Privacy Policy

Personal data processing policy

Version of 29 September 2026

This is an English translation of the Russian-language privacy policy, provided for convenience. If the two texts differ, the Russian text prevails.

1. General

1.1. This Policy explains what personal data Individual Entrepreneur Boris Samsonovich Binyaminov (INN 780111974601, OGRNIP 325784700187105), the “Operator”, processes, why, who receives it and how it is protected. The Operator is the controller of this data. The Policy is published under Part 2, Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law”).

1.2. The Policy covers data the Operator receives from users of:

• the website https://esimello.com;
• the Telegram bot @eSIMello_bot and the mini app opened from it;
• the support bot @esim_unlimited_support_bot.

Together, the “Website”.

1.3. The terms of sale of eSIMs are set out in the Public Offer. The terms “Order”, “Account” and “Payment Service” have the meaning given in the Offer.

1.4. The Operator processes only the data needed for the purposes below. The Operator does not process special categories of personal data (health, beliefs and the like) or biometric data, and does not send marketing emails or messages.

2. What data, why, and on what legal basis

2.1. Registration and sign-in with an email address. Data: email address, password hash (the password itself is not stored), the date the address was confirmed, registration and last sign-in dates, the number of failed sign-in attempts. Legal basis: entering into and performing a contract with the user (Item 5, Part 1, Article 6 of the Law).

2.2. Sign-in through Telegram, the bot and the mini app. Data: Telegram user ID, username, name and profile photo link, to the extent Telegram provides them. Legal basis: entering into and performing a contract.

2.3. Placing, paying for and delivering an eSIM. Data: the selected plan and quantity, billing country, amount and currency, payment identifiers at the Payment Service, payment status, order number, ICCID and eSIM status, installation data, data usage and package validity. Legal bases: performing the contract, and the Operator’s tax and accounting obligations (Items 2 and 5, Part 1, Article 6 of the Law).

2.4. Service messages. Sign-in and address confirmation links are sent by email; Order status messages are sent through the Telegram bot. This uses the data in Clauses 2.1 and 2.2. Legal basis: performing the contract.

2.5. Customer support. Data: Telegram name, username and ID, message text, photos and files sent, and the Order number or ICCID if the user provides them. The support bot may answer common questions automatically using OpenAI; a request that needs a person is passed to a support agent together with the conversation history. Legal bases: performing the contract and the Operator’s legitimate interest in answering requests (Items 5 and 7, Part 1, Article 6 of the Law).

2.6. Security and abuse prevention. Data: IP address, request time and address, browser information the browser sends itself, and the number of requests from one address. Used to protect against password guessing, fraud and overload of the Website. Legal basis: the Operator’s legitimate interest and its duty to keep data secure (Item 7, Part 1, Article 6 and Article 19 of the Law).

2.7. Bank card details are entered on the Payment Service page. The Operator does not receive, see or store them.

3. Cookies and browser storage

3.1. The Website uses only what is technically necessary:

3.2. The Website uses no analytics or advertising cookies and no visitor counters.

3.3. When Website pages open, the browser loads fonts from Google servers and the mini app script from Telegram servers, and on the payment page the Paddle script. These companies receive the visitor’s IP address and browser information, and Paddle may set its own cookies on the payment page. Cloudflare, which carries the Website’s traffic, may set technical cookies to protect against attacks.

3.4. Cookies can be deleted or blocked in browser settings. Without the esim_session cookie, signing in to the Account is not possible.

4. Who receives the data

4.1. The Operator does not sell personal data. It shares data only to the extent needed for the purposes in Section 2:

4.2. The eSIM supplier (the Operator’s partner mobile operator) receives only the Order parameters: plan, quantity and transaction number. It does not receive the user’s name, email address or Telegram data.

4.3. The Operator discloses data to public authorities only where and as required by the laws of the Russian Federation.

5. Storage and international transfers

5.1. The Website database is hosted on a server in Germany. Some recipients in Section 4 are located outside the Russian Federation, so processing involves international transfers of data. These are made to the extent needed for the purposes in Section 2, in accordance with Article 12 of the Law.

5.2. Retention periods:

• account data (Clauses 2.1 and 2.2) — while the account exists;
• Order and payment data (Clause 2.3) — 5 years after the end of the year in which the payment was made, as tax law requires;
• support correspondence (Clause 2.5) — 3 years after the last request, the limitation period for claims;
• technical logs (Clause 2.6) — no more than 6 months;
• database backups — 14 days, after which they are overwritten.

5.3. When the retention period ends, the purpose of processing is achieved, or the user makes a justified request, the data is destroyed or anonymised within 30 days. Data the Operator is required by law to keep is destroyed once the statutory period ends.

6. How data is protected

6.1. The Operator takes the legal, organisational and technical measures required by Articles 18.1 and 19 of the Law, including:

• connections to the Website are encrypted (HTTPS);
• passwords are stored only as hashes (scrypt), and sign-in tokens and email links only as hashes, so a database leak does not expose them;
• sign-in attempts are limited, and sign-in is temporarily blocked after a series of failures;
• server access is restricted, server sign-in is by key only, and inbound connections are limited by a firewall;
• secrets and tokens are removed from technical logs;
• the database is backed up daily, and restoring from backups is tested regularly.

6.2. The Operator is personally responsible for organising the processing of personal data.

7. User rights

7.1. The user has the right to:

• obtain information about the processing of their data: what data is processed, on what basis, for what purpose, who receives it and how long it is kept;
• have data corrected if it is incomplete, inaccurate or out of date;
• have data blocked or destroyed if it is processed unlawfully or is not needed for the stated purpose;
• delete their account. Data the Operator is required by law to keep (Clause 5.2) is retained until the statutory period ends;
• withdraw consent where processing is based on consent;
• complain about the Operator’s actions to Roskomnadzor (rkn.gov.ru) or to a court.

7.2. Users in the European Union and the United Kingdom also have the rights provided by the GDPR, including the right to data portability, the right to object to processing, and the right to lodge a complaint with the data protection authority of their country.

7.3. Requests are sent to boris.binyaminov@gmail.com from the address registered in the account, or to the support service in Telegram from the account used to sign in, so the Operator can confirm that the request comes from the data owner. The Operator responds within 10 business days of receiving the request. This period may be extended by up to 5 business days, in which case the Operator will explain why.

8. Minors

8.1. The Website is intended for people over 18. A person under 18 may use the Website only with the consent of a legal representative. If the Operator learns it has received a child’s data without such consent, it will delete it.

9. Changes to the Policy

9.1. The Operator may change the Policy by publishing a new version on the Website at https://esimello.com/privacy. The new version applies from publication. The version date is shown at the top of the document.

9.2. The Policy is drawn up in Russian. This English translation is published on the Website for convenience. If the texts differ, the Russian text prevails.

10. Operator contacts