Privacy Policy

1. Who we are and what this policy covers

WISE INTERNATIONAL LLC, a Wyoming, United States limited liability company operating as Zebra eSIM, is responsible for the personal information it handles through zebraesim.com, direct eSIM purchases and our support channels. This Privacy Policy explains the information involved, why it is used, the recipients, retention and your choices. Where applicable data-protection law uses the term, we are the controller for our own processing.

This policy covers our handling of your information. A payment provider, telecommunications operator or other independent service may also process information under its own notice and legal obligations. Reading or accepting our Terms does not waive privacy rights or provide consent for an unrelated use. Contact support@zebraesim.com with privacy questions or requests.

Mailing address: 1021 E Lincolnway Unit 1588, Cheyenne, Wyoming 82001, United States.

2. Information you provide

We receive the email address you use for sign-in, purchase or support; your selected plan and purchase details; and messages, device information, screenshots or other evidence you choose to provide when requesting help or a refund. If you buy for another traveler, only provide information you are entitled to share and let them know about relevant privacy and installation information.

Do not send passwords, full payment-card numbers, card security codes, government identity documents or unrelated sensitive information through ordinary support messages. If a particular legal or ownership check requires additional information, we will explain the request and the appropriate submission method. Our normal account sign-in uses email verification rather than requiring you to create a password.

3. Purchase, payment and eSIM records

We keep records needed to connect your account to a purchase and deliver the service: account and order identifiers, selected plan conditions, price and currency, payment status and transaction references, credit and refund entries, and delivery or troubleshooting records. eSIM records may include profile identifiers such as ICCID, installation credentials, activation status, validity and usage totals supplied by telecommunications service partners.

Stripe collects payment details through its checkout. Our application uses payment references and, for some fraud reviews, a hashed payment-instrument identifier; that identifier is not a full card number. We do not ask you to enter a full card number or security code into a Zebra eSIM support form. A service-status or data-usage record does not mean we receive the content of your calls, messages or web browsing.

4. Technical information and sources

When you use the website, our infrastructure and security services process connection information such as IP address, request and browser headers, timing, errors and security events. Authentication and support protections may use hashed identifiers to limit abuse. Language settings and the browser storage described below help the website remember your choices and continue a checkout or support session.

We obtain information directly from you, from your use of the Services, and from payment, eSIM and support providers returning records relevant to your transaction or request. Our ordinary account and checkout flows do not request precise GPS location, biometric identifiers or an unrelated browsing history. If a future feature needs a new category or permission, it requires an appropriate notice and any legally required consent.

5. Why we use information

We use information to authenticate accounts, process payments, issue and manage eSIMs and compatible top-ups, show order status, respond to support and privacy requests, review cancellations and refunds, prevent fraud and misuse, secure the Services, reconcile transactions and meet accounting, dispute and legal obligations. Operational records also help us identify and fix service failures.

Where a law requires a legal basis, the relevant basis depends on the activity: performing the purchase contract, meeting a legal obligation, pursuing a proportionate legitimate interest in operating and securing the service, or obtaining consent for a use that requires it. An optional marketing or new sensitive-data use is not authorized merely by a purchase. Withdrawing consent does not affect an earlier lawful use or information we must process on another applicable basis.

6. Service providers and other recipients

Information is disclosed as needed for the purposes above. Cloudflare provides website hosting, data storage and security services, including Turnstile where used. Stripe processes payments and associated fraud or refund records. Telecommunications service partners receive the identifiers and service instructions needed to issue, manage and troubleshoot an eSIM. Spacemail handles our support mailbox. Authorized personnel access records needed to assist you and operate the service.

When an AI-assisted support feature is enabled, the limited information described in the next section may also be sent to its configured model service. Providers may have independent legal responsibilities for some processing, as explained in their own privacy notices. We may disclose relevant records to advisers, competent authorities or another party where necessary to comply with law, protect legal rights or investigate misuse. A business transfer may involve relevant records subject to the applicable privacy obligations; it is not permission for an unrelated use of your support messages.

7. AI-assisted support

Website support has two AI modes. The legacy selector sends bounded approved guidance and service categories to OpenAI, without raw questions/history. Enabled chat sends your accepted question (up to 1,200 characters), up to six recent user/assistant messages (6,000 characters total) and current server-checked policy/public plan facts to OpenAI. The server adds no account names, emails, installation credentials or private order/payment records. Recognized sensitive credentials and identifiers are blocked before message storage or model dispatch, but screening cannot detect every item of personal information in free text. Do not enter private order links, QR/installation codes, full card details, passwords or unrelated sensitive data. A session correlation identifier can link a request within our systems; bounded input is not necessarily anonymous.

Staff-requested email drafts send redacted, shortened subject/body and at most two earlier inbound messages to configured OpenAI, DeepSeek or Z.ai. Redaction is imperfect. Email input excludes raw attachments, full headers, recipients, internal notes and member/order/payment IDs. Chat generates answers from questions and checked facts; the legacy selector and email drafts select approved guidance. Email drafts require human review and are not automatically sent. AI does not approve refunds or change accounts; the manual mail workflow has no automatic provider fallback. Website requests use store: false, which does not promise zero provider retention or that data is never used for another purpose; applicable provider terms/settings apply. Ask for human handling of sensitive, account, refund or privacy matters.

8. Cookies and browser storage

Our sign-in cookies maintain a session and protect email verification. The session cookie lasts up to seven days; the sign-in challenge cookie lasts up to five minutes. The zebra-language preference cookie can remember your chosen language for up to one year. A support guest cookie can identify an eligible guest session. Browser session storage can preserve an unfinished checkout selection or a support conversation reference; local storage can remember whether you hid the support widget.

