Privacy Policy

IBNFLY LIMITED, trading as IBNFLY, is the controller for the customer information described here. IBNFLY is a trading name of IBNFLY LIMITED. IBNFLY LIMITED is registered in England and Wales, company number 17521691. Registered office: 73 Bucklane, Wembley, NW9 0AH, United Kingdom. VAT registration is unverified.

For privacy questions, email hello@ibnfly.com. We have not appointed a data protection officer.

Depending on what you do on the site, we process:

• your email address, from checkout and, if you create one, from an optional account;
• the destination, data allowance, validity, price and currency of the plan you select;
• the IBNFLY order ID;
• Stripe’s checkout-session identifier and, after payment, the payment-intent identifier;
• the supplier order identifier and eSIM identifier, when the supplier returns them;
• the ICCID and the installation credentials (QR payload, SM-DP+ address and activation code), stored encrypted;
• whether the installation email was sent, and the email provider’s message identifier;
• the checkout confirmation: the policy version, the time, and that you requested immediate supply and acknowledged the effect on the statutory cancellation right;
• account information if you register: email, a password hash, and a hashed session token. A purchase does not require an account;
• support correspondence that you send to hello@ibnfly.com. The contact form on the website does not send a message;
• server logs of order and checkout events, such as an order ID and a status. Those logs are written to redact payment secrets and installation payloads;
• a language cookie, a display-currency cookie, and, if you sign in, an account session cookie.

We do not store your full payment-card number, expiry date or security code. You enter those on Stripe’s page. We do not store your travel dates with the order. We do not store a record of whether a QR code was scanned, whether the eSIM was installed on a phone, whether it joined a network, or whether data was consumed. We do not use advertising or analytics trackers on this website.

On a failed sign-in we do not store the IP address itself. A short-lived security counter uses a hash so that repeated failures can be limited.

We use this information:

• to perform the contract: take the order, confirm payment, supply the eSIM and send the installation email;
• to provide customer support about that order;
• for security, including limiting repeated failed sign-in attempts and keeping server logs of checkout and provisioning events;
• for legal and accounting duties connected with a paid order, including VAT records;
• for the legitimate interest of running a reliable store, recovering an order that is stuck in provisioning, and keeping evidence of the checkout confirmation you gave.

We use these providers for the live service:

• Stripe, to take the card payment. Stripe receives your email, the amount, and the product description, which includes the destination and plan. Card details are entered on Stripe’s page.
• eSimerge, to supply the eSIM. The supplier request sends the plan identifier and the IBNFLY order ID. It does not send your email address. eSimerge returns the eSIM identifiers and installation details to us.
• Resend, to send the installation email. That email contains your address, the order details, and the installation credentials.
• Railway, to host the website and the PostgreSQL database that stores the order, credential and account records.

We do not use Google Analytics, a Meta pixel, or another advertising or analytics service in this website.

Stripe, eSimerge, Resend and Railway may process information on infrastructure outside the United Kingdom. We use them to take payment, supply the eSIM, send the installation email, and host the service and its database. This policy does not name a further transfer country or a further safeguard.

We keep order, account and support information for as long as we reasonably need it to supply the eSIM, handle support, keep payment and security records, and meet legal or accounting duties. The service does not currently delete orders after a fixed number of days. Account session cookies last 14 days. The signed link in the installation email expires after 7 days. The failed sign-in counter uses a 15-minute window.

Installation credentials are encrypted in the database with AES-256-GCM. Password hashes and session-token hashes are stored instead of the password or the raw session token.

You can ask for access, correction, erasure, or restriction of your information, and you can object to processing based on legitimate interests. Where the law gives you a right to data portability, you can ask for that too. You can also complain to the Information Commissioner’s Office, the UK supervisory authority (ico.org.uk).

Some information has to be kept to complete a contract or to meet a legal duty, so we may not be able to delete every record as soon as you ask. Email hello@ibnfly.com to make a request. You do not need to send card details or installation secrets.

We may update this policy. The version and date at the top are the current version. An update does not rewrite the version recorded on an order you have already placed. The Terms & Conditions and Refund Policy are separate pages.