previous choice allowed it. Declining does not affect plan comparisons or provider links. When measurement is permitted, OpenAI uses first-party __oppref cookies for attribution (up to 30 days) and __obref cookies for a random browser identifier (up to 365 days). OpenAI also stores its consent preference. Withdrawing permission stops future measurement and removes the attribution and browser-identifier cookies. These cookie lifetimes are separate from conversion attribution windows and data retention. A landing-page attribution parameter may be kept in memory before your choice; it is stored for measurement only after you allow it or a fresh US policy check permits measurement. After Allow, existing attribution can identify a later ad journey. A separate marker for automatic US measurement is read only after a fresh country-policy check and cannot grant permission in another country. Session-storage expiry markers let an eligible journey continue in the same tab. Each marker contains no click identifier and expires when the tab's session ends or after 30 days, whichever comes first. Withdrawal also removes these markers.

We may share information with vendors that provide hosting, databases, analytics, email delivery, security, and other services needed to operate eSIM Grab. PostHog provides product analytics and may process the usage and device information described above on our behalf. You can read PostHog's privacy policy for more information. We may also disclose information when required by law, to protect users or the service, or as part of a corporate transaction. We do not sell contact-form submissions or personal information for money.

Contact-form submissions are stored in Supabase and sent to our team through Resend. Resend processes your name, email address, optional company name, and message to deliver these notifications.

When advertising measurement is permitted, OpenAI receives the measurement information described above to help attribute provider-link clicks to our ads in ChatGPT. See OpenAI's privacy policy. We request that these events be excluded from future user-level personalization. Your advertising choice controls this optional OpenAI measurement separately from the site's existing PostHog product analytics.

6. International processing

Our users and service providers may be located in different countries. Information may therefore be processed outside the place where you live, under laws that may differ from those in your jurisdiction.

7. Retention and security

For multi-country comparisons, we use a daily pseudonymous identifier derived from the requesting network address to enforce request limits and bind temporary comparison records to the requesting client. These records contain the normalized itinerary, comparison settings, and continuation state. They expire after 15 minutes without use, with a maximum lifetime of one hour from creation. Expiry prevents further continuation access; bounded cleanup may remove stored state later. These access limits are not a deletion schedule for hosting logs or backups.

We retain personal information only for as long as reasonably necessary for the purposes described here, including support, security, legal, and recordkeeping needs. We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security.

8. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, or a copy of personal information, or to object to certain processing. You can also clear saved site preferences through your browser. We may need to verify your request before acting on it.

9. Children's privacy

eSIM Grab is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us.

10. Changes to this policy

We may update this policy as the service or applicable requirements change. We will post the revised version here and change the effective date above.

11. Contact us

To ask a privacy question or exercise a privacy right, use our contact form.