Privacy Policy
Last updated: May 2026
Contents
- 1. Introduction
- 2. Data Controller Information
- 3. Personal Data We Collect
- 4. Sources of Your Personal Data
- 5. Legal Basis for Processing
- 6. Data Sharing & Recipients
- 7. International Data Transfers
- 8. Your Data Protection Rights
- 9. Data Retention
- 10. Children's Personal Data
- 11. Cookies & Tracking Technologies
- 12. Contact Information
- 13. Your Rights Under the Australian Privacy Act
- 14. Brazil Privacy Rights (LGPD)
- 15. Japan Privacy Rights (APPI)
- 16. Canada Privacy Rights (PIPEDA)
- 17. India Privacy Rights (DPDP Act)
- 18. Additional Regional Privacy Rights
- 19. AI and Machine Learning
- 20. Referral Program Privacy
1. Introduction
This Privacy Policy ("Notice") explains how your personal data is handled by Future Syncs Limited, UK, operating as HelloRoam ("HelloRoam", "we", "us", or "our"). It covers the personal information you provide or that we collect when you contact us, use our app, visit our website, or buy our eSIM services.
We are required to provide you with this information under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR. If you are in Australia, you also have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Does HelloRoam comply with Australian privacy law?
HelloRoam takes data protection seriously and will not share your personal data without a proper legal basis. We comply with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles, GDPR, and UK data protection law. Privacy by design is built into everything we build.
We run Data Protection Impact Assessments when we start new services or data processing that may pose a high risk to your rights.
2. Data Controller Information
For this Notice, the data controller is Future Syncs Limited, UK, operating as HelloRoam. HelloRoam is responsible for your personal data.
Company:Future Syncs Limited
Brand:HelloRoam (a brand of Future Syncs Limited)
Address:London, United Kingdom
Company Registration:15950168
Email:admin@helloroam.com
HelloRoam is committed to looking after your personal data. This Notice tells you exactly how we process it and what rights you have.
3. Personal Data We Collect
We collect and process the following categories of personal data:
| Category | Examples |
|---|---|
| Identity Data | First name, last name, username or similar identifier, title, date of birth |
| Contact Data | Email address, phone number, billing address, delivery address |
| Financial Data | Payment card details (handled by our payment provider), bank account details |
| Transaction Data | Details about payments to and from you, details of products and services you have bought from us |
| Technical Data | IP address, login data, browser type and version, time zone and location, browser plug-in types and versions, operating system and platform, device identifiers |
| Profile Data | Your username and password, purchases or orders you have made, your interests, preferences, feedback and survey responses |
| Usage Data | Information about how you use our website, products and services, including eSIM activation data and data consumption patterns |
| Marketing Data | Your preferences for receiving marketing from us and our partners, and your communication preferences |
4. Sources of Your Personal Data
We collect your personal data from the following sources:
Direct Interactions
You give us your identity, contact, and financial data when you fill out forms or get in touch by phone, email, or other channels. This includes data you share when you create an account, buy a plan, subscribe, request marketing, enter a promotion, or give us feedback.
Automated Technologies
As you use our website and app, we may automatically collect technical data about your device, browsing activity, and patterns. We do this through cookies, server logs, and similar technologies.
Third Parties
We may receive personal data from third parties including analytics providers, advertising networks, search providers, payment and delivery services, and identity verification services.
5. Legal Basis for Processing
We only use your personal data when the law allows it. The most common situations are:
Contract Performance
Where we need to perform the contract we are about to enter into or have entered into with you.
Legitimate Interests
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Legal Obligation
Where we need to comply with a legal or regulatory obligation.
Consent
Where you have given consent to the processing of your personal data for one or more specific purposes.
Your Right to Withdraw Consent
We only use your personal data when the law allows it. The most common situations are:
6. Data Sharing & Recipients
We may share your personal data with the following categories of recipients:
Service Providers
Companies that deliver services on our behalf, such as payment processing, data analysis, email delivery, hosting, customer service, and marketing support.
Network Partners
Mobile network operators and eSIM providers that power our connectivity services.
Professional Advisers
Lawyers, bankers, auditors and insurers who provide consulting, banking, legal, insurance and accounting services.
Regulatory Authorities
Government agencies, regulators, law enforcement, courts and other authorities where required by law.
Data Protection Standards
We require all third parties to protect your personal data and treat it in line with the law. We do not allow third-party service providers to use your data for their own purposes. They may only process it for specific purposes we define.
