Find a plan

Privacy Policy

Last updated: October 6, 2026

Operated by Mirage Global Technologies LLC. Privacy is our product — this policy is deliberately short and honest.

  1. What we collect. An email address and a password (stored as a strong hash) are enough for the current travel-data account. If you sign in with Apple or Google, we store the identifier that provider gives us for you and the email address it shares (Apple may share a relay address). For calls, texts, phone numbers and SIP trunks we also ask for your full name and the country you live in — no document. Mirage Global Technologies LLC is a US company, so we check them against the official US sanctions lists (OFAC) on our own servers: when you give them, before a new number or trunk, and again whenever a list changes. We also print your name on your invoices. The mobile app registers a push-notification token for each installed device so we can tell you about your orders. We confirm email ownership for security-sensitive actions. A future regulated product may require separate information and disclosure before it is offered.
  2. What we store to run the service. Your orders, wallet ledger, eSIM records (activation codes and QR data are stored encrypted with AES-256-GCM), notifications, and the messages you send us via the contact form. Login sessions record an IP address and browser signature for security. For each call we record the calling and called numbers, the times, the duration and the result, the IP address and port the call was placed from and the software that placed it; for each text, the numbers, the time and the price.
  3. Why we use your data. To run your order and your account (a contract with you). To keep the service safe, stop fraud and meet our obligations as a telephone company (our legitimate interest and the law). To measure and advertise, only if you accept it in Cookie settings (your consent, which you can withdraw at any time).
  4. Browser storage and measurement. Login tokens, campaign frequency and anonymous Journey work can be kept in your browser. Optional measurement stays off until you choose it in Cookie settings, and each category can be withdrawn there at any time. Analytics loads Google Analytics: aggregate page and product measurement, with no account or eSIM identifiers. Marketing loads the advertising tags we use (Google Ads, Meta, TikTok), which learn which ad brought you and whether you bought, and keeps the affiliate or invite link that brought you (below). If you chose a category and then buy, our server reports that purchase once to the same services: the order number and amount, the campaign identifiers that brought you and, for marketing only, your IP address, your browser and a one-way hash of your email address. A hash is not anonymous: it is still personal data, only in a form the services cannot read back. Without your choice nothing is sent, and the campaign identifiers we keep are deleted after 90 days.
  5. Advertising and “sharing”. We do not sell your personal information for money. If you accept marketing cookies, Google, Meta and TikTok receive identifiers (and, after a purchase, a hashed email address) so they can measure and show our ads; some US state laws call this “sharing” for targeted advertising. You can turn it off any time in Cookie settings. We treat the Global Privacy Control signal as an opt-out: when your browser sends it, marketing stays off and cannot be switched on from that browser.
  6. Affiliate and invite links. If you arrive through an affiliate’s link or a friend’s invite, our server counts the click (the link’s code and the page — nothing about you). We keep the code in your browser for 30 days only if you allow Marketing in Cookie settings; otherwise it is kept only while the page stays open. When you sign in, it is attached to your account so we can pay the affiliate or give you and your friend the invite credit. The affiliate sees the date, the amount and the commission of the orders it brought — never who you are; a friend who invited you sees only how many friends joined and were rewarded. When someone uses your invite link or code, they see your first name and the initial of your last name next to it (for example “Anna K.”), so they know whose invite it is — never your email address or anything else, and only once the invite is on their account. Nothing about it is sent to an advertising service.
  7. Visits. Every visit to the website and every use of the app is recorded on our own servers: the IP address, the country, region and city our network provider (Cloudflare) derives from it, the browser, system and device, the headers your browser sends (never cookies, passwords or login tokens), the page or screen, the site or campaign that sent you, your time zone, languages and screen size, and a random identifier kept in your browser or the app so that visits can be counted. If you are signed in, the visit is linked to your account. Sign-ups, sign-ins and payment attempts are recorded the same way, with what the payment processor reports about a card that was tried (its country, type and the reason it was declined) — never the card number. We use these records to understand how people find and use MirageTEL, to detect fraud and to keep the service secure. They are kept without a time limit; you can ask us to delete the ones linked to you.
  8. Payments. Use only methods shown at checkout. Card details are collected by the hosted payment processor; MirageTel stores transaction references and does not store a full card number.
  9. Sharing. Our network partners receive only the technical minimum required to deliver your eSIM or plan (e.g. the package and the eSIM identifier). Payment and infrastructure services receive the limited account or transaction data needed for their part of the service. Your name and country are not sent to anyone for the sanctions check: the lists are downloaded and compared here. Who receives data: payment processing (Stripe), network protection (Cloudflare), the network and number providers needed to deliver your service, and — only with your consent — Google, Meta and TikTok.
  10. Infrastructure and international transfers. Traffic passes through Cloudflare for security; our servers are located in the EU. Some providers we use (payment, network protection, advertising and measurement) are in the United States. For them we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses in that provider’s terms.
  11. Retention and deletion. Account data is kept while the account exists. You can close your account yourself from Settings in the portal or the app: active eSIMs are cancelled, a remaining wallet balance is not refunded and can no longer be used, and your personal data is removed together with anything not legally required to keep (receipts already issued are kept as records of the sale, without your identity). Call and text records — the numbers, the times, the duration and price, and the address a call came from — are kept for 18 months, also after the account is closed, and then deleted: a telephone company must be able to answer who placed a call. A record named in a traceback request from a carrier, a regulator or law enforcement is kept with that request. If a closed account had a number, a call or a SIP trunk, who it belonged to is kept encrypted for that purpose alone, and deleted once its last call record is. Before a month of records is deleted, its totals are kept for 3 years without any number or account in them. The words of a text are erased after 90 days. The record of who looked at customers’ call records is kept without an expiry date. Each sanctions check (the name and country checked, the list, the result) and any decision a person made on it are kept without an expiry date too; closing the account removes the name and country from the account itself. You can also ask us via the contact form.
  12. Your rights. Depending on where you live, you can ask us to access, correct, delete or export your data, to object to or restrict how we use it, and to withdraw consent — one message through the contact form is enough. You can also complain to your data protection authority.
  13. Children. The service is not for people under 16, and we do not knowingly collect their data.
  14. Changes. The current version of this policy always lives on this page.
  15. Contact. Contact form — the fastest way to reach Mirage Global Technologies LLC about anything in this policy.