Privacy Policy
Effective date: October 2026
This policy explains what personal data Telovi ("Telovi", "we", "us") processes when you use the Telovi mobile application and telovigo.com, why, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the German BDSG.
1. Controller & App Publisher
Telovi is owned, published, and operated by Amad Amjad Khedir (Sole Proprietorship / Einzelunternehmen Amoverse), Paul-Keller-Str. 2, 59269 Beckum, Germany (Tax No. / Steuernummer: 456623012; see full Impressum). Contact for all privacy matters: support@telovigo.com.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (hashed) | Your account, sign-in, order confirmations | Contract (Art. 6(1)(b) GDPR) |
| Orders: plan, destination, price, date | Delivering the eSIM, receipts, refunds, accounting | Contract; legal obligation (§147 AO, 10 years) |
| eSIM technical data: ICCID, activation code, status, data used | Provisioning the eSIM and showing your usage | Contract |
| Device model and OS version | eSIM compatibility check | Contract |
| Country / currency: from your device region and, if needed, a country lookup of your IP address (only the country is kept, on your phone) | Showing prices and payment methods available to you | Legitimate interest (Art. 6(1)(f)) |
| Wallet balance and top-ups (Iraq only) | Prepaid balance | Contract |
| Support emails and in-app support chat, including eSIM and device details you choose to share | Answering you | Contract / legitimate interest |
| Support chat messages sent to our AI assistant | Answering common questions instantly, any time of day; replies are marked “AI assistant” and a person can take over | Contract / legitimate interest |
| Push notification token | Order, eSIM and data-low notifications; deals and offers | Contract; consent you give in your phone’s settings (you can turn it off there at any time) |
| Flight number you enter for flight reminders | Reminders before your trip; stored only on your phone | Consent |
| Crash reports (error message, app version, device type) | Fixing bugs | Legitimate interest (Art. 6(1)(f)) |
| Withdrawal requests (order, email, name, date and time) | Handling your withdrawal and confirming it | Legal obligation (§356a BGB) |
| Online status while the app is open: that you are online, your device type (iPhone, Android, web) and which screen you are on. No IP address and no location. | Helping you faster in support, and seeing how many people use the app right now | Legitimate interest (Art. 6(1)(f)) |
| IP address of sign-in and payment requests, as received by our server; blocked emails, accounts and IPs | Fraud prevention and protecting customers from stolen cards | Legitimate interest (Art. 6(1)(f)) |
We do not collect your GPS location, contacts, browsing history or advertising identifiers, and we do not use advertising or tracking SDKs.
Automatic fraud checks
To protect customers from stolen cards, every payment is checked automatically: identities on our blocklist, how many payments come from the same IP, email or account in a short time, the amount for new or guest accounts, and fraud warnings from Stripe. A payment can be stopped, and in clear cases of fraud a payment can be refunded and the email, account and IP blocked automatically. If you think this happened to you by mistake, write to support@telovigo.com: a person will review it, you can explain your side, and we lift wrong blocks (Art. 22(3) GDPR).
3. Payments
Card, Apple Pay, Google Pay, PayPal and Klarna payments are processed by Stripe Payments Europe, Ltd. (Ireland). Your card details go directly to Stripe and never reach our servers; we receive only a payment reference, the last four digits and the outcome.
4. Who receives your data (processors)
- Supabase Inc. - database, authentication, realtime support chat, and serverless edge functions.
- Stripe Payments Europe Ltd. - global payment processing and transactional receipts.
- Resend Inc. - transactional email (receipts, sign-in and password links).
- eSIMfly & Partner Telecoms - eSIM supplier and regional carriers for profile provisioning and data routing.
- Apple Inc. & Google LLC - OAuth sign-in and platform app store distribution.
- Cloudflare Inc. - website hosting, routing and DDoS protection; the optional speed test in the app connects to Cloudflare’s test servers.
- Anthropic PBC (USA) - the AI assistant in support chat. It receives the chat messages and the eSIM details needed to answer, and does not use them to train its models.
- Expo / 650 Industries Inc. (USA) - delivering push notifications to Apple and Google.
- country.is and ipwho.is - looking up the country of an IP address so the right prices and payment methods are shown.
- flagcdn.com and Unsplash - country flags and destination photos; your phone loads these images directly, so these services see your IP address.
All processors are bound by data processing agreements under Art. 28 GDPR. Where data leaves the EU/EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.
5. Cookies & Analytics (Zero Wiretapping)
We do not use tracking cookies, advertising identifiers, keystroke loggers, or session replay SDKs (such as PostHog, Hotjar, FullStory, or LogRocket). No behavioral data is sold or shared with third parties.
6. Retention
- Account data: until you delete your account.
- Orders and receipts: 10 years (German tax law), then deleted.
- eSIM technical data: 12 months after the plan expires.
- Support emails and chats: 2 years.
- Withdrawal requests: 3 years (limitation period).
- Online status: only while the app is open; it is not stored.
- Fraud blocklist entries: 2 years, or earlier if you show us the block was a mistake.
7. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (Art. 15-21 GDPR). Email support@telovigo.com. You can delete your account yourself in the app under Account → Settings → Delete account. You also have the right to lodge a complaint with a data protection supervisory authority.
8. Children (COPPA Compliance)
Telovi is not directed at children under 13 and complies with the Children's Online Privacy Protection Act (COPPA). Account registration requires affirmative age certification; creation by individuals under 13 is strictly prohibited and server-side refused. We do not knowingly collect personal information from children under 13.
9. Security
All traffic is encrypted (TLS). Passwords are stored hashed. Access to production data is restricted to authorized personnel.
10. Changes
We will post any changes here and update the effective date. Material changes are announced in the app.