Our Data Processors
We share your data with these trusted service providers. Each one has a data processing agreement with us.
| Processor | Purpose |
|---|---|
| Stripe | Payment processing. Card details go directly to Stripe and are never stored on our servers. |
| Supabase | User authentication and account management. |
| Google Analytics (GA4) | Website usage analytics. Only active after you give consent. |
| Google Ads | Conversion tracking for advertising. Only active after you give consent. |
| Google Tag Manager | Tag management for analytics and marketing scripts. |
| Meta (Facebook Pixel) | Marketing analytics and conversion tracking. Only active with marketing consent. |
| Microsoft Clarity | Behavioral analytics and session recordings to improve user experience. Only active with analytics consent. |
| Sentry | Error monitoring and performance tracking. Personal data is automatically redacted. |
| VWO (Visual Website Optimizer) | A/B testing to help us improve the website experience. |
| Vercel | Website hosting, analytics, and performance monitoring. |
| Rewardful | Affiliate referral tracking. Stores a referral token for 90 days when you arrive via an affiliate link. |
We have Data Processing Agreements in place with all processors listed above.
Affiliate Partners
When you arrive through an affiliate link, we share a referral token with Rewardful to attribute your purchase and calculate rewards. This data is kept for 90 days.
7. International Data Transfers
We may transfer your personal data to countries outside the UK and European Economic Area (EEA). Whenever we do, we make sure your data gets the same level of protection by putting appropriate safeguards in place.
• Transfers to countries that the European Commission or UK government has deemed to provide adequate data protection.
• Use of Standard Contractual Clauses approved by the European Commission or UK government.
• Transfers to US-based providers certified under the EU-US Data Privacy Framework.
Contact Us About Transfers
Contact us at privacy@helloroam.com if you'd like more detail about the mechanisms we use when transferring your personal data outside the UK or EEA.
Transfer Mechanisms by Processor
Stripe, Google, Meta, Microsoft, Sentry, VWO, and Vercel transfer data to the United States under Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. Supabase processes data in the US under SCCs. For UK-origin transfers, we use the UK International Data Transfer Agreement (IDTA) alongside SCCs.
8. Your Data Protection Rights
Under data protection law, you have the following rights regarding your personal data:
Right to Access
You can request a copy of the personal data we hold about you.
Right to Rectification
You can ask us to correct any information you think is wrong, or complete information you think is incomplete.
Right to Erasure
You can ask us to delete your personal data, under certain conditions.
Right to Restrict Processing
You can ask us to limit how we process your personal data, under certain conditions.
Right to Object
You can object to our processing of your personal data, under certain conditions.
Right to Data Portability
You can ask us to transfer the data we've collected to another organisation, or directly to you, under certain conditions.
Withdraw Consent
Withdraw consent at any time.
Complaint
Lodge a complaint with a supervisory authority.
We do not use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
How to Exercise Your Rights
To exercise any of the rights listed above, contact us at privacy@helloroam.com. There's no fee to access your personal data or use any of your other rights. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
9. Data Retention
We keep your personal data only for as long as needed to fulfil the purposes it was collected for, including to meet any legal, accounting, or reporting requirements.
To decide how long to keep personal data, we consider the amount, type, and sensitivity of the data, the potential harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes another way, and the applicable legal requirements.
| Category | Retention Period |
|---|---|
| Account Data | For the duration of your account plus 6 years after closure |
| Transaction Data | 7 years from the date of the transaction |
| Marketing Preferences | Until you unsubscribe or 3 years of inactivity |
| Technical/Usage Data | 13 months from collection |
10. Children's Personal Data
HelloRoam's services are not intended for anyone under 16 years of age. We don't knowingly collect personal data from children under 16. If you're a parent or guardian and believe your child has given us personal data, please contact us straight away.
If we find out we've collected personal data from a child without verified parental consent, we'll remove that information from our servers promptly.
Parental Notice
If you think we may hold information from or about a child under 16, contact us immediately at admin@helloroam.com.
12. Contact Information
Got a question about this privacy policy or how we handle your data? Reach out:
Right to Complain
Got a question about this privacy policy or how we handle your data? Reach out:
13. Your Rights Under the Australian Privacy Act
If you are in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) give you specific rights over your personal information. This section explains those rights and how to use them.
HelloRoam does not sell personal information.
