Privacy Policy

Wren is run by [Company legal name], [Registered business address]. We are the “controller” of the personal data described here. Questions or requests: [email protected].

We collect only what we need to sell you an eSIM and help you use it:

• Contact details: your email address, which you give at checkout or when signing in.
• Order details: the destination and plan you bought, the price, payment status, and timestamps.
• eSIM details: your eSIM's identifier (ICCID), its activation code, status, expiry date, and how much data you've used. We get these from our connectivity partner so we can show them to you.
• Payment details: handled by Stripe. We receive a payment reference and status, but never your full card number.
• Sign-in details: if you sign in with Discord, we receive your Discord ID, username, avatar and email from Discord.
• Technical data: IP address, browser and device type, and similar data that our hosting and security providers log automatically when you visit.
• Usage data, only if you accept cookies: which pages you visit on our site, how you found us, and whether you bought after seeing one of our ads.
• Support messages: anything you send us when you contact support.

We don't collect your location, browsing history, or what you do online while using your eSIM.

• To deliver your order: issuing your eSIM, showing it to you, emailing your sign-in link, and showing your data usage. Legal basis: performing our contract with you.
• To take payment and prevent fraud, together with Stripe. Legal basis: contract, and our legitimate interest in preventing fraud.
• To provide support and handle refunds. Legal basis: contract.
• To keep the service secure and working, for example by investigating errors and abuse. Legal basis: legitimate interests.
• To meet legal duties such as keeping tax and accounting records. Legal basis: legal obligation.
• To understand how the site is used and measure our ads, so we can improve Wren. Legal basis: your consent, which you can withdraw at any time.

We only email you about your orders and account, such as delivery and sign-in links. We won't send you marketing emails unless you've opted in, and you can unsubscribe at any time.

We don't sell your personal data, and we don't share it for advertising. We use these service providers to run Wren. They may only use your data to provide their service to us:

When your eSIM connects to a mobile network abroad, that network operator processes technical data (such as your eSIM identifier and which cell you're connected to) to carry your traffic, under its own privacy policy and local law.

We may also share data if the law requires it, or to protect our rights, our users or the public.

Some of our providers process data outside the UK and European Economic Area, for example in the United States. Where they do, we rely on approved safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision.

• Order and payment records: 6 years after purchase, to meet tax and accounting rules.
• Your account: until you ask us to delete it. After deletion we keep only the order records we're legally required to keep.
• Support messages: up to 2 years after your issue is resolved.
• Technical logs: usually no longer than 90 days.

Always on. These are strictly necessary for the site to work, so they don't need your consent:

• Sign-in cookies, which keep you signed in to see your eSIMs.
• Stripe cookies on checkout, which Stripe uses to process payments securely and prevent fraud.
• Preference cookies, which remember your currency and your cookie choice.

Only if you accept. Analytics and advertising cookies, set through Google Tag Manager, that tell us how visitors use the site and which ads lead to purchases. We ask before setting any of them, and until you accept, Google's tags run without cookies.

You can change your choice at any time with Cookie settings at the bottom of every page, or block cookies in your browser. Signing in and checkout won't work without the necessary ones.

Depending on where you live, you may have the right to:

• get a copy of the personal data we hold about you;
• correct data that's wrong;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format.

To use any of these rights, email [email protected] from the address on your account. We'll reply within one month. We may need to confirm your identity first.

If you're unhappy with how we've handled your data, you can complain to your data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first.

California residents: we don't sell or share personal information for cross-context behavioural advertising. You have the right to know, delete and correct your information, and we won't treat you differently for using these rights.

We protect your data with encryption in transit (HTTPS), access controls that limit each account to its own records, and by keeping payment card details entirely with Stripe. No system is perfectly secure, but if a breach affects you we'll tell you and the relevant authorities as the law requires.

Wren isn't aimed at children, and you must be at least 18 to buy a plan. If you think a child has given us personal data, contact us and we'll delete it.

We'll update this policy when our practices change. The date at the top shows the latest version. If a change significantly affects you, we'll tell you by email or on the website. See also our Terms of Service.