Skip to content
lumsim
My eSIMs

Privacy Policy

Last updated: October 20, 2026

Who we are

RagHubs Inc., 8 The Green, Ste R, Dover, DE 19901, USA, runs lumsim and is responsible for your personal data (the "controller"). Contact us about privacy at support@lumsim.com.

We don't currently sell to residents of the European Union, the European Economic Area, the United Kingdom or Switzerland. If you visit the site from there, this policy still explains how we handle your data and what rights you have.

What we collect and where it comes from

Most data comes from you, through the website and your emails. Some comes from Stripe (payment), Cloudflare (the country of your IP address) and our eSIM network provider (install status and data usage).

  • Email address: to deliver your eSIM, send receipts, sign-in codes and alerts when your data or plan is running out, and answer support requests.
  • Order details: the plan, amounts, currency, tax, order and invoice references, and your trip start date if you enter one. A discount code you apply is stored with the order.
  • Tax residence evidence: the country of residence you confirm, your billing country, your card's country, your IP address and the country it points to.
  • Payment details: you enter your card into Stripe's payment form, so we never see your full card number. We receive the card brand and country, and a card identifier that we store only in hashed form. For a company invoice, Stripe collects the company name, billing address and tax ID you enter, and they appear on the invoice.
  • Fraud prevention signals: a random identifier for your browser (we store only its hash), the risk level Stripe gives the payment, and when you accepted immediate delivery.
  • eSIM details: the eSIM's number (ICCID), its activation details (stored encrypted), whether it has been installed, and data usage reported by the network.
  • Messages you send us by email or WhatsApp. If you write to us on WhatsApp, WhatsApp (Meta) also processes the chat under its own privacy policy.
  • Reviews: if you rate your eSIM, your rating, and the comment and name to show if you add them.
  • Analytics and advertising data: Google Analytics and Google Ads only if you allow them in the cookie settings. Cloudflare's cookie-free visit count follows your analytics choice: in the EU/EEA, the UK, Switzerland and Turkey it runs only if you allow analytics; elsewhere it runs unless you turn analytics off (see our Cookie Policy).

We need your email address and country of residence to sell to you. Without them, we can't take your order.

Why we use it

  • To provide the service: deliver eSIMs and data add-ons, run your account, send emails about your orders and process refunds. Legal basis: our contract with you.
  • To meet legal duties: work out tax and keep invoices and tax records. Legal basis: legal obligation.
  • To prevent fraud and abuse: payment risk scoring by Stripe Radar, purchase limits for new customers, bot checks and request limits. Legal basis: our legitimate interest in protecting customers, card holders and our business from fraud.
  • To handle disputes: answer payment disputes and legal claims. In a payment dispute we send Stripe and the card network your email address, IP address, when you accepted immediate delivery, delivery times and the eSIM's install and usage records. Legal basis: our legitimate interest in establishing, exercising or defending legal claims.
  • To keep the service secure and working: server logs with email and IP addresses masked. Legal basis: our legitimate interest in running a secure service.
  • To ask for and publish reviews: a few days after your eSIM first connects, we email you once with a link to rate it; the email also has a link to stop these requests. Your rating counts towards the destination's average on our site. If you write a comment, we check it only for personal details and inappropriate content and then publish it with the name you chose (or “Verified buyer”) and your country of residence. Legal basis: our legitimate interest in showing real customers' opinions to other travellers. You can object at any time, and we will delete your name and comment.
  • To make our data emails useful: the emails telling you your data is running low, has run out or your plan is ending have a link to add data to that eSIM without signing in. We record whether that link was used, not who opened the email. Legal basis: our legitimate interest in sending emails that help.
  • To measure visits and ads: Google Analytics and Google Ads. Legal basis: your consent, which you can withdraw at any time. Cloudflare Web Analytics counts visits and page load times without cookies. Legal basis: in the EU/EEA, the UK, Switzerland and Turkey, your consent; elsewhere, our legitimate interest in improving the site. You can turn it off at any time by switching off analytics in the cookie settings.

We don't use your data for any other purpose without telling you first.

Automated fraud checks

Stripe Radar scores the risk of each payment using signals such as the card, the device and payment patterns across Stripe's network. Our own rules limit how many eSIMs, and for how much, a new customer can buy in 24 hours. Based on these checks, a payment may be declined automatically or an order held. A person on our team reviews each held order; if it isn't approved within about 12 hours, it is cancelled and refunded in full. If a card issuer warns that a payment may be fraudulent, an eSIM that has never been installed is cancelled and refunded automatically; an installed one may be suspended until we have looked into it. We use these checks because selling safely online would not be possible without them.

If a purchase was declined or cancelled after these checks, you can email support@lumsim.com to ask for a person to review it, explain your point of view and contest the decision.

Who we share it with

We use these service providers. They process data on our behalf and only for the purposes above:

  • Stripe: payments, fraud prevention, tax calculation, invoices and credit notes.
  • eSIM Access: our eSIM network provider. It receives the order reference and the plan, not your name or email address, and gives us the eSIM, its install status and its data usage.
  • Brevo: sends our emails and tells us whether each one was delivered or bounced. We use this to warn you if your eSIM email didn't arrive, and as evidence in a payment dispute.
  • Cloudflare: delivers the website securely, runs the bot check (Turnstile), tells us which country an IP address is in and counts visits without cookies (Web Analytics).
  • Railway: hosts our servers, database and logs.
  • Google: Google Analytics and Google Ads, only with your consent; and Google Drive, where we keep backup copies of invoices and credit notes.

