Privacy Policy

Who we are

The travel eSIM service sold as Simbo on simbo.co.il and in the Simbo mobile apps (iOS bundle identifier il.co.simbo.app and Android package il.co.simbo.app) is operated by Reshef and Moti Holdings 2021 Ltd, company number 516390028, Hagabish 4, Netanya, Israel (“we”, “us”). For privacy requests that company is the controller of the customer data described in this Policy.

Privacy contact: support@simbo.co.il. WhatsApp: +972-55-259-4341. Website: https://simbo.co.il. Please write from the email or phone number on the account so we can verify that the request is yours.

Legal name: Reshef and Moti Holdings 2021 Ltd. Company number: 516390028. Address: Hagabish 4, Netanya, Israel. The contacts above are how you reach us about privacy.

What this Policy covers

This Policy covers the public website in Hebrew, English, Russian, and Arabic; accounts and checkout on the web and in the apps; digital delivery of eSIM profiles; usage information shown in your account; Simbo Coins and referral credits; in-app and website support; surveys; service email; WhatsApp conversations you start with us; and push notifications you allow.

It does not cover networks, app stores, payment pages, or messaging apps that have their own privacy notices. Apple, Google, your mobile operator, a connectivity supplier, WhatsApp, and a payment provider each process some data under their own terms when you use their service.

If an employer, family member, or travel agent buys a plan for you, we still process the order data needed to deliver it. Their own privacy notice may also apply to information they hold about you.

Data we collect

We collect only what we need to sell and support a travel data plan, keep the service secure, and meet legal duties. The categories below use ordinary names and, in parentheses, the labels Apple and Google use in their store questionnaires.

Contact data (Contact Info): first and last name, email address, and phone number. You give these when you register, check out, or contact support. A plan can also carry a traveler nickname so you can tell family lines apart. A nickname is a label, not a separate identity document.

Account identifiers (Identifiers): a Simbo customer ID, order numbers, and, if you use Google sign-in, the Google account identifier and the name and email Google shares with us. We never receive your Google password. If Facebook sign-in is offered on the website, the same applies to the Facebook identifier and the email Facebook shares. On the apps we currently offer Google sign-in and email registration.

Purchase data (Purchases): destination, plan name, data allowance, validity, price in Israeli shekels, currency, taxes shown at checkout, top-ups, coupons or referral codes used, Simbo Coins earned and redeemed, and whether the order completed, failed, or was cancelled.

Payment data (Financial Info): checkout is handled by the payment provider shown at payment. We receive a payment status, a transaction reference, the method type, and the amount. We do not store full card numbers, CVV codes, or magnetic-stripe data on Simbo servers. The payment provider’s own notice describes how they handle card data.

eSIM service data: the technical material required to deliver and support a profile, including ICCID, SM-DP+ address, activation code, matching ID, QR code or manual installation string, supplier order reference, installation state, first network attachment if the supplier reports it, data used, data remaining, and validity dates. We treat activation secrets as confidential. They are not placed in analytics events.

Device and product data (Device ID, Product Interaction, Other Diagnostic Data): IP address, browser type, app version, operating system and version, device manufacturer, brand, and model, language, and the result of the in-app or on-site eSIM compatibility check. If you contact support from the app, that device report can be attached so we can give the right install steps. We do not ask the app for your photo library, contacts, microphone, camera, advertising identifier (IDFA or Android advertising ID), health data, or precise GPS location.

Usage of the service (Product Interaction): pages and screens you open, plans you view, and in-app events such as starting checkout, opening install steps, or starting a support flow. Those events include platform, app version, and language. They are redacted so they do not contain QR codes, ICCIDs, or activation codes.

Plan consumption: the connectivity supplier reports status and data volume so we can show remaining data and send usage alerts (for example around 75% and 90%). That figure describes the plan, not a map of websites you visited. We do not receive your browsing history on the mobile network.

Approximate location: we infer a coarse location from your IP address for security, fraud checks, and language. The destination you choose is a product selection, not GPS tracking. The apps do not request location permission.

Messages you send us (Other User Content / Customer Support): WhatsApp messages, email, in-app support answers, and optional survey comments. Please do not send passwords or full card numbers in chat.

Push tokens (Device ID): if you allow notifications, Apple (APNs) or Google Firebase Cloud Messaging gives us a device token so we can send order, install, usage, and Coins messages. The token is not an advertising ID. You can turn notifications off in system settings.

Cookies and similar web storage, described in the cookies section. The native apps do not use that cookie banner and do not run the website advertising pixels inside the app.

