Privacy policy
Information used to provide and protect the service, and your rights over it.
Controller and contact
CONSULT FUSION LTD operates Vaylio and controls the personal information described here, except where another party acts as an independent controller. Registered in England and Wales, company 16980506, at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Privacy contact: privacy@vaylio.io. Test operation does not make your real account or email information fictional.
Information and purposes
You provide name, email, account/verification details, support messages and device information. Records include orders, invoices, prices/currency, payment status/references, eSIM provisioning, provider IDs, ICCID, status/usage, referrals and test rewards. Security records include sign-in, sessions, browser details, IP where available, audits and fraud reviews. Checkout collects no separate billing address and stores no complete card numbers or security codes.
Why we use it
To manage accounts, fulfil and track orders/eSIMs, deliver email/documents, process payments, support, complaints and refunds, prevent fraud, meet record duties and resolve disputes. Order/problem reporting supports improvements. No visitor analytics trackers, advertising tools, marketing campaigns or marketing-preference records are active. Future optional marketing/analytics need appropriate notices and lawful choices; buying is not consent.
Lawful bases
Account, order and related support processing supports our contract or steps you request before it. Mandatory records rely on legal obligations. Security, fraud prevention, dispute review and service improvement rely on legitimate interests balanced against your rights. Optional functional storage follows your choice in the cookie policy. Consent is sought where required for optional processing; accepting this notice is not blanket consent.
Sign-in and payments
Choosing available social sign-in, such as Google, supplies identity details such as provider account ID, name, email and verification status. Apple requires actual configuration. We do not receive your provider password. Passkeys use a public key and authenticator details; we receive no face/fingerprint biometrics. When offered and selected, Stripe or PayPal receives the order reference, amount and currency; Stripe also receives email. Payment credentials are entered with the processor. Availability is shown at checkout.
Suppliers and sharing
Authorised staff access information needed for service, support and security. Hostinger handles email addresses, content and order documents. eSIM Access receives the package ID and transaction reference to fulfil a paid order; authorised queries use eSIM/provider references for verification. Live connectivity involves infrastructure, networks and roaming partners processing necessary service data under their roles. Sign-in/payment providers may be independent controllers for some purposes. Hosting, backups, advisers or authorities may receive necessary information. An optional WhatsApp link opens an external service under its policies, not an embedded tracking chat.
Locations and transfers
We do not claim all data stays in the UK. Providers may process it elsewhere. Locations and safeguards depend on actual arrangements; a restricted transfer needs an appropriate basis, such as applicable adequacy or contractual safeguards with required assessment. Request provider, location and safeguard information from privacy@vaylio.io; listing a provider here does not certify its transfer safeguards.
Retention
Retention depends on record type, account/fulfilment needs, support, security, accounting/legal duties and ongoing disputes. Session/code expiry does not automatically delete server orders or records. We do not promise automatic deletion or an unimplemented uniform period. Requests and retention/minimisation needs are reviewed, including backups. Controls include restricted access, encrypted installation information and authentication; absolute security is not guaranteed.
Your rights
Email privacy@vaylio.io for access, correction, erasure, restriction or portability where applicable, or to withdraw optional consent without affecting earlier lawful processing. Identity checks and legal exceptions may apply. Account export/deletion requests open a support review; they do not automatically export data or erase invoices. You may complain to the ICO at https://ico.org.uk/make-a-complaint/ or your competent authority.
Right to object
You may object to legitimate-interest processing based on your circumstances, and to any direct marketing if introduced, through privacy@vaylio.io. Using the service does not prevent an objection.
Required information and changes
Missing required account or verification details may prevent secure fulfilment. Security checks can restrict actions; contact support for review of a result. Material purpose/provider changes are explained in this policy and its update date.