Privacy

1Who we are

eSIMradar is operated by Now On Company Limited, a company registered in Thailand. Now On Company Limited is the data controller for the processing described on this page, and the address below is where to write about any of it.

• Now On Company Limited
• 112/246 Moo 8, Bangkaew, Bangplee, 10540 Samut Prakarn, Thailand
• [email protected] — for anything on this page, including a request about your data

2What we collect when you read the site

Nothing that you type, because there is nothing here to type into. Every public page is a static file served from a content delivery network, and pages are built in advance rather than assembled for you when you ask for one. What does happen is what happens on any website: our hosting provider records the request.

• A server log entry for each request: the IP address it came from, the time, the page, the browser and operating system your device reports, and the response we sent.
• Those logs are used to deliver the site, keep it available, and investigate faults and abuse. They are not used to build a profile of you, and we do not try to work out who you are from them.
• The legal basis is our legitimate interest in running a working, secure website (GDPR Article 6(1)(f)). No consent is asked for because none of this is optional to serving a page.

3What we do not do

These are all things a comparison site could reasonably be expected to do. This one does not do them, and this section exists so that is on the record rather than left to be inferred.

• No visitor accounts. There is nothing to sign up for, no password to store, and no email address collected from readers.
• No advertising tags, no remarketing pixel, no session recording, no heatmaps and no tag manager. The one measurement tool is Google Analytics, described in its own section below; Google’s advertising signals are switched off in it and stay off.
• No payments, ever. We do not sell eSIMs, so no card details are entered here. A purchase happens on the provider’s own site, under their terms.
• One third-party script, and it is the analytics one. Everything else on a page — including the two typefaces — is served from our own domain, which is the exception people are most often surprised to find in their browser logs.
• We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers.

4Analytics, and the consent it does not assume

We use Google Analytics 4 to see which pages, destinations and plans people actually use, so the site can be built around that rather than around guesses. It is configured to ask first, and to be useful even when the answer is no.

• It loads with every consent signal set to denied. In that state Google Analytics still counts the visit, but it writes nothing to your device, sets no _ga cookie, and cannot connect this visit to any other — the numbers are aggregate and the visitor is not identified.
• The banner asks whether we may store a cookie that recognises you across visits. Saying yes turns on Google’s analytics_storage only. Saying nothing leaves it denied for as long as you keep saying nothing, and there is no second prompt.
• What is recorded is what was done, never what was typed: pages viewed, a plan opened or clicked, a filter or sort used, a currency changed, whether a destination search matched anything. Searches report how many characters were typed and how many results came back, never the words themselves, and the search term is removed from the page address before Google Analytics is told which page you are on.
• Google’s three advertising signals — ad_storage, ad_user_data and ad_personalization — are denied and are never asked about, because we do not advertise. IP addresses are anonymised before Google stores them, and Google Signals and advertising features are off in the property.
• The legal basis is your consent (GDPR Article 6(1)(a)) for the cookie, and our legitimate interest in knowing whether the site works (Article 6(1)(f)) for the cookieless counting. Withdraw consent by clearing site data for esimradar.com, which removes the record of your answer and lets you give a different one.

Google acts as our processor for this and is listed with our other processors below. Their own terms govern what they may do with it, and they are not permitted to use it for their own advertising.

5What is stored in your browser

Two entries, both written only in response to something you did. If you change the display currency, your choice is saved under the name esimradar.currency; if you answer the analytics banner, your answer is saved under esimradar.consent. Both are local storage rather than cookies, which means neither is ever attached to a request and neither reaches our servers. Clearing site data for esimradar.com removes both. Google Analytics writes its own cookie only if you said it could.

The cookie page lists this in full, along with what a browser stores on its own.

6When you click through to a provider

Deal links are affiliate links. Following one takes you off eSIMradar to the provider or to the affiliate network they use, and their privacy policy applies from that point — typically they set a cookie to record that the visit came from us.

• What comes back to us is commercial reporting: that a click led to a purchase, and what commission is due. Those reports do not tell us who you are, and we do not receive your name, your email address or your order details.
• A commission never changes the order plans are ranked in. What it can decide is which plans a promoted surface carries: the "top pick" marker, the "Our picks" shelf, the paid partner row and the "Recommended" tab of a board. All four are labelled where they appear, and the method is written out on our ranking page.
• Blocking third-party cookies does not break anything here. At most it means a provider does not credit us for the visit.

7Providers who list with us

A provider that lists on eSIMradar, through our API or by arrangement, gives us business contact details. This is the only place the site holds an account of any kind.

• A contact email address and company details, plus an API key that is stored only as a one-way hash — we cannot read back a key that has been issued.
• Used to operate the listing: to tell a provider when their catalogue fails validation, to enforce fair use of the API, and to reach them about their listing.
• The rest of that relationship is covered by the provider terms, which are a separate document.

8Reviews shown on provider pages

Provider pages show ratings and written reviews from our own dataset, gathered before this version of the site existed. This version does not collect reviews from visitors — there is no form to submit one. Where a review is published with a display name, that name is what the reviewer gave at the time. Write to us if you want a review of yours removed.

9Who else processes data for us

Three companies, all acting on our instructions, plus the affiliate networks that only see anything after you choose to click a deal link.

• Vercel — hosting and the content delivery network that serves every page, and therefore the request logs described above.
• Google — Google Analytics 4, as described above. It receives page and event data from your browser; with consent that includes a cookie identifier, without it does not.
• Supabase — the database holding the plan catalogue, provider records and reviews. No visitor data is written to it while you browse; public pages read prepared documents and never query it for you personally.
• Both operate internationally, so data may be processed outside the country you are in. Where transfer safeguards are required we rely on the standard contractual clauses and equivalent mechanisms those providers publish.

10How long anything is kept

There is no visitor profile to keep, so the question mostly answers itself.

• Request logs are held by our hosting provider for the limited operational period their platform applies, and are not copied into any store of ours.
• The currency preference stays on your device until you clear it. We never receive it, so we cannot delete it for you.
• Provider account records are kept while a listing is active, and after it ends for as long as we need them for accounting and dispute-handling.

11Your rights

Under the GDPR, the UK GDPR and Thailand’s Personal Data Protection Act, you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict or object to what we do with it, or provide it in a portable format. Where we ever rely on consent, you can withdraw it at any time. Write to [email protected] and we will answer within one month.

The honest caveat: for an ordinary reader we hold nothing that identifies you, so a request will usually be answered by telling you that — we cannot find records we never made. You also have the right to complain to your national data protection authority, and in Thailand to the Personal Data Protection Committee.

12Children

This site is aimed at people buying mobile data for travel and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data — through the provider API or by writing to us — tell us and we will delete it.

13Changes to this policy

If what the site does changes, this page changes with it and the date at the top moves. Anything material — a new processor, a different measurement tool, collecting reviews again — will be described here before it starts, not after.