Privacy Policy

This Privacy Policy explains how EMODAS LTD (Cyprus, reg. No. HE459036, Dalia Court, Flat 007, 7 Ikarou, Paphos 8041, Cyprus), operating the StayOn service at getstayon.com, processes personal data as a data controller under the EU General Data Protection Regulation (GDPR). Contact: hello@getstayon.com.

1. What we collect

• Order data: email address, purchased plan, order ID, order status, locale, timestamps.
• eSIM technical data: ICCID and activation parameters of the eSIM issued to you, data usage totals for your plan (provided by our network partner for service delivery and support).
• Payment data: processed entirely by Stripe Payments Europe Ltd. We receive payment status and the last 4 digits of the card; we never receive or store full card numbers.
• Website data: cookies and analytics events (pages viewed, device type, approximate location by IP) — see section 6.
• Checkout data: your IP address and browser or app details (User-Agent). We keep them to prevent fraud.
• Order source: the advertising campaign (utm tags) or partner link that brought you to the website, when you followed it, and whether you came from our Google ad. We do not store the ad click identifier. A visit through a partner link is recorded without your IP address: only the partner code and the landing page.
• App notifications: the push token of your device and its platform (iOS or Android), if you allow notifications.
• Support communications: emails and WhatsApp messages you send us.

2. Why we process it (legal bases)

• To deliver the service you purchased — contract performance (Art. 6(1)(b) GDPR): order processing, eSIM issuance, delivery emails, support.
• To meet legal obligations (Art. 6(1)(c)): accounting, tax, and consumer law records.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, service security, improving the website, attributing orders to the advertising campaign or partner link that brought you (to measure our advertising and pay commission to partners), for existing customers — occasional service emails about their eSIMs, and inviting customers to review their purchase on Trustpilot (see section 3). You can object at any time.
• Consent (Art. 6(1)(a)): non-essential cookies/analytics and marketing emails, where requested. Consent can be withdrawn at any time.

3. Who we share data with (processors and partners)

• Stripe — payment processing. Stripe receives payment data and device signals for fraud prevention.
• eSIM network partners (wholesale eSIM providers) — to issue and operate your eSIM; they process the technical identifiers needed to provide connectivity.
• Email delivery provider (e.g. Resend) and Microsoft 365 — to send and receive service emails.
• Firebase Cloud Messaging (Google) and Apple Push Notification service — to deliver notifications in the app. They receive the push token of your device and the notification text.
• Trustpilot (Trustpilot A/S, Denmark) — after your eSIM is delivered, we send Trustpilot your email address and order number so that it can invite you to review your purchase. Trustpilot does not receive your eSIM details; leaving a review is optional. Trustpilot processes this data under its own privacy policy (available on trustpilot.com). You can object by writing to hello@getstayon.com or unsubscribe using the link in the Trustpilot invitation.
• Voyage AI — the text of your search query when you search for a country, without any data about you.
• Partners (websites and services that recommend StayOn through a partner link) — receive a report on orders made through their own link only: date, shortened order number, destination, plan, amount, status and commission. Partners do not receive your email address, name or eSIM details.
• Hosting and infrastructure (EU-based servers, Hetzner, Germany/Finland).
• Analytics (e.g. Google Analytics) — on the website only, and only where you consent.
• Meta — on the website only, and only after you accept cookies: the Meta Pixel and server-side purchase events (Conversions API). With a purchase, Meta receives a hash of your email, your IP address, User-Agent and Meta cookie identifiers. Not used in the app. We do not sell personal data. Some partners (e.g. Stripe, Google, Apple, Meta, Voyage AI) may process data outside the EEA under appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions).

4. Retention

Order and eSIM records: while your account/orders are active and thereafter as required for accounting and legal claims (up to 6 years under Cyprus law). Support correspondence: up to 2 years. Analytics: up to 14 months. The IP address and User-Agent stored with your orders are erased when you delete your account, and push tokens are deleted together with the account.

5. Your rights

You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent. Write to hello@getstayon.com; we respond within one month. You may also lodge a complaint with your local supervisory authority or the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy).

6. Cookies

Essential cookies keep the site and checkout working and require no consent. Analytics cookies are set only after your consent via the cookie banner and can be declined without affecting the service. If you accept cookies, the visit source (campaign tags, partner link, the time you came from our ad) is kept in your browser for 30 days, in a getstayon.com cookie and in localStorage, so that a purchase on a later visit is attributed correctly. If you decline cookies or have not answered yet, nothing is stored on your device: the visit source is held only in the memory of the open tab and is sent with an order placed during the same visit (legitimate interests, section 2).

7. Children

Our services are not directed at children under 16, and we do not knowingly process their data.

8. Changes

We will post any changes on this page with an updated date.