Data we do not collect for this service

We do not knowingly collect precise location, contacts, photos, SMS content, call logs, microphone recordings, or government ID numbers. We do not use the Simbo apps to track you across third-party apps and websites, and we do not ask for App Tracking Transparency permission for that purpose.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Website marketing tags run only after you opt in on the cookie banner, and they are not embedded in the native apps.

The service is not directed to children under 18. We do not knowingly collect personal data from children under 13, or under the age required in their country. If you believe a child has given us data, email support@simbo.co.il and we will delete it.

How we use data, and why

We use personal data to create and secure your account; take payment; buy the matching profile from a connectivity supplier; show the QR or manual code in your account and send it by email; guide installation; show remaining data; send service messages about the order, install, usage, and Coins; operate referrals; answer support; prevent fraud and abuse; keep accounting and tax records; and understand, in aggregate, which plans and screens work.

Where a law requires a legal basis, we rely on: performance of the contract (account, payment, delivery, support of a plan you bought); consent (non-essential website cookies, optional push notifications, Google or Facebook sign-in, and optional surveys); legitimate interests that are not overridden by your rights (securing the site and apps, preventing fraud, measuring our own product, and limited service analytics that do not identify you for advertising); and legal obligation (tax, accounting, consumer, and lawful requests from authorities).

We do not use customer data to train public advertising profiles, and we do not allow connectivity suppliers to use your Simbo account for their own marketing unless you contact them separately.

App permissions

The apps need an internet connection to load the catalogue, sign you in, and deliver an eSIM. That is the network permission on Android and ordinary internet access on iOS.

Notifications are optional. We ask only so we can tell you that an eSIM is ready, that a usage threshold was reached, or that Coins are about to expire. If you refuse, the app still works. You can change the choice later in iOS Settings or Android Settings.

The compatibility check reads the device model and operating system that the phone already exposes to the app. It does not scan other apps, and it does not read your SIM serial unless you type it into a message to support.

If a future version needs a new permission, the app will explain the reason before the system prompt, and this Policy will be updated first.

Cookies and similar technologies

On the website, strictly necessary cookies and local storage keep you signed in, hold the cart, remember a referral code, remember a device-compatibility hint, and store your cookie choice. The site does not work properly without them. They do not require marketing consent.

Analytics cookies and tags (for example Google Analytics, Google Tag Manager, Microsoft Clarity, or Plausible, whichever are enabled in that environment) load only after you turn on Analytics in the banner. They help us see aggregated traffic and fix broken pages.

Marketing cookies (for example the Meta/Facebook pixel, when enabled) load only after you turn on Marketing. They measure campaigns. They are off until you opt in.

You can change the choice at any time from Cookies in the footer. You can also block cookies in the browser. Blocking necessary cookies can sign you out or clear the cart.

The iOS and Android apps do not drop these browser cookies and do not include the advertising pixel. In-app events described above are product diagnostics for Simbo, not a third-party ad profile.

Who we share data with

Connectivity suppliers and mobile operators, so they can provision the profile, route data in the destination country, and report status and volume. They receive the technical identifiers and the destination plan, not your browsing history.

Payment providers that process the charge you approve at checkout, and banks or card networks they use.

Infrastructure that hosts the website, the API, email, and databases, including processors in Israel and abroad.

Google, for Google sign-in and for Firebase Cloud Messaging delivery of push notifications you allow. Apple, for APNs delivery of push notifications on iOS.

Meta (WhatsApp and, only if you opt in on the web, Facebook login or the marketing pixel).

Support and inbox tools we use to read and answer conversations you start.

Accounting and invoicing tools, limited to the records needed for receipts and tax.

Professional advisers and authorities when the law requires it, or when we need to protect customers, suppliers, or Simbo from fraud, abuse, or a legal claim.

A buyer of the business, if Simbo is sold or reorganized, under a duty to use the data only as this Policy allows.

We do not authorize these providers to use Simbo customer data for their own unrelated advertising. Each provider is limited to the job we hire them to do, except where they are an independent controller (for example a card network or WhatsApp when you use their app).

International transfers

Simbo is based in Israel. Connectivity suppliers, app-store notification services, cloud hosting, and payment providers often process data in the European Economic Area, the United Kingdom, the United States, and the countries where the mobile network operates.

Where the law requires a transfer tool, we use contractual clauses, adequacy decisions, or the supplier’s equivalent safeguards, plus access limits. A travel eSIM cannot be delivered without sending provisioning data to the supplier that serves that destination.

