Version 1.0 · Effective 18 September 2026
Selling an eSIM takes more companies than selling a shirt: one sources the plan, another delivers the profile to your phone, and a mobile operator abroad carries the traffic. This page names all of them and says what each one gets.
The English version is the one that applies; translations are provided for convenience. It belongs with our Privacy Policy.
Each of these processes data on our behalf, for one job, under a contract that limits them to it.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Amazon Web Services | Hosting, database, storage and transactional email | All stored content: account, orders, eSIM records | European Union — eu-central-1, Frankfurt |
| eSIM connectivity supplier | Sources the data plan and orders the eSIM profile | The order identifier and the plan code only — no name, email or phone. It cannot identify you from what we send. | Hong Kong |
| Simlessly Inc. | Runs the SM-DP+ platform that delivers the profile to your device | Your device's eUICC identifier (EID) and its IP address at the moment of installation | United States |
| Mobile network operators | Carry your traffic in the country you travel to | Device and network identifiers, connection data and approximate location, as any mobile network does | The country of travel |
| Stripe | Payment, tax and invoicing | Card details entered on their page, the order amount and your email | United States and European Union |
| Google (Firebase Authentication) | Sign-in | Email, name, profile picture and provider identifiers | United States |
| Sentry | Error reports | Stack traces and identifiers. Personal data is not attached to events | European Union |
| Amplitude | Product analytics — only after you accept the banner | Account identifier, locale, currency, sign-in provider and the events listed in the privacy policy | United States |
| Pusher | Live updates in the app | Event notifications tied to your account identifier, without order content | United States |
The country in the last column is where the company is, not necessarily where every byte sits — that is how these lists are normally read. Where we know the hosting region and it matters, we say so: your orders and accounts are in Frankfurt.
Two things happen outside our systems, and neither can be avoided — they are how an eSIM works.
When you install the profile. Your phone connects to the SM-DP+ server at rsp-eu.simlessly.com, operated by Simlessly Inc., and sends it the eUICC identifier of your device together with your IP address. The server returns the profile. Without this exchange the eSIM cannot be installed.
When you use the plan. Your traffic runs through the network of the mobile operator we buy the plan from. Like any mobile network, it sees the identifiers of your device and your SIM profile, the cells you connect through and how much data you use. That operator handles this data under its own rules and the telecoms law of its country, not under our policy.
We do not receive the content of your traffic and cannot see what you browse.
We are a United States company and our providers operate in several countries. Orders, accounts and eSIM records are stored in the European Union (AWS, Frankfurt), and error reports stay in the European Union as well.
Our eSIM connectivity supplier is in Hong Kong. It receives an order identifier and a plan code, and no personal data about you — it cannot identify you from what we send. We will name it on request: write to service@nerds.boutique.
Personal data leaves the European Economic Area through Stripe and Google for payment and sign-in, and through Amplitude if you accepted analytics. Those transfers rely on the European Commission’s Standard Contractual Clauses together with the technical measures described in our Privacy Policy. Write to service@nerds.boutique for a copy of the executed clauses.
This page changes when a provider does. The date at the top says when it last did, and the previous wording of any line is in the history of the repository this site is built from.