Privacy Policy

At uPhone, we respect your privacy and are committed to protecting your personal data. This policy covers the uPhone native mobile application and the website at uphone.com and explains the different data each service collects.

1. Who We Are

uPhone is operated by Targa Limited (Company number: 1412942; Business registration number: 51710016), Flat/Room B8, 5/F, Cheung Wei Industrial Building, No. 42 Lee Chung Street, Chai Wan, Hong Kong. Targa Limited is the controller of the personal data described in this policy. Contact [email protected].

2. Information We Collect

Native mobile application

• Account and authentication data: name, email address, password hash or linked sign-in-provider identifier, language, currency, and marketing choice.
• App and device data: app version, device model, operating-system version, locale, timezone, installation identifier, push token, IP address, and security/session records.
• Service data: orders, eSIM identifiers and installation details, activation and usage status, referrals, account balance, and support communications.

The native iOS app does not collect or process card details. When you choose a card-payment or membership option, you are sent to a secure page on uphone.com. Card details are entered on the website and handled directly by Stripe.

Website

• Commerce data: cart, order, currency, coupon, balance, transaction and refund records, plus the email and IP address needed to fulfil and protect a purchase.
• Payment data: Stripe processes card details. We receive transaction identifiers, status, payment type, card brand and last four digits, but not the full card number or security code.
• Website and marketing data: cookies, pages and campaign/referral parameters, consent, newsletter activity, approximate location, and fraud-prevention signals.

3. How We Use Your Information

We use your data to:

• Process and fulfil your eSIM orders
• Send order confirmations, QR codes, and account notifications
• Provide customer support
• Improve our platform and detect fraud
• Send marketing emails (only with your consent; unsubscribe anytime)
• Meet legal obligations

4. Legal Basis for Processing (GDPR)

Where GDPR applies, our legal bases are: contract performance (fulfilling your order), legitimate interests (fraud prevention, analytics), consent (marketing), and legal obligation (tax records).

5. Cookies and Analytics

We use cookies for session management, analytics (Google Analytics), and personalisation. See our Cookie Policy for full details and opt-out options.

6. Processors and Sharing

We do not sell personal data. We disclose only what is necessary to service providers acting under contract, including:

• eSIM network and provisioning suppliers to issue and operate the purchased mobile-data service;
• Stripe for website payments, billing, refunds, fraud prevention and regulatory compliance;
• hosting, email, push-notification, customer-support, security and analytics providers needed to operate and protect the service;
• professional advisers, acquirers and authorities where required for legal claims, a corporate transaction, or compliance with law.

7. International Transfers

Targa Limited is based in Hong Kong and our processors and eSIM suppliers may process data in other countries. Where applicable, we use contractual safeguards and limit transfers to the data necessary for the service. Local privacy and government-access rules may differ from those in your home country.

8. Data Retention and Account Deletion

We retain order, payment, refund, and fraud-prevention records for up to 7 years where required for tax, accounting, dispute, security, or other legal obligations. We keep other personal data only for as long as needed for the purposes described in this policy.

You can delete your account in the mobile app under Settings → Delete Account. Deletion immediately disables sign-in, revokes app sessions and push tokens, pseudonymises account-profile and authentication identifiers, removes the account email from our newsletter list, and stops active memberships from renewing. Records that we must retain remain linked only to an internal deleted-account identifier and are kept for the applicable legal or security period. You may also request deletion by emailing [email protected].

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and complain to a data-protection authority. Withdrawal does not affect earlier lawful processing. Submit requests to [email protected]; we may verify your identity before responding.

10. Security

We use transport encryption, hashed passwords, restricted administrative access, tenant-scoped records, revocable mobile sessions, rotating refresh tokens, monitoring and backups. Payment card data is handled by Stripe. No method of storage or transmission is completely secure.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by email or a banner on the site. Continued use after changes constitutes acceptance.

12. Contact

Questions about this policy? Email [email protected].