Privacy Policy
Last updated: October 2026
1. Data Controller & Overview
OrientPass (https://orientpass.com, contact: orientpass@hotmail.com) is committed to protecting your privacy. This policy outlines how your data is handled when using our travel eSIM services.
2. Orders & Payment Processing
Payments are handled by Stripe. Payment details are entered on Stripe Checkout; we do not store complete card numbers. We keep the order reference, plan, price, payment status and the contact details provided at checkout to process and support your order. Vercel hosts this website.
3. Digital Delivery (eSIM Profiles)
We use your checkout email to send installation details, order updates and customer support replies through Resend. Order and correspondence records are stored in our PostgreSQL database hosted on Neon. eSIM Access provisions the eSIM using the selected package and order reference.
4. Analytics & Cookies
We retain separate server request totals for 30 calendar days. Analytics is enabled by default. First-party HttpOnly cookies identify a browser for up to 90 days and group activity into sessions after 30 minutes of inactivity. We record page paths, viewed plans, checkout actions, timestamps, approximate country, device, operating-system and browser categories, referring domain and limited campaign labels, and link checkout orders to that browser. Verified payment and delivery status come from server order records, not browser claims. Browsing records and attribution links are retained for up to 90 days. We record the connection IP address and approximate city supplied by our hosting platform with analytics events, visible only to authorized administrators, for up to 90 days. City estimates describe the network location, not a precise personal location. Complete user-agent strings, arbitrary query strings and form contents are not stored in this analytics system. DNT/GPC browser signals are respected. Legally required order records remain separate. Security rate limiting and hosting technical logs are separate from analytics. We also derive a keyed pseudonymous identifier from the connection IP to exclude administrator networks; unique visitors are counted by signed browser identity. We keep that identifier with analytics records for up to 90 days; administrator exclusion entries, including the IP address and operator note, remain until removed. A shared IP does not merge customer accounts or orders.
5. Your Rights (GDPR)
You retain full rights under GDPR to access, rectify, or delete personal data stored in connection with your orders. For inquiries, contact support at orientpass@hotmail.com.
6. Referrals and store credit
When you choose a discount code or follow a referral link, we remember the code for 7 days in a necessary cookie. For your optional credit account, we verify your email through Resend; a single-use sign-in code lasts 10 minutes and the sign-in cookie lasts 30 days. Only protected verification values of codes and sessions are stored. Referral attribution, discounts, credit and reversals remain linked to orders. Referrers see amounts and payment dates, not referred customers' names or email addresses. Link visits are recorded as daily counts for 90 days, respecting your analytics choice and DNT/GPC. Contact us for access or deletion; legally required order records may need to be retained.