Personal Information We Collect
We collect the following categories of personal information from Australian residents:
- Identifiers: name, email address, and account credentials
- Device information: device type, operating system, and identifiers used for eSIM activation
- Payment information: billing details processed securely by our payment provider
- Usage data: how you interact with our website and app
- Internet or other network activity: IP address, browser type, and pages visited
Right to Access
You can ask us what personal information we hold about you, where it came from, and who we share it with.
Right to Correction
You can ask us to correct personal information that is inaccurate, out of date, incomplete, or misleading.
Right to Complain
You can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have mishandled your personal information.
Right to Anonymity
Where lawful and practicable, you may interact with us without identifying yourself or by using a pseudonym.
How to Submit a Privacy Request
To exercise any of the rights above, email us at privacy@helloroam.com. Include your name, email address, and a description of your request. We will respond within 30 days.
Verification Process
We need to verify your identity before processing your request. We will ask you to confirm the email address linked to your account and may request additional information. If we need more time, we will let you know within 30 days.
14. Brazil Privacy Rights (LGPD)
Brazil's Lei Geral de Proteção de Dados (LGPD) applies to HelloRoam when we process personal data from individuals in Brazil. This section explains your rights and how we handle your data under Brazilian law.
Legal Bases Under LGPD
We process your personal data based on your consent, to perform a contract with you, to meet a legal obligation, or to serve our legitimate interests. We tell you the applicable legal basis at the time we collect your data.
Your Rights Under LGPD
- Confirmation that we process your personal data and access to a copy of it.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary or excessive data.
- Portability of your personal data to another service provider.
- Deletion of personal data processed with your consent.
- Information about which public and private entities we share your data with.
- Information about your option to deny consent and the consequences of doing so.
- Withdrawal of consent at any time, free of charge.
- Review of decisions made by automated means that affect your interests.
Data Protection Officer
Our Data Protection Officer handles privacy matters for Brazilian residents. Contact them at admin@helloroam.com with the subject line "LGPD Request." We will respond within the timeframes required by Brazilian law.
If you believe we have not handled your data correctly, you have the right to file a complaint with Brazil's national data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), at gov.br/anpd.
15. Japan Privacy Rights (APPI)
Japan's Act on Protection of Personal Information (APPI) applies when we process personal data from individuals in Japan. We handle your data in line with APPI requirements and the guidelines issued by Japan's Personal Information Protection Commission (PPC).
Purpose of Data Use
We use your personal data to process eSIM orders, manage your account, provide customer support, send service notifications, and improve our platform. We will not use your data for other purposes without notifying you first.
Cross-Border Transfers
Your personal data is transferred to and stored in the United Kingdom. The UK has been recognized as providing an adequate level of personal data protection by the European Commission. We apply equivalent safeguards for transfers under APPI.
Your Rights Under APPI
- Disclosure of the personal data we hold about you.
- Correction of any inaccurate personal data.
- Cessation of use or deletion of your personal data where it is no longer needed.
- Cessation of provision of your personal data to third parties.
To exercise your rights or to submit a complaint, email us at admin@helloroam.com. You may also contact the Personal Information Protection Commission (PPC) at ppc.go.jp.
16. Canada Privacy Rights (PIPEDA)
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies to HelloRoam's handling of personal information from Canadian residents. We follow the fair information principles that PIPEDA requires.
How We Apply PIPEDA Principles
- Accountability: We are responsible for all personal information under our control and have designated a privacy contact to oversee compliance.
- Consent: We collect, use, or disclose your personal information only with your knowledge and consent, except where the law permits otherwise.
- Limiting Collection: We collect only the information we need for the identified purposes.
- Accuracy: We keep your personal information as accurate, complete, and up to date as necessary.
- Safeguards: We protect your personal information with security appropriate to its sensitivity.
Your Rights Under PIPEDA
- Access to the personal information we hold about you.
- Challenge the accuracy and completeness of your information and request corrections.
- Withdraw consent for non-essential data collection at any time.
To make a privacy request, email us at admin@helloroam.com. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
17. India Privacy Rights (DPDP Act)
India's Digital Personal Data Protection Act 2023 (DPDP Act) applies when we process personal data from individuals in India. HelloRoam acts as a Data Fiduciary under this law and processes your data only for clear, lawful purposes.
Your Rights Under the DPDP Act
- Access to a summary of the personal data we process and how we use it.
- Correction and updating of inaccurate or incomplete personal data.
- Erasure of personal data that is no longer necessary for the purpose it was collected.
- Grievance redressal through our dedicated grievance mechanism.
- Nomination of another individual to exercise your rights on your behalf in case of death or incapacity.
