Gizlilik politikası

Zepliner Privacy Policy

Last updated: March 29, 2026

Effective date: March 29, 2026

Contact: privacy@zoragrad.com

This Privacy Policy explains how Zepliner collects, uses, stores, shares, and protects personal data when you use our website, mobile applications, customer support channels, and eSIM-related services (collectively, the "Services").

Zepliner is operated by ZORAGRAD LTD.

Who we are

• Company name: ZORAGRAD LTD
• Company registration number (CRN): 16701620
• Registered office address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Business telephone number: 020 8059 1042
• Privacy contact email: privacy@zoragrad.com

ZORAGRAD LTD is the data controller responsible for the processing of personal data described in this Privacy Policy, except where a third party acts as an independent controller under its own privacy policy.

Scope of this Privacy Policy

This Privacy Policy applies to personal data collected or processed through:

• the Zepliner website;
• the Zepliner mobile applications;
• sign-up and sign-in processes;
• purchases of prepaid eSIM plans;
• eSIM delivery, activation, management, and support;
• customer support, communications, and feedback;
• fraud prevention, abuse detection, service security, and dispute handling.

This Privacy Policy does not apply to third-party websites, platforms, payment pages, app stores, sign-in providers, telecom providers, or other services that we do not control, even if they are linked to or integrated with our Services.

About our services

Zepliner offers prepaid eSIM data services, including prepaid data plans with varying data allowances and validity periods. Not all plans are available for all destinations.

We may also provide country-specific packages, multi-country territory-based packages, promotional plans, coupon-based offers, and related support services.

What we collect

• Account and identity-related information: name, display name, profile name, email address, account identifier, authentication provider information, login-related metadata, and account preferences or settings.
• Purchase and transaction information: order identifiers, purchased package details, selected destination, package validity details, price, currency, discount information, coupon or referral code usage, transaction status, and refund, dispute, chargeback, or cancellation information.
• eSIM and service-related information: eSIM order and provisioning records, activation status, package type, associated country or territory, service validity period, product status, operational identifiers, and limited usage or status records necessary to provide, troubleshoot, secure, investigate, or support the service.
• Technical, device, and log information: IP address, approximate location inferred from IP address, device model, device type, operating system and version, browser type and version, app version, language or regional settings, session and access timestamps, crash data, diagnostics, debugging information, performance information, request logs, and security-related or fraud-related technical signals.
• Support and communication information: message contents, support requests, support history, screenshots, files, attachments, troubleshooting details, and complaint or dispute-related correspondence.
• Marketing and feedback information: coupon usage information, communication preferences, survey responses, reviews, feedback, and campaign participation details.
• Information from third parties: information received from authentication providers such as Apple and Google, payment providers such as Stripe, infrastructure and communications providers such as Google / Firebase and OneSignal, analytics or technical service providers, and telecom or upstream eSIM partners.

How we use data

• Create, maintain, and manage user accounts.
• Authenticate users and provide secure sign-in.
• Provide, provision, activate, maintain, and support eSIM services.
• Process orders, purchases, payments, refunds, disputes, cancellations, and related requests.
• Deliver and manage prepaid eSIM data packages and related services.
• Enable promotional and coupon-related functionality.
• Communicate with users about accounts, purchases, support matters, service status, or important notices.
• Provide customer support and resolve issues.
• Troubleshoot operational or technical issues.
• Improve service quality, product reliability, performance, and user experience.
• Monitor usage and detect bugs, misuse, abuse, suspicious activity, fraud, unauthorized access, chargeback risk, or policy violations.
• Review and investigate transactions, sessions, devices, account actions, and related behavior where reasonably necessary for fraud prevention or service protection.
• Enforce our Terms of Service, Refund Policy, acceptable use rules, and other business policies.
• Comply with legal, regulatory, accounting, tax, audit, consumer-protection, and law-enforcement requirements.
• Protect the rights, security, systems, property, users, partners, and operations of Zepliner and ZORAGRAD LTD.

Legal bases for processing

Where UK GDPR, EU GDPR, or similar laws apply, we rely on one or more of the following legal bases:

• Performance of a contract: to provide the services you request, including account creation, sign-in, purchase processing, eSIM provisioning, service activation, and support.
• Legitimate interests: to operate and improve the services, maintain product quality and reliability, detect and prevent fraud, abuse, and suspicious activity, secure our systems, provide support, resolve disputes, maintain records, and enforce agreements and policies.
• Legal obligation: to comply with legal and regulatory obligations, including obligations relating to taxation, accounting, consumer law, fraud investigations, lawful requests by authorities, and legal claims.
• Consent: where required by applicable law, including for certain marketing communications or non-essential cookies and similar technologies. You may withdraw consent at any time.

Cookies, analytics, and similar technologies

Our website and applications may use cookies, local storage, SDKs, analytics tools, security technologies, and similar mechanisms to:

• keep the services functioning properly;
• maintain sessions and settings;
• improve security;
• detect fraud and abuse;
• analyze performance and reliability;
• understand product usage patterns;
• support diagnostics and troubleshooting;
• improve the user experience.

Depending on our implementation, these technologies may include services associated with Google / Firebase, infrastructure tools, communication systems, and operational monitoring providers.

Where required by law, we will request consent before using non-essential cookies or similar technologies.