Some of them also use data as independent controllers under their own privacy policies: Stripe, for example for fraud prevention across its network and to meet its legal duties as a payment provider; Google, for advertising if you allow advertising cookies; and WhatsApp (Meta), if you write to us there. If you use the one-tap install link on an iPhone, the link passes your eSIM's activation details to Apple's eSIM setup service so that Apple can install it.

We may also share data with authorities when the law requires it, with banks and card networks to handle a payment dispute, and with a buyer of our business if lumsim is sold, who would have to keep this policy's promises.

International transfers

We are a US company. We and our service providers process data in the United States and in other countries where those providers operate, so your data may be processed outside the country where you live. Where data protection law requires it, transfers are protected by safeguards such as the European Commission's standard contractual clauses, which are part of our providers' data processing terms.

How long we keep it

  • Orders, invoices and tax residence evidence, including your IP address: 10 years after the order, as tax law requires. Invoices and credit notes are stored with Stripe, with backup copies in Google Drive.
  • Account details: until you delete your account.
  • Sign-in codes: valid for 10 minutes and deleted within 2 days. Sign-in sessions: up to 30 days.
  • Server logs: 30 days, with email and IP addresses masked. Request-limit records, which contain a hashed IP or email address: up to 2 days.
  • After you delete your account, we keep a one-way code made from your email address for 120 days, only to apply the purchase limits for new customers. It can't be turned back into your address.
  • Support messages: as long as we need them to help you and to handle any related claim, and no longer than 3 years after your last message.
  • Reviews: the rating as long as we keep the order; the name and comment until you ask us to delete them or delete your account.
  • Analytics data: no longer than 14 months.
  • Deleted data can stay in our database backups for a short time until those backups are replaced.

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, Swiss data protection law, Turkey's KVKK or US state privacy laws such as California's CCPA), you have the right to:

  • know whether we process your data, access it and get a copy of it in a portable format
  • correct or delete it
  • object to or restrict how we use it, including use based on our legitimate interests
  • withdraw consent at any time, without affecting what we did before
  • ask for a person to review a decision made by automated checks, and contest it
  • not be treated differently for using these rights

You can delete your account yourself in My eSIMs. We then delete or anonymise your personal data, except the order, invoice and fraud-prevention records we must or need to keep. Our order records no longer contain your email address. Records we must keep by law, such as invoices and credit notes at Stripe and in our backup copies, keep the details shown on them, including your email address. eSIMs you have installed keep working but no longer appear on the site.

For any other request, email support@lumsim.com. We may ask you to confirm the request from your email address. We reply within 30 days; if the law allows more time for a complex request, we tell you. If we refuse your request, we explain why, and you can ask us to reconsider by replying to our answer.

You can also complain to a data protection authority, for example the one in the country where you live.

If you live in Turkey

This policy is also our notice under Article 10 of the Turkish Personal Data Protection Law (KVKK). We collect your data electronically through the website, our emails and the providers listed above, for the purposes and on the legal grounds above: the performance of a contract, a legal obligation, the establishment, exercise or protection of a right, our legitimate interests, and your explicit consent for analytics and advertising cookies.

Your data is processed outside Turkey, mainly in the United States, by us and the providers listed above.

Under Article 11 of the KVKK, you may also ask which third parties in Turkey or abroad receive your data, ask us to tell them about a correction or deletion, object to a result against you that comes only from automated analysis, and claim compensation for damage caused by unlawful processing. Send your request to support@lumsim.com. If we refuse it or don't answer within 30 days, you can complain to the Personal Data Protection Authority (KVKK Kurumu).

If you live in the United States

In the past 12 months we have collected these categories of personal information, for the purposes and from the sources described above: identifiers (email address, IP address, browser identifier), commercial information (orders, refunds and reviews), limited payment information (card brand and country), internet activity (how you use the site, only with your consent), approximate location (the country of your IP address) and the contents of messages you send us. We don't collect precise location, and we don't use sensitive personal information to infer anything about you.

We don't sell your personal information for money. If you allow advertising cookies, Google Ads may use them, together with identifiers and internet activity, to measure and personalise ads. Some state laws call this "selling", "sharing" or "targeted advertising". You can opt out at any time with the "Your Privacy Choices" or "Cookie settings" link at the bottom of every page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out: advertising cookies stay off, and you can still choose whether to allow analytics.

We don't knowingly sell or share the personal information of anyone under 16. We don't offer financial incentives for personal information. You can use an authorised agent to make a request; we may ask the agent for proof of your permission and ask you to confirm the request. If we refuse a request, you can appeal by replying to our answer; if we still refuse, you can contact the attorney general of your state.

Security

We use encrypted connections, store activation codes encrypted, and keep sign-in codes and session keys only in hashed form. Only you can see your activation code: on your order page, by email, or after signing in. No system is completely secure; if a breach affects your data, we tell you and the authorities where the law requires it.

Children

lumsim is not meant for anyone under 18. We don't knowingly collect data from children, including children under 13. If we learn that we have, we delete it. If you think a child has given us data, contact us at support@lumsim.com.

Cookies

See our Cookie Policy.

Changes

We may update this policy. We show the date of the latest change at the top of this page. If a change significantly affects how we use data we already have, we tell you by email or on the site before it applies, and ask for your consent again where the law requires it.