Wavee Global Privacy Policy

Wavee is operated by two companies, and each one is responsible (the "controller") for the data of the sales it processes. For any privacy question or request, write to our data protection officer, Sergio Padilha, at hello@wavee.global.

• Wavee Global eSIM, LLC (EIN 32-0859013), 131 Continental Dr, Suite 305, Newark, DE 19713, United States — for purchases paid by card or digital wallet from 23 July 2026, for your Wavee account, and for the website and app.
• S H C Padilha Consultoria em Tecnologia da Informação Ltda (CNPJ 47.476.357/0001-04), Ayrton Greiffo 429, 81230-178, Campo Comprido, Curitiba, Paraná, Brasil — for purchases paid by Pix or PayPal, for card purchases made before 23 July 2026, and for orders invoiced in Brazil.

• Information provided directly: name, email address, phone number, and payment details when you create an account or complete a purchase.
• Automatically collected information: device data, IP address, geographic location, language, the pages you visit on our site, and interactions such as clicks and scrolling when you allow analytics cookies.
• Communications: information related to support conversations, surveys, feedback, and requests sent by you.

• To process and manage eSIM purchases and activations.
• To improve app functionality and the user experience.
• To provide customer support and respond to questions.
• To send service notices, such as order and service updates or changes to our Terms and Conditions, and, where you have agreed, promotions.
• To protect account security and help prevent fraud.

• With the carriers and service providers that help us deliver your eSIM and run our service, such as payment, email, analytics, and advertising providers.
• To comply with legal, regulatory, or court-ordered obligations when required.
• With your consent for specific purposes that you authorize.
• Our main service providers: Stripe, PayPal and Asaas (payments); Google and Apple (sign-in); WhatsApp (support chat); Amazon Web Services (email); Cloudflare and Railway (hosting and security); Google Analytics and Microsoft Clarity (analytics, with your consent); Meta and OpenAI (advertising measurement, with your consent); Sentry (error monitoring); and Google Firebase and Apple (app notifications). We do not sell your personal data.

We implement technical and organizational security measures to protect your information against unauthorized access, loss, or theft. These measures include encryption, firewalls, and restricted access controls.

• To perform the contract: process your order and payment, deliver and support your eSIM, and manage your account.
• To meet legal obligations: keep tax, accounting and payment records, and answer authorities when the law requires.
• Our legitimate interest: protect your account and our service against fraud and abuse, and fix errors — always weighed against your rights.
• Your consent: analytics and advertising cookies, and marketing messages. You can withdraw it at any time in Manage cookies or in your account, without affecting what was done before.

Our companies and service providers are in the United States, Brazil and other countries, so your data may be processed outside the country where you live. When the law requires, we rely on safeguards such as the European Commission's standard contractual clauses or adequacy decisions, and on the equivalent mechanisms of Brazil's LGPD and the UK GDPR. Who receives your data outside your country, and why:

• Stripe and PayPal (United States): payments.
• Railway and Cloudflare (United States): our servers and website, where your account and orders are stored.
• Amazon Web Services (United States): sending our emails.
• Google, Meta and Microsoft (United States): measurement and ads, only with your cookie consent.
• Sentry (United States): recording errors on the website.

Personal data is kept only for as long as necessary to fulfill the purposes described in this policy or as required by law. After that period, the information is deleted or anonymized.

• Access, correct, or delete your personal information.
• Withdraw consent for data usage at any time.
• Request the transfer of your data to another service provider when applicable.
• Contact us to clarify any questions about how your data is processed.
• Object to processing based on our legitimate interest, or ask us to restrict it while a request is being reviewed.
• Complain to the data protection authority where you live — for example the ANPD in Brazil, the ICO in the United Kingdom, or your country's authority in the European Union.
• If you live in the United States: we do not sell your data; you can opt out of the use of your data for targeted advertising in Manage cookies, and you will not be treated differently for exercising your rights.

You can delete your Wavee account at any time, from the website or the app: sign in and go to Account › Privacy › Delete account. You may also email hello@wavee.global to request deletion — we verify your identity before proceeding.

• Deleted or anonymized: name, email, phone number, language, preferences, sessions, notification tokens and the link between you and the eSIMs you purchased.
• Retained: tax and payment records, for the period the tax and accounting laws of the country of sale require, without personal identification wherever possible.
• Active eSIMs are deactivated together with the account and cannot be recovered afterwards — use or transfer your plans before requesting deletion.
• Requests are completed within 30 days; deletion from the app is usually immediate.

Not every request requires deleting your account. Under Account › Privacy you can also request, with verification by a code sent to your email:

• Correction of incorrect or outdated data.
• Anonymization: keeps the records the law requires and removes the link to you.
• Withdrawal of consent for uses that depend on it, such as marketing.
• The list of third parties your data has been shared with.
• Human review of automated decisions.

Necessary cookies keep the platform working. With your analytics permission, Google Analytics and Microsoft Clarity may measure navigation, performance, and interactions, including heatmaps and session recordings; Clarity masks sensitive content by default. With your marketing permission, we measure the results of our ads. The Meta pixel (Facebook and Instagram) records the pages you visit on the site, with no purchase data. And for our ads in ChatGPT, when you buy after clicking a Wavee ad, our server sends OpenAI the order number, amount, products, country of payment, the ad click identifier, and your email and account identifier in hashed form — never your email in plain text. OpenAI uses this data to measure and optimize campaigns, and it may be processed outside your country. You can change or withdraw these preferences at any time.

We may update this Privacy Policy to reflect changes in our services or legal requirements. We will notify you of relevant changes through the app or by email.

If you have questions or concerns about this Privacy Policy, about how your data is handled, or if you would like to request deletion of your information, please contact us.