Privacy policy

1. Who we are

Ryvo is a trading name of AJTV LIMITED, a company registered in Hong Kong ("Ryvo", "we", "us"). We decide how and why your personal information is used, which makes us the controller of it under data protection laws such as the GDPR and the UK GDPR.

Registered details: AJTV LIMITED (Business Registration No. 77482617), 2301, 23/F Bayfield Building, 99 Hennessy Road, Wan Chai, Hong Kong.

For any privacy question or request, email support@ryvosim.com with "Privacy" in the subject line.

2. What we collect

We collect only what we need to sell you an eSIM, deliver it, support it and meet our legal obligations.

• Contact details: your email address, and your name if you give it to us.
• Order details: the plan and destination you chose, the price, currency and date, and your order reference.
• eSIM details: the eSIM's identifiers, such as its ICCID, and the installation and activation codes we show on your order page.
• Usage information from our eSIM supplier: how much data your eSIM has used, its status and when it expires. We don't see the websites you visit or the content of your traffic.
• Payment information: our payment processor collects your card or wallet details. We never see or store your card number or security code. We keep only the payment status, the card brand, the last four digits, the country that issued the card, whether it is credit or debit, whether a wallet was used, the result of the bank's 3-D Secure check and the processor's risk score.
• Purchase and order-page records: when you buy an eSIM we also record your IP address and the country it maps to, your browser and device description, your language preference, the website that referred you and any campaign tags in the link you arrived by. When you open your order page or your invoice we record the time, your IP address and your browser description.
• Website measurement: we count visits to our own website so we can see which pages and which referrals bring travellers to us. We store the country your internet connection is in, whether you were on a phone, tablet or computer, the website that linked you to us, the first page you opened, any campaign tags in that link, and a random identifier that your browser keeps in its session storage only until you close the tab. We don't store your IP address, the name or version of your browser, or anything that identifies you, we don't use analytics cookies, and we don't share this first-party measurement with anyone else. If you say yes to advertising cookies, a separate set of rules applies. See Advertising and Meta below.
• Location evidence for tax: the country shown by your IP address and your card's country of issue, which we use to work out any tax included in the price.
• Technical information: your IP address, browser and device type and the pages you request, which our hosting provider logs to run and protect the website.
• Support messages: what you send us and our replies. When you use our chat assistant, we keep the question you asked with card numbers, activation codes, order links, email addresses and IP addresses removed, a record of the answer rather than the answer itself, and whether you marked it helpful. We keep a whole conversation only when you ask us to pass it to a person and agree to pass it on.
• Referral information: if you arrive through a creator's link, the creator's referral code.
• Creator applications: if you apply to our creator programme, your name, email address, country, time zone and posting language, the account handles you give us and what you tell us about your audience. We keep them so we can set your account up if we accept you. If we decline, we clear the handles and what you told us about your audience.

We don't ask for sensitive information, such as health information or government identity documents.

3. How we use it, and our legal bases

The GDPR and the UK GDPR require a legal basis for each use. Ours are shown in brackets.

• To sell and deliver your eSIM, show your order page and send you order emails (to perform our contract with you).
• To help you when you contact us, including checking your eSIM's status with our supplier (to perform our contract, and our legitimate interest in giving useful support).
• To take payments, make refunds and prevent fraud (to perform our contract, our legitimate interest in preventing fraud, and our legal obligations).
• To prove a purchase was genuine if the cardholder's bank asks, to answer a chargeback and to detect fraud, using the purchase and order-page records above (our legitimate interest in preventing fraud and defending payment disputes). We don't use these records for profiling. If you opted in to advertising cookies, we may also use your order, once it's paid, to tell Meta that a purchase happened. See Advertising and Meta below.
• To keep the records that tax and company law require (legal obligation).
• To pay creators commission on sales they referred (our legitimate interest in running our referral programme).
• To run, secure and improve the website, including counting visits and seeing which pages and referrals bring travellers to us (our legitimate interest in a working, secure, useful website).
• To send you marketing emails, only if you've agreed. You can unsubscribe at any time (consent).

We don't make decisions about you by automated means that have legal or similarly significant effects on you.

4. Who we share it with

• Our eSIM supplier, which issues your eSIM and connects it to partner mobile networks. We share what it needs to do that: the plan, an order reference and the eSIM's identifiers. We don't give it your name or email address.
• Partner mobile networks in the countries you visit, which carry your traffic and record usage the way any mobile network does.
• Our payment processor, currently Airwallex, which processes payments and refunds and runs fraud checks. It also handles your payment details under its own privacy policy.
• Service providers that host our website and database and send our emails. They may use your information only to provide their service to us.
• Creators whose referral link you used. They learn that a referred sale happened and its value. We don't give them your name or contact details.
• Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
• Courts, regulators and law enforcement, where the law requires it.
• A buyer of our business, if it's sold, who must protect your information in the same way.