As a Data Fiduciary, HelloRoam collects only the personal data needed to provide our eSIM services. We keep it secure, use it only for stated purposes, and delete it when it is no longer needed. We do not process the personal data of children without verifiable parental consent.
To raise a grievance or exercise any DPDP right, email us at admin@helloroam.com with the subject line "DPDP Request." We will acknowledge your request within 48 hours and resolve it within the timeframe required by law.
18. Additional Regional Privacy Rights
HelloRoam operates in 185+ countries. In addition to GDPR, CCPA, LGPD, APPI, PIPEDA, and the DPDP Act, the following regional laws may apply to you depending on where you live.
South Africa (POPIA)
South Africa's Protection of Personal Information Act (POPIA) gives you rights to access, correct, and delete your personal data. Cross-border transfers require adequate protection. To exercise your rights or file a complaint, contact us at admin@helloroam.com or reach the Information Regulator at inforegulator.org.za.
Thailand (PDPA)
Thailand's Personal Data Protection Act (PDPA) requires your consent for most processing. You have the right to access, correct, delete, and port your data, and to object to processing. To exercise your rights or complain to the Personal Data Protection Committee (PDPC), contact us at admin@helloroam.com.
Singapore (PDPA)
Singapore's Personal Data Protection Act (PDPA) requires your consent before we collect, use, or disclose your personal data. You can withdraw consent at any time. We notify affected individuals promptly in the event of a data breach. Contact admin@helloroam.com for any PDPA-related request.
Turkey (KVKK)
Turkey's Personal Data Protection Law (KVKK) requires explicit consent for cross-border data transfers. You have the right to know whether your data is processed, access it, request correction or deletion, and object to automated decisions. To submit a request or file a complaint with the KVKK Board, contact us at admin@helloroam.com.
Switzerland (nFADP)
Switzerland's revised Federal Act on Data Protection (nFADP) applies to both natural and legal persons. You have the right to access your data, correct inaccuracies, and object to certain processing. We notify the Federal Data Protection and Information Commissioner (FDPIC) of significant data breaches. Contact admin@helloroam.com with any nFADP request.
Indonesia (UU PDP)
Indonesia's Personal Data Protection Law (UU PDP) requires your consent for data collection and cross-border transfers. We maintain a designated Data Protection Officer to oversee compliance. To exercise your rights or raise a concern, email admin@helloroam.com.
China (PIPL)
China's Personal Information Protection Law (PIPL) requires us to notify you and obtain separate consent before transferring your personal data outside China. We process data from Chinese residents only for the purposes clearly stated at the time of collection. Contact admin@helloroam.com for any PIPL-related request.
19. AI and Machine Learning
HelloRoam uses AI tools carefully and only where they improve our service without compromising your privacy. We do not use AI in ways that produce automated decisions with legal or similarly significant effects on individual users.
AI Crawler Access
Our public website content, including eSIM pricing, coverage information, and FAQs, is accessible to AI crawlers. Your account data, personal information, and order history are never exposed to or shared with AI crawlers. We protect all personal data from AI training pipelines.
How We Use AI Internally
We use AI tools to support content research and review customer support quality. These tools process anonymized or aggregated data only. They are not used to make automated decisions about individual users.
HelloRoam does not sell user data to AI companies, data brokers, or any third parties for AI model training purposes.
20. Referral Program Privacy
When you participate in the HelloRoam referral program, we collect limited technical data to attribute referrals accurately and prevent fraud.
Data Collected
- IP address (anonymized after attribution)
- Browser user-agent string
- Device fingerprint (hashed, non-reversible)
Purpose
This data is used solely to attribute referral purchases to the correct referrer, prevent duplicate or fraudulent claims, and calculate referral rewards. We do not use this data for advertising or sell it to third parties.
Data Retention
Referral attribution data is retained for 90 days after the referred purchase. After this period, the data is automatically deleted. Aggregated, non-personal statistics (total referrals, reward amounts) are kept for accounting purposes.
Your Privacy Matters
We care about your data rights. Our practices are transparent, and you can exercise your rights anytime by contacting us at admin@helloroam.com.
Related Policies
Questions About This Policy?
Have questions about this Privacy Policy or how we handle your data? We're happy to help.
Excellent
Trustpilot
4.3 out of 5(50 reviews)Get the app. Travel smarter.
Manage your eSIMs from your phone, wherever you are.
4.8
App Store rating
4.3
Trustpilot
