1 · Our commitment to your privacy

At Ringo, your privacy isn't an afterthought. It's the reason we built a global eSIM that doesn't make you swap SIM cards or hand your number to a new operator at every border. This Privacy Policy explains what data we collect, why we collect it, the legal basis on which we rely, and how to exercise your rights.

The data controller is RingoLTD, 86-90 Paul Street, London EC2A 4NE, United Kingdom. You can reach our Data Protection Officer at privacy@ringoesim.com.

We process personal data in line with the UK GDPR, the EU GDPR, the UK Privacy and Electronic Communications Regulations (PECR), the EU ePrivacy Directive, and applicable telecommunications regulations across our 180+ partner markets.

2 · Information we collect

We collect only the information necessary to provide a global mobile network service:

  • Account data: name, email, phone number, billing address.
  • Number-portability data: your existing carrier and porting authorization codes. Held only as long as needed to complete the port.
  • Service data: network usage volume, country of connection, eSIM activation status. We do not log call content or message bodies.
  • Payment data: tokenized via Stripe. Ringo never stores raw card numbers or CVCs.
  • Site analytics data: anonymous measurement of pages viewed, traffic source, device type, and approximate location (country / city, derived from a truncated IP). Collected via Google Analytics 4 with advertising signals disabled. See our Cookie Policy for the full inventory and browser-level opt-out instructions.

Providing your account, port, and payment information is a contractual requirement. We cannot deliver the eSIM service without it. Site analytics processing relies on legitimate interests (Art. 6.1.f); you can opt out at the browser level at any time and the service is unaffected.

3 · How we use your data · And the legal basis

We process each category of personal data for a specific purpose, on a specific lawful basis under Article 6 of the UK / EU GDPR:

  • Provide and maintain the eSIM service. Including porting your number, activating the eSIM, and routing calls/SMS/data through partner networks. Legal basis: performance of a contract (Art. 6.1.b).
  • Process payments and refunds via Stripe. Legal basis: performance of a contract (Art. 6.1.b); compliance with tax and accounting law (Art. 6.1.c).
  • Send service-related emails (welcome, port status, billing, security notices). Legal basis: performance of a contract (Art. 6.1.b).
  • Send communication and marketing emails (product news, launch and early-access updates, founding-member and referral offers, and occasional promotions). When you sign up you are automatically opted in to these, and every marketing email carries an unsubscribe option. See Section 7. Legal basis: legitimate interests in marketing our own similar products (Art. 6.1.f) and the "soft opt-in" for electronic marketing under PECR Reg. 22 / the ePrivacy Directive. You can object or unsubscribe at any time.
  • Detect fraud, abuse, and network misuse. Legal basis: legitimate interests in protecting our service and our customers (Art. 6.1.f).
  • Measure how visitors use our website via Google Analytics 4, with advertising signals disabled and IP anonymised. Legal basis: legitimate interests in understanding aggregate traffic to improve the site (Art. 6.1.f). Cookies set by this measurement are session and traffic identifiers only. See the Cookie Policy for the full inventory and how to opt out at the browser level.
  • Comply with legal and regulatory obligations, including telecoms law and law-enforcement requests where required. Legal basis: legal obligation (Art. 6.1.c).

We do not sell your data to advertisers, share it with data brokers, or use it to build behavioural profiles for targeted advertising.

4 · Sub-processors and sharing with partners

To deliver service in 180+ countries, we share the minimum data necessary with mobile-network partners (e.g. IMSI for connection authorization). Partners are contractually bound by Data Processing Agreements to handle data only for service delivery.

We use the following sub-processors:

  • Stripe. Payment processing and fraud prevention (Ireland / United States, Standard Contractual Clauses in place). Stripe collects identifying information about the devices that connect to its services and uses it to operate and improve those services, including to detect fraud. Its privacy policy is at stripe.com/privacy.
  • Supabase. Database, authentication, and file storage for account and lead data (EU region).
  • Vercel. Website hosting and serverless edge functions (regional EU edge).
  • Resend. Transactional email delivery (United States, Standard Contractual Clauses in place).
  • Google Analytics 4. Site measurement only, all advertising signals disabled (United States, Standard Contractual Clauses in place under Google's terms).

We do not sell your data and we do not share it with advertising networks or general-purpose data brokers. A current list of sub-processors is maintained on this page; we will notify Pioneer and account holders of material changes by email at least 30 days before any new processor begins handling personal data.

5 · International data transfers

Wherever possible we host data inside the European Economic Area (EEA). Some sub-processors. Notably Stripe, Resend, and Google. May process personal data in the United States. Where such transfers occur, we rely on the following legal mechanisms under Articles 44–49 of the UK / EU GDPR:

  • Standard Contractual Clauses (the European Commission's 2021 SCCs and the UK International Data Transfer Addendum) signed with each transferring processor.
  • EU–US Data Privacy Framework certification, where the processor is self-certified (e.g. Google LLC, Stripe Payments Inc.).
  • Supplementary measures as recommended in EDPB Recommendation 01/2020. Encryption in transit and at rest, pseudonymisation where feasible, and contractual restrictions on government-access requests.

You can request a copy of the relevant SCCs and Transfer Impact Assessment summaries by emailing privacy@ringoesim.com.

6 · Pioneer & Ambassador data

If you join the Pioneer Program, we additionally store: your deposit transaction record, plan-interest survey response, and welcome-kit shipping address. Shipping addresses are deleted within 90 days of fulfillment.

If you opt in to the Ambassador Program, we generate a unique referral link and track sign-ups originating from that link. We share your first name and Ambassador status with referred users only when the referred user explicitly asks.