You can clear or block cookies and browser storage through your browser. This can sign you out, remove saved choices or prevent a protected feature from working. Stripe checkout and Cloudflare security features may process additional technical information under their own notices. Our current storefront does not deploy cross-site advertising pixels or create cross-context advertising profiles. The website does not currently change its behavior in response to a browser Do Not Track signal. Any legally required opt-out preference signal remains subject to the rights described below.

9. How long records are retained

Retention depends on the purpose and the record. Account, order, eSIM, payment, credit and refund records may be needed while a service, balance or claim remains open and for applicable accounting, fraud-prevention and legal requirements. They are not all covered by the support-message deletion schedule. We do not state one fixed retention period for every record or promise that every third-party copy disappears when an account is closed.

Our local support retention rule schedules message content, including accepted website questions and AI conversation answers, email AI drafts and local contact data for removal after 90 days following case closure, during the next successful maintenance cycle. Open cases and cases under a dispute or legal hold are retained while the relevant need remains; a new reply can reopen a closed case. Managed local email-support backups last at most seven days and are removed earlier if they contain closed-case content due for deletion. Cached AI answers are erased too; content-free deduplication, policy-version and cost-audit records may remain. This local rule does not delete original Spacemail messages, model-provider records or independently maintained backups; those have separate retention arrangements. You may request deletion sooner where the law provides that right.

10. Your privacy choices and requests

Depending on the law that applies, you may request access to personal information, correction, deletion, a portable copy, restriction of processing, objection to certain uses, or withdrawal of consent. You can contact support@zebraesim.com without creating a new account. Describe the request and the email or order reference involved; do not include passwords, installation codes or full payment details.

We may ask for proportionate information to verify an access, correction or deletion request and protect another person's data. An authorized agent may submit a request where permitted, subject to appropriate authority checks. We will respond within the applicable legal timeframe, explain a lawful refusal or extension, and provide an appeal route where required. Some records may need to remain for an unresolved transaction, claim or legal obligation. We will not unlawfully discriminate against you for exercising a privacy right. Optional marketing, if offered, must provide an appropriate way to withdraw or opt out; essential transaction and security messages are separate.

11. United States state privacy rights

Where the California Consumer Privacy Act or another applicable state privacy law covers you and our processing, its additional rights apply. These may include knowing the categories, sources, purposes and recipients of information; access, correction and deletion; and opting out of a legally defined sale, sharing for cross-context behavioral advertising, or certain profiling. Applicable laws may also provide rights concerning sensitive information and an appeal of a request decision.

The categories, sources, purposes and recipient types relevant to our Services are described above. Our storefront does not use account, order or support information to build cross-context advertising profiles. Service-related disclosures are still subject to any legal classification and applicable opt-out duties; a provider relationship is not a blanket exemption. Send an applicable request to support@zebraesim.com. An opt-out request does not require verification of identity beyond information needed to identify the records concerned, and a legally binding browser opt-out signal must be respected where it applies. This policy does not assert that every state statute applies to every customer.

12. International processing

We are a United States company and work with infrastructure, payment, telecommunications and support providers operating in multiple countries. Information may be processed in the United States and in other countries where those services or authorized personnel operate. A country may have different privacy protections from your country of residence; the eSIM's roaming destination is not a promise about the storage location of all associated information.

Where applicable law requires a transfer mechanism or other safeguards, the transfer must meet those requirements. We do not claim that every provider stores information exclusively in the United States, or that every destination has an adequacy decision. Contact us for information about the processing relevant to your request. A visit to the website alone does not constitute consent to a transfer where the law requires a separate, informed consent.

13. Security and private credentials

We use measures designed to limit unauthorized access, including protected website connections, controlled account sessions, ownership checks and restricted administrative access. Support model inputs are limited as described above. The level and form of protection depend on the system and the information involved; no internet transmission or storage method guarantees absolute security.

You can help by protecting your email account, sign-in codes, private order links and eSIM installation credentials. Do not post these publicly. Notify support@zebraesim.com promptly if you believe your information or service credentials have been exposed. If an incident triggers a legal notification obligation, we will act under the applicable requirements.

14. Children

Our website, accounts and support channels are intended for adults purchasing travel services and are not directed to children under 13. Children should not create an account or submit personal information to us. An adult can purchase a compatible plan for a traveler in their care and handle the account and support interactions.

If you believe a child under 13 has supplied personal information directly to us, contact support@zebraesim.com. We will review the situation, stop any impermissible processing and arrange deletion or another response required by applicable law.

15. Independent services and telecommunications networks

Links to a device maker, travel service or another website take you to an independent service with its own privacy practices. Stripe and telecommunications operators may collect additional information when you use their services. Network operators may handle connection, device, usage or network-location data needed to provide communications or meet their own legal obligations.

Their processing is not described as if it were all controlled by Zebra eSIM. Read the relevant provider's notice and contact us if you need help identifying the service relevant to your eSIM or payment. A link does not grant a third party permission to use your Zebra eSIM account or support records for an unrelated purpose.

16. Updates, language and contact

We will post an updated date and version when this policy changes. Where required, a material change will receive an additional notice and any necessary consent before a new use begins. A revision is not retroactive permission to use previously collected information for an incompatible purpose.

English is the authoritative text; Chinese is a reference translation. Any mandatory local-language requirement or non-waivable privacy right remains effective. For an access, correction, deletion, opt-out, appeal or other privacy request, contact WISE INTERNATIONAL LLC, operating as Zebra eSIM, at support@zebraesim.com. Put "Privacy request" in the subject if helpful. You may also contact a competent data-protection or consumer authority where the law provides that right.

Mailing address: 1021 E Lincolnway Unit 1588, Cheyenne, Wyoming 82001, United States.