eSIM Coupon
What this site records, and what it does not
This page describes the processing that actually happens on esim.qpon, checked against the installation rather than copied from a template. Where a fact has not been decided yet, it says so instead of guessing. Last updated 27 August 2026.
It sets out the sections a privacy policy needs and fills in the parts that can be verified from the site itself. The entity details, retention periods and governing law are decisions, not facts to be discovered, and they are marked below. Have someone qualified review this before it is relied on.
Who is responsible for your data
The legal entity name, the entity type, the country of registration and a postal address. A privacy policy without an identifiable controller gives a reader no one to exercise their rights against, and in the EU and UK that is the first thing the policy is required to state.
What is actually collected
Everything in the left column was confirmed against the running site. The right column lists things this site does not do, which is as much a part of the picture.
- The contact form. Fields currently collected: name, email, provider, coupon, page_url, message. Each submission is saved in the WordPress database of this site, where only administrators can read it
- Outbound click logging. Every click on a
/go/provider link is recorded by Pretty Links, currently 1,111 records. Each row stores ip, browser, os, referer, created_at, vuid. An IP address is personal data, so this is the largest single processing activity on the site - Consent records. Complianz is installed and stores the choice you make in the consent banner so you are not asked repeatedly
- Server and caching logs. Standard web server request logs, and WP Rocket cache files
- No Google Analytics, Tag Manager, Meta Pixel, Clarity, Hotjar, Plausible or Matomo tag appears in the pages served
- No account system, so no passwords or profiles
- No payment processing. Every purchase happens on the provider's own site, under their policy
- No newsletter address is collected here. The home page links out to the eSIMDude newsletter on beehiiv, where signup, storage and unsubscribe all happen under the beehiiv policy. Nothing you type there reaches this site
The list on the right reflects what is visible in the page source and the plugin list. If a tag is injected at the host or CDN level, or Search Console and a hosting analytics panel are in use, tell me and they get named here. Do not let this page claim an absence that is not true.
The home page links out to the eSIMDude newsletter on beehiiv. Because the address is typed on beehiiv and never touches this site, beehiiv holds that list, not us. If the newsletter is operated by the same people who run this site, say so and beehiiv gets named in the processor list in section five with a link to their policy.
Cookies and affiliate tracking
The important detail here is the one most sites bury: clicking through to a provider hands you to their tracking, not ours.
When you open a provider through a /go/ link, the affiliate network behind that provider generally sets its own cookie in your browser so a later purchase can be attributed. That cookie is set by the network, under their policy, and this site cannot read it.
Cookie names, purposes and durations for the affiliate networks in use, which come from the networks themselves. Complianz can scan and generate this table once the networks are known. This overlaps with the list already needed for the affiliate disclosure.
Retention, legal basis and processors
How long contact messages are kept, and how long the click log is kept before rows are deleted. This has to be a decision you make and can honour. A guessed figure such as "12 months" written here would be a false statement about your handling of real data, and the click log currently holds 1,111 rows with no stated expiry.
Whether you are treating EU and UK visitors as in scope, and on what basis each activity runs, for example legitimate interest for the click log and consent for anything set by the banner. The rights that follow, and the route to exercise them, are written once that is settled.
The hosting provider, the outbound mail service that carries contact form submissions, and any backup service. These are processors under EU and UK law and have to be named or described.
Children, changes and contact
Children. This site sells nothing and is aimed at people buying travel connectivity. It is not directed at children under 13, and no age is collected. If you believe a child has sent us information through the contact form, ask for it to be deleted and it will be.
Changes. The date at the top and foot of this page is the last time it changed. Material changes will be summarised here rather than applied quietly.
Contact about your data. Use the contact page. A dedicated privacy address is worth adding once the entity above is settled.
About your data
Do you track me across the internet?
What happens when I click through to a provider?
Do you sell or share my data?
Can I ask for my data to be deleted?
Last updated 27 August 2026. Related: How we review deals, Affiliate disclosure, Terms of use, About, Contact.
Now go and use one.
Every code in the directory went through the process on this page.