Information sharing

We do not sell your personal data. We may share information with:

• Service providers and infrastructure partners: providers that help us operate the services, including hosting, cloud storage, communications, database, analytics, diagnostics, security, and technical support providers. This may include Google / Firebase, OneSignal, hosting and infrastructure partners, and technical monitoring or communications providers.
• Payment providers: payment processors and payment-related service providers, including Stripe, to process payments, manage authorizations, refunds, and cancellations, detect and investigate fraud, and handle disputes, chargebacks, and payment-related compliance.
• eSIM, network, and telecom partners: eSIM fulfillment partners, upstream providers, telecom operators, or related service partners where necessary to provision and deliver eSIM services, manage service status and support, investigate service problems, prevent abuse, review suspicious activity, or support operational, legal, or fraud-related matters.
• Security, fraud prevention, and dispute handling partners: vendors, advisers, partners, or authorities where reasonably necessary to detect, prevent, investigate, respond to, or document suspicious activity, fraud, stolen-payment-method activity, abuse of promotions, referrals, or coupons, resale or misuse, unauthorized access, disputes and chargebacks, or violations of our policies or legal rights.
• Professional advisers and business transfers: auditors, lawyers, consultants, insurers, accountants, or parties involved in a merger, acquisition, reorganization, investment, or sale of assets, subject to appropriate protections where required.
• Legal authorities: authorities or other parties where disclosure is necessary to comply with applicable law, regulation, court order, or lawful request, protect our rights, property, systems, users, partners, or business, investigate fraud, abuse, disputes, or security incidents, or enforce contracts, policies, or legal claims.

Fraud prevention, abuse monitoring, and account security

Because Zepliner provides digital prepaid connectivity products, our services may be exposed to fraud, stolen payment methods, abuse, unauthorized account activity, promotion misuse, resale patterns, or other harmful conduct.

To protect our business, users, and partners, we may process personal data for fraud prevention, abuse detection, dispute defense, and service security purposes. This may include:

• reviewing account activity, order history, coupon usage, sessions, devices, and transaction patterns;
• detecting suspicious sign-in, purchase, activation, or service behavior;
• linking related sessions, accounts, devices, technical indicators, or transactions where reasonably necessary;
• restricting, suspending, reviewing, canceling, delaying, or denying certain actions, accounts, services, or transactions;
• retaining records reasonably necessary to investigate, document, respond to, or defend against fraud, abuse, disputes, chargebacks, or policy violations;
• sharing relevant information with payment providers, communications providers, infrastructure providers, telecom or eSIM partners, advisers, or authorities where legally permitted and reasonably necessary.

International data transfers

Zepliner is based in the United Kingdom, but our providers, technical systems, and partners may operate in multiple countries.

As a result, your personal data may be processed, stored, or accessed outside your country of residence, including in jurisdictions whose data protection laws may differ from those in your home country.

Where required by law, we take appropriate steps to protect international transfers of personal data, including through contractual safeguards, lawful transfer mechanisms, or other appropriate protective measures.

Security & retention

We implement reasonable technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, misuse, loss, destruction, alteration, or disclosure. However, no system, internet transmission, or storage method is completely secure, and we cannot guarantee absolute security.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• provide and support the services;
• maintain account and order records;
• resolve support issues;
• document purchases and transactions;
• comply with tax, accounting, audit, legal, and regulatory obligations;
• investigate and defend against disputes, chargebacks, fraud, abuse, and policy violations;
• protect our systems, partners, and legal rights.

Retention periods may vary depending on the type of data and the reason it is processed. For example:

• Account data may be retained while an account remains active and for a reasonable period afterward.
• Order and transaction records may be retained for longer periods where required for accounting, legal, audit, or dispute-related purposes.
• Support records and communications may be retained to improve support quality and to document service or complaint history.
• Technical logs, device-related records, and security information may be retained for operational, fraud prevention, abuse investigation, and security purposes.
• Fraud, dispute, and abuse-related records may be retained for as long as reasonably necessary to investigate, respond to, recover losses, enforce rights, or comply with applicable obligations.

When personal data is no longer reasonably required, we may delete, anonymize, or securely store it in accordance with applicable law and operational requirements.

Your choices

Depending on your location and applicable law, you may have rights regarding your personal data, including the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• object to certain types of processing;
• request restriction of certain processing;
• request portability of certain personal data where applicable;
• withdraw consent where processing is based on consent;
• opt out of marketing communications.

You may also have the right to lodge a complaint with a relevant supervisory authority or data protection regulator.

To make a privacy-related request, contact us at privacy@zoragrad.com. We may need to verify your identity before responding to your request. We may also decline, limit, or delay certain requests where permitted by law, including where retention is necessary for fraud prevention, dispute handling, accounting, legal claims, security, or regulatory compliance.

Marketing communications

Where permitted by law, we may send service-related updates, transactional communications, support messages, and marketing communications.

You can opt out of marketing emails at any time by using the unsubscribe link in the message or by contacting us at privacy@zoragrad.com.

Even if you opt out of marketing communications, we may still send important non-promotional messages relating to your account, purchases, support, security, or the services.

Children’s privacy

Zepliner is not directed to children under 18, and we do not knowingly collect personal data from children.

If you believe that a child has provided personal data to us, please contact us at privacy@zoragrad.com and we will take appropriate steps to review and delete the information.

Third-party services

Our services may include or rely on third-party products and services such as:

• Apple and Google for authentication;
• Stripe for payment processing;
• Google / Firebase for infrastructure and related technical services;
• OneSignal for communications or support-related operations;
• app stores, telecom providers, and upstream connectivity or eSIM service partners.

These third parties operate under their own terms and privacy policies. We encourage you to review their policies. We are not responsible for the privacy practices of third-party services we do not control.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, providers or partners, legal or regulatory requirements, or fraud, abuse, and security practices.

When we update this Privacy Policy, we will revise the “Last updated” date at the top of the page. Where required by law, we may also provide additional notice or request consent.

Your continued use of the services after an updated Privacy Policy becomes effective means you acknowledge the revised version, to the extent permitted by law.

Contact us

• Company: ZORAGRAD LTD
• Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Business telephone number: 020 8059 1042
• Email: privacy@zoragrad.com