How long we keep data

Account profile data is kept while the account is open. Order, invoice, payment, fraud, and eSIM provisioning records are kept for as long as tax, accounting, and dispute rules require. In Israel that is commonly up to seven years from the end of the relevant tax year, and longer if a claim is open.

Support messages are kept while needed to finish the case and for a reasonable period afterwards in case the same trip has a follow-up.

Push tokens are deleted when you sign out and unregister, when you ask us to delete the account, or when the token is reported invalid.

Cookie consent is stored in your browser until you clear it or change it. Server logs with IP addresses are kept for a shorter security window, then deleted or aggregated.

Survey answers are kept without any obligation to attach them to a public profile. We use them to improve the service.

When a retention period ends, we delete or anonymize the data. Activation material that a network operator must keep under its own telecom rules may remain with that operator.

Security

We protect data with HTTPS in transit, access controls, secret management, and redaction of activation secrets in analytics. Staff and vendors get access only as needed for their role.

No internet service is perfectly secure. If you believe your account or an eSIM QR code was exposed, contact us immediately so we can freeze sign-in and advise whether the profile should be treated as compromised. A QR code is a bearer credential: anyone who installs it may consume the plan.

Your rights

Subject to Israeli privacy law and, where it applies, the GDPR or UK GDPR, you can ask us to: confirm whether we process your data; give you access; correct inaccurate data; delete data we are not required to keep; restrict or object to certain processing; and receive data you provided, in a portable format, where the law gives that right.

You can withdraw cookie consent on the website at any time, and you can turn off push notifications in the operating system. Withdrawal does not undo processing that was lawful before the withdrawal.

You may lodge a complaint with the Privacy Protection Authority in Israel (www.gov.il/he/departments/the_privacy_protection_authority) or, if you are in the EEA or UK, with your local supervisory authority. We ask that you contact us first so we can try to resolve the issue.

We may need to confirm that you are the account holder before we act. We will respond within the time the applicable law allows. Some records, especially invoices and fraud evidence, cannot be deleted on request.

Delete your account

You can ask us to delete your Simbo account from this page, by email, or from WhatsApp. This section is the web address for account and data deletion for the Simbo apps: https://simbo.co.il/en/privacy#delete-account (Hebrew: https://simbo.co.il/he/privacy#delete-account).

Send an email to support@simbo.co.il from the address on the account with the subject “Delete my Simbo account”, or message +972-55-259-4341 on WhatsApp from the phone number on the account. In the apps, open Profile and tap Delete account. That starts the request in the app. You can also use Contact support. Tell us the email on the account. We will verify that the request is yours and will not ask you to call a premium phone line.

Deletion means we close the login, remove the profile details we are not required to keep, delete push tokens, and stop optional messages. It is not the same as signing out, and it is not a temporary freeze.

We keep, in a restricted form, records we must retain for tax, accounting, fraud prevention, chargebacks, and establishment or defense of legal claims. That usually includes the fact of the orders, amounts, dates, and eSIM provisioning references. Coins and unused referral credit are forfeited when the account is deleted and are not converted to cash. Deleting an account does not refund a plan. Refunds follow the Refund Policy.

We aim to complete deletion of the data we are allowed to erase within 30 days, and we will tell you if a legal hold requires longer. Profiles already installed on a phone remain on that phone until you remove them in system settings. A connectivity supplier may keep telecom records under its own legal duties.

Store privacy disclosures

For Apple App Privacy, the data linked to your identity is contact info, identifiers (account ID and push token), purchases, and product interaction such as plan status and support. Device model and diagnostics are linked when you use support or the compatibility check. We do not mark the app as tracking you, and we do not use data for third-party advertising inside the apps.

For Google Play Data safety, the app collects the categories above, shares provisioning and payment data with the providers named in this Policy, encrypts data in transit, and offers the deletion path in the previous section. Data is not sold. Optional notifications can be refused.

If we add an analytics or crash SDK to the apps later, we will update this Policy and the store forms before or when that version is released.

California and other regional notices

If the California Consumer Privacy Act applies, we do not sell personal information and we do not share it for cross-context behavioral advertising. You may ask for access or deletion using the contact details above. We will not discriminate against you for exercising those rights.

Residents of other places may have similar rights. The request route is the same.

Changes to this Policy

We will post changes on this page and change the date above. If a change materially expands how we use data, we will also give a notice in the account, by email, or in the app before it takes effect where the law requires that. The store privacy forms will be updated to stay consistent with this page.

Contact

Simbo · support@simbo.co.il · WhatsApp +972-55-259-4341 · https://simbo.co.il/privacy