7 · Marketing communications & your choices

When you sign up with Ringo, whether you join the waitlist, reserve a Pioneer spot, or become a paying customer, you are automatically opted in to our communication and marketing emails. These cover product news, launch and early-access updates, founding-member and referral offers, and occasional promotions about Ringo and similar services we provide.

We do not ask for separate prior consent before sending these. We rely instead on our legitimate interest in marketing our own similar products (Art. 6.1.f UK / EU GDPR), together with the "soft opt-in" for electronic marketing under Regulation 22 of the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive. In plain terms: because you gave us your details when you signed up for Ringo, we may email you about Ringo until you tell us to stop.

You can opt out at any time. It is free, it takes effect right away, and we never ask why. To stop marketing emails you can:

  • Reply STOP (or "unsubscribe") to any email we send you.
  • Click the unsubscribe link in any of our marketing emails.
  • Email privacy@ringoesim.com and ask us to stop.

Once you opt out we add your address to a permanent do-not-contact list and remove you from every future marketing send. Usually at once, and in any event within 72 hours. Opting out of marketing does not stop essential service emails. Things like billing, security, and number-port notices. Which we must send to operate your account.

We do not sell your email address and we do not share it with third-party advertisers. Your right to object to direct marketing is absolute (Art. 21.2 GDPR). See Section 9 for the full list of your data-protection rights.

8 · Cookies & analytics

We use essential cookies for session management and Google Analytics 4 to understand how visitors use the site. Pages viewed, traffic sources, device type, and approximate location (country and city, derived from a truncated IP address). Google Analytics is configured for measurement only: advertising signals (ad_storage, ad_user_data, ad_personalization) are disabled and IP anonymisation is on. We do not use this data to target ads or build advertising profiles.

We do not run Google Ads remarketing, Facebook Pixel, TikTok / X / LinkedIn ad pixels, B2B visitor-identification tools, or session-replay tools.

You can opt out of Google Analytics at the browser level by installing the Google Analytics Opt-out Browser Add-on, or by blocking third-party cookies in your browser. For the full inventory of cookies set by this site, see the Cookie Policy.

9 · Your rights

Under the UK / EU GDPR you have the following rights, free of charge, in respect of your personal data:

  • Right of access (Art. 15). Obtain a copy of the personal data we hold about you.
  • Right to rectification (Art. 16). Correct inaccurate or incomplete data.
  • Right to erasure (Art. 17). Request deletion, subject to legal retention obligations (e.g. tax records).
  • Right to restriction (Art. 18). Limit how we process your data.
  • Right to data portability (Art. 20). Receive your data in a structured, machine-readable format.
  • Right to object (Art. 21). Object to processing based on legitimate interests.
  • Right to withdraw consent (Art. 7.3). At any time, where consent is the legal basis (e.g. analytics cookies). Withdrawal does not affect lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email privacy@ringoesim.com from the address on your account or include enough information for us to verify your identity. We will respond within one calendar month (Art. 12.3); for complex requests we may extend by a further two months and will tell you why.

Right to lodge a complaint. If you believe we have mishandled your personal data, you have the right to complain to a data-protection supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113). EU residents can also complain to the supervisory authority in their country of residence. A list is maintained by the EDPB at edpb.europa.eu.

We would always prefer the chance to resolve your concern first, so please consider contacting us before filing a complaint. But the right to complain directly is yours and you do not need our permission to use it.

10 · Security

We protect personal data with industry-standard controls: TLS 1.3 in transit, AES-256 at rest (provided by Supabase, Vercel, and Stripe), least-privilege access controls, principle-of-least-data on logging, and encrypted off-site backups.

Our infrastructure runs on EU regions of SOC 2 Type II–certified providers (Supabase, Vercel, Stripe, Google Cloud). We will notify affected individuals and the relevant supervisory authority of any personal-data breach in line with Articles 33 and 34 of the GDPR. Without undue delay and within 72 hours where feasible.

11 · Data retention

We retain personal data only for as long as needed for the purpose collected, or as required by law:

  • Account data. For the life of the account, plus 90 days after cancellation, then deleted unless required by law.
  • Billing and tax records. 7 years after the financial year of issue (UK HMRC / EU national tax-law obligation).
  • Number-portability records. Held only for the duration of the port plus 30 days for dispute resolution.
  • Pioneer welcome-kit shipping addresses. Deleted within 90 days of fulfillment.
  • Marketing leads (waitlist sign-ups that did not become customers). 24 months from last interaction, then deleted.
  • Site analytics (Google Analytics). 14 months at Google's data-retention setting, then automatically deleted.
  • Server logs. 30 days, then rotated.

You can request earlier erasure via the right to erasure described above; we will honour it where no overriding legal obligation requires retention.

12. Children's data

Ringo is not intended for, and we do not knowingly market to, children under 16. We do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, contact privacy@ringoesim.com and we will delete it promptly.

13 · Automated decision-making

We do not use solely-automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR). Fraud-prevention checks may flag a payment for human review, but no account decision is taken by an algorithm alone.

14 · Changes to this policy

If we change this policy in a material way. Adding a new processing purpose, a new sub-processor, or a new tracking technology. We will update the "last updated" date at the top of the page, and where practical we will email account holders or display a banner on the site. Continued use of the service after a change constitutes acceptance of the revised policy. The previous version remains available on request.

15 · Contact our DPO

Data Protection Officer: privacy@ringoesim.com.

Postal address: RingoLTD, 86-90 Paul Street, London EC2A 4NE, United Kingdom.

For UK supervisory complaints, contact the Information Commissioner's Office at ico.org.uk or 0303 123 1113.