Privacy Policy
This Privacy Policy explains how AM Soft sh.p.k. (Tax ID M67611801A, the 'Data Controller') collects, uses, and protects your personal information in compliance with GDPR, CCPA, and applicable privacy laws.
Last updated: October 20, 2026
1. Data we collect
We collect the following categories of personal data: (a) Account information: name, email address, phone number, password (stored only as a secure hash); (b) Payment information: billing name and address, and the card's brand, country and last four digits; full card numbers are handled by our payment processor and never stored by us; (c) Device and connection information: IP address, browser or app user agent and, from the mobile network, the device model and the network your eSIM connects to; (d) Usage data: data consumption, plan activation and expiry, connection logs, and app and website interactions such as sign-ins and viewing your eSIM status; (e) Support communications: messages, attachments, feedback submitted to customer support.
2. How we use data
We process your data for the following purposes: (a) Service delivery: activating eSIMs, managing your account, and providing connectivity; (b) Payment processing: completing transactions and preventing fraud; (c) Customer support: responding to inquiries and resolving technical issues; (d) Communication: sending order confirmations, service updates, and promotional offers (with your consent); (e) Legal compliance: meeting regulatory obligations and responding to lawful requests; (f) Analytics: improving service quality and user experience.
3. Legal basis for processing
We process your data based on: (a) Contract performance: necessary to provide the services you requested; (b) Legitimate interests: fraud prevention, service improvement, and security; (c) Legal obligation: compliance with tax, accounting, and regulatory requirements; (d) Consent: marketing communications and optional features (you may withdraw consent at any time).
4. Sharing with trusted partners
We share data only when necessary with: (a) Payment processing: Stripe, for secure payments and fraud prevention, including the information needed to answer a payment dispute raised with your bank; (b) Connectivity partners: the eSIM providers and mobile network operators that issue and run your eSIM; (c) Infrastructure: our servers at Hetzner (Germany), backups at Cloudflare, email delivery (Resend) and app notifications (Firebase); (d) Support: our live-chat provider (Tawk.to); (e) Analytics and advertising: Google (Analytics, Ads) and Meta, only with your consent. With your marketing consent, when you buy or register on our website we send Meta an event with your email, phone and name in hashed (SHA-256) form, your IP address and browser user agent, to measure our ads (Meta Conversions API); (f) Legal authorities: when required by law or to protect our rights. We do not sell your personal data to third parties.
5. International data transfers
Our servers are located in the European Union (Germany). Some of the providers above (for example Stripe, Google, Meta and Cloudflare) may process data outside your country, including in the United States. We ensure adequate protection through Standard Contractual Clauses approved by the European Commission and other appropriate safeguards.
6. Security and retention
We apply industry-standard administrative, technical, and physical safeguards including encryption, access controls, and regular security audits. We retain personal data for: (a) Active accounts: duration of service plus 90 days; (b) Purchase records: 7 years for tax and accounting compliance; (c) Marketing consent: until withdrawn; (d) Legal claims: as required by applicable limitation periods.
7. Cookies and tracking
We use essential cookies for site functionality, analytics cookies to understand usage patterns, and marketing cookies for targeted advertising (with your consent). You can manage cookie preferences through your browser settings or our cookie consent tool.
8. Your rights and choices
Depending on your location, you have the following rights: (a) Access: obtain a copy of your personal data; (b) Rectification: correct inaccurate information; (c) Erasure: request deletion (subject to legal retention requirements); (d) Portability: receive your data in a structured format; (e) Objection: oppose certain processing activities; (f) Restriction: limit how we use your data; (g) Withdraw consent: opt out of marketing or optional features. To exercise these rights, contact privacy@novasim.al. We will respond within 30 days.
9. Children's privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the data promptly.
10. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified via email or prominent notice on our website at least 30 days before taking effect.
11. Contact and complaints
For privacy inquiries or to exercise your rights, email privacy@novasim.al or write to AM Soft sh.p.k., Privacy, Rruga Dames - Ninesh, Ndërtesa 4, Lagjja Memaj, Fratar, Mallakastër 9328, Albania. If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority or with Albania's Information and Data Protection Commissioner.
Analytics & marketing data
We process the following data for analytics and ad attribution: pseudonymous user identifiers from Google Analytics 4, page views, search terms typed into the AI search, product views, add-to-cart and purchase events, the source/campaign that referred you to novasim.al, and the Meta Conversions API events described in section 4. We do not sell this data. Legal basis: your consent, which you can withdraw at any time in the cookie settings.