We don't sell your personal information. If you opt in to advertising cookies, Meta receives the information described under Advertising and Meta so it can show our ads and measure them. If you say no, or your browser sends a Global Privacy Control signal, nothing is sent to Meta.

5. Transfers to other countries

We're based in Hong Kong, and our suppliers and service providers operate in several countries, including the United States and countries in Asia and Europe. Your information may be processed in any of them. If you opt in to advertising cookies, your information goes to Meta, which handles it in the United States, Ireland and other countries.

When we transfer personal information from the UK or the European Economic Area to a country without an adequacy decision, we use safeguards such as the European Commission's standard contractual clauses and the UK's International Data Transfer Addendum. For customers in Australia, we take reasonable steps to make sure overseas recipients handle your information consistently with the Australian Privacy Principles.

6. How long we keep it

• Orders, payments, refunds and tax records: seven years after the order, because tax and company law requires it.
• Support messages: two years after the conversation ends. Chat assistant records: 90 days, except a conversation you asked us to pass to a person, which we keep as a support message.
• eSIM usage information: for as long as we keep the order it belongs to.
• Purchase and order-page records: up to 24 months, after which the IP address and browser description are deleted. The card summary stays with the order record.
• Website measurement: 13 months.
• Technical logs: up to 90 days, unless we need them longer to investigate a security issue.
• Marketing preferences: until you unsubscribe or ask us to delete them.

When we no longer need information, we delete it or make it anonymous.

7. Your rights

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@ryvosim.com. We may ask you to confirm you control the email address on the order before we act. We'll respond within one month.

If you're in the UK or the European Economic Area, you also have the right to restrict or object to how we use your information, including for direct marketing, to receive your information in a portable format, and to withdraw consent at any time. You can complain to the Information Commissioner's Office in the UK or to the data protection authority where you live.

If you're in Australia, the Privacy Act 1988 and the Australian Privacy Principles give you rights to access and correct your information. If you're unhappy with how we've handled a privacy matter, tell us first. If we don't resolve it, you can complain to the Office of the Australian Information Commissioner.

If you're a California resident, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We don't sell or share personal information as those terms are defined in California law. We won't treat you differently for using your rights. You can use an authorised agent to make a request for you.

8. Cookies

We use a small number of cookies that the website needs to work. Advertising cookies depend on where you are. In the UK, the EU and EEA, Switzerland, Canada and Brazil we only use them if you say yes. Everywhere else, including Australia, they are on from your first visit and you can switch them off at any time. Our cookie notice lists each cookie and what it does.

9. Advertising and Meta

We advertise on Facebook and Instagram, which are run by Meta. To do that well, we use the Meta Pixel on our website. Whether it runs before you choose depends on where you are, as explained under Your choice below.

What it does. When it is on, a small piece of Meta's code runs in your browser. It tells Meta which Ryvo pages you look at, which plan you pick and when you start to check out. We use that to show our ads to people who might want an eSIM and to see whether our ads work.

What Meta receives. Meta gets your IP address, your browser and device details, the page address, and two cookies it sets, called _fbp and _fbc. If you came from a Meta ad, it also gets the ad click identifier in the link. For the events above it gets the plan, its price and the currency. It doesn't get your name, your email address, your payment details or your order page.

What we don't send. We turn off Meta's automatic form and button tracking. We don't send your email address or any other contact detail to Meta from your browser. Your eSIM, your activation codes and your order page address never go to Meta.

Overseas. Meta handles this information in the United States, Ireland and other countries. It uses the information under its own terms and privacy policy, and it may use it to improve its own services as well as to deliver our ads.

Your choice. If you are in the UK, the EU or EEA, Switzerland, Canada or Brazil, nothing loads until you choose Accept. No thanks is just as easy and the site works exactly the same. Everywhere else, including Australia, the Pixel is on from your first visit: we tell you so in a notice with a Switch off button, and the site works exactly the same either way. If your browser sends a Global Privacy Control signal, we treat that as No thanks wherever you are and we don't ask. When advertising cookies are offered on the site, you can withdraw your yes at any time with Cookie settings in the footer. If you turn advertising cookies off, we stop the pixel straight away and delete the Meta cookies we can reach on this site. Meta may already hold information it received earlier. To ask about that, use the tools in your Facebook or Instagram settings or contact Meta.

Questions or complaints. Email support@ryvosim.com. In Australia you can also contact the Office of the Australian Information Commissioner.

10. Security

We use encrypted connections, access controls and trusted providers to protect your information. Your order link contains a long random code that gives access to your eSIM's install details, so keep it private, as you would a password.

If a data breach is likely to cause you serious harm, we'll tell you and the relevant regulators as the law requires.

11. Children

Our service isn't directed at children under 16, and we don't knowingly collect their personal information.

12. Changes to this policy

When we change this policy, we'll update the date at the top of this page. If a change significantly affects how we use your information, we'll also tell customers by email.