Privacy policy · roam201

Who is responsible for your data

TMT Connekt, trading as roam201 is the data controller for personal data collected through this site. For any privacy question or request, email support@roam201.com.

What we collect

When you buy:

Your email address — required, because it is how your eSIM is delivered.
Your billing country — required, because it determines whether we are permitted to sell to you and what tax applies.
Your order — the plans you bought, the price, the currency and the time.
A payment reference from the payment provider handling your order (Razorpay or Stripe, chosen by your billing country and currency). See "Payment data" below.
Your travel date, if you choose to give it, so we can remind you to install before you fly. This is optional.

When a destination requires identity verification:

A passport or other accepted identity document, which you upload through a secure link. This only happens for plans that are flagged as requiring it, and we tell you before you pay. See "Identity documents" below — we treat these more strictly than anything else on this list.

If you create an account:

Your email address, your mobile number (required, so we can reach you about an order; we never use it for marketing and never share it except as described below) and, optionally, your name. If you choose *Continue with Google*, Google tells us your email address and name and confirms the address is yours; we store nothing else from Google and never see your Google password. Google does not give us a phone number, so we ask for it the first time you open your account.

If you enter a giveaway:

Your name, email address and phone number, whether you agreed to receive offers by email, and the link or campaign that brought you to the entry page (the tags on the link you followed, and the page you came from). We use this to run the giveaway, contact the winner and see which posts worked — see the giveaway terms.

Automatically, when you browse:

Standard server logs (IP address, browser type, pages requested, timestamps), kept for security and troubleshooting.
Nothing else unless you accept analytics cookies — then Google Analytics measures your visit as described in "Cookies and analytics".

What we never collect: we do not require your name, your home address, your date of birth, your passport number for ordinary purchases, or any information about what you do with your data connection. We do not create accounts by default and we do not build a profile of you.

Payment data

We never see or store your card details. Card data is entered into the payment provider's own hosted form (Razorpay's checkout or Stripe's payment element) and goes directly to them. We receive only a payment reference, the amount, the result and, from your card, the country and the last four digits. This keeps card data out of our systems entirely.

Each payment provider processes your card data as an independent controller under its own privacy policy. Which one handles your order depends on your billing country and currency; the payment step shows its name.

Why we are allowed to use it

To perform our contract with you — delivering the eSIM you bought, taking payment, handling refunds, and giving you support. This covers your email, your order and your payment reference.
To comply with a legal obligation — identity verification where a destination's law requires it, tax records, and sanctions screening.
Our legitimate interests — keeping the service secure, preventing fraud and abuse, and keeping the site working. We balance these against your rights and keep the data minimal.
Your consent — the optional travel-date reminder and any marketing email. You can withdraw consent at any time; withdrawing it does not affect what we did before you did.

Identity documents

Documents you upload for identity verification are the most sensitive data we hold, and we treat them accordingly:

They are encrypted at rest and access to them is logged and audited.
They are used only to satisfy the destination's regulatory requirement for that order.
They are deleted once verification has an outcome and a short grace period has passed. They are not archived.
They never appear in our logs, our analytics, or in any support export.
They are not sold, shared for marketing, or used to train anything.

Your eSIM credentials

The activation code and QR for your eSIM are stored encrypted, and every read of them is recorded. Your order page is reachable only through a signed link tied to your order — not by guessing an order number.

Who we share data with

We share the minimum necessary, and only with:

Our eSIM supply platform (PayConnekt) and, through it, the mobile network operator for your destination — to issue your eSIM. Where a destination legally requires identity verification, the required verification data goes to the operator.
Our payment providers (Razorpay and Stripe) — one of them takes your payment and processes any refund of it.
Our email provider — to deliver your eSIM and order emails.
Authorities, where we are legally required to disclose.

We do not sell your personal data. We do not share it with advertisers.

Some of these providers are located outside your country. Where personal data is transferred internationally we rely on the safeguards required by applicable law, including standard contractual clauses.

How long we keep things

Order and transaction records — for as long as tax and accounting law requires, which is typically several years. These records include your email and what you bought.
eSIM credentials — for the life of the plan plus a short period, so we can support you.
Identity documents — deleted on verification outcome plus a short grace period.
Server logs — a short retention for security purposes.
Giveaway entries — until the giveaway has closed and its prize has been delivered; if you agreed to receive offers, until you ask us to stop.

Cookies and analytics

We use a small number of essential cookies and equivalent local storage: your cart, your currency choice and your session. These are required for the site to work and are not used to track you across other sites.

Partner referral links. If you arrive through a partner's link (roam201.com/p/*name*), we set a cookie named *roam201.ref* holding that partner's handle for 30 days (a later partner link replaces it), and we record the visit against that partner as a one-way hash of your IP address and browser type with the page you landed on — never your identity. If you buy while the cookie is set, the order is attributed to that partner so we can pay them a commission; the partner sees the date, destination and value of the order, not your name or email. This is first-party and is not shared with any advertising network.

Google Analytics — only if you accept. When you first visit, we ask whether you accept analytics cookies. Until you press *Accept*, no analytics script loads and no analytics cookie is set; if you press *Decline*, nothing loads at all. If you accept, we load Google Analytics 4 (Google LLC), which sets first-party cookies named *_ga* and *_ga_…* (up to 2 years) to count visits, the pages you view, the link or campaign that brought you (for example a social media post), your approximate location and device type, and — when you buy — the order number, plan and value (never your name, email or payment details). Google Analytics 4 does not log or store IP addresses. We use these reports only in aggregate, to learn which pages and links work; we do not use them for advertising and have not enabled Google signals or ad personalisation. Your choice is stored in a cookie named *roam201.consent* for 180 days. You can change it at any time with Cookie settings at the bottom of every page; withdrawing consent deletes the analytics cookies.

We also keep first-party, aggregate counts of how orders progress (for example, how many carts reach checkout), derived from our own order records — not from a cookie, and not shared with anyone. We do not use advertising or cross-site tracking cookies.

This site loads no third-party fonts, scripts, images or trackers — every asset is served from our own domain — with three exceptions: Google Analytics, only after you accept it (above); the hosted payment form of the payment provider handling your order (Razorpay or Stripe, chosen by your billing country and currency) on the pay step; and Google's sign-in script on the pages that offer *Continue with Google* (sign in, register, and the sign-in step of checkout). That script loads with the page so the button can render, so Google can tell you opened that page even if you never use the button; it is only present while Google sign-in is enabled on the site.

Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you,
correct it if it is wrong,
delete it (subject to records we are legally required to keep),
restrict or object to how we use it,
receive a portable copy of it,
withdraw consent where consent is what we relied on,
not be discriminated against for exercising any of these.

To exercise any of them, email support@roam201.com. We will respond within 24 hours and complete the request within the period required by law. We may need to verify that the request comes from you — usually by confirming you control the email address on the order.

We do not make automated decisions that produce legal effects about you.

If you are in the EEA or the UK and you think we have got this wrong, you may complain to your local data protection authority. We would rather you told us first.

Children

roam201 is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

Changes

We post changes here. Where a change is material we will say so at the top of the page.

Effective 2026-08-27. We post changes on this page; the version in force is the one published here when you buy.

Contact us

Operator: TMT Connekt, trading as roam201
Email: support@roam201.com