Information We Collect
At checkout, we collect the contact name, email, selected plan, city, pickup point, order and payment status, notification records, and referral or campaign parameters used to understand the order source.
Based on the processing result, the unified backend records passport document type and document and age eligibility when document verification is completed. It also records each SIM's final success or failure result, fixed failure reason, refund status, and administrator action. The contact name and email entered at checkout are encrypted at rest; the name is shown in the order to authorized administrators for fulfillment and support, and on-site processing does not require a second name entry. The on-site service party may independently inspect a passport for processing; the website system does not collect or store passport numbers, passport images, dates of birth, or exact ages.
Payment And Email Providers
When Stripe Checkout is used, Stripe receives the checkout email, public order number, product, quantity, amount, currency, and payment and refund identifiers. The platform stores transaction, refund, and settlement records but not full card numbers.
The encrypted email outbox stores the recipient, subject, body, attachment, and delivery status. Order Voucher emails may contain order, product, pickup date, amount, and guide details. Result and refund emails may include the public order number and lookup or support links, and present summary counts, refund amount, currency, and status—not failed-SIM sequence numbers, failure reasons, document data, or payment-provider information.
Cookies And Security
The site stores language, market, and currency preferences in cookies or local storage for up to one year. First and last landing pages, referring-site origin, UTM parameters, gclid, and fbclid are stored locally for 30 days and submitted with an order.
When anonymous traffic measurement is enabled, the browser creates a first-party random visitor ID containing no name, email, or IP address. It is stored for up to 13 months, and a new session starts after 30 continuous minutes without activity. UV is calculated from that random ID, not from IP. Only allowlisted page templates and necessary dimensions for market, language, currency, product, pickup point, campaign source, access platform, experience surface, and coarse device category are sent—not full URLs, query parameters, referrer addresses, order numbers, access credentials, full browser identifiers, or personal data. No anonymous measurement ID or event is created or sent when the browser enables Global Privacy Control or Do Not Track.
Raw anonymous visit and interaction events are retained for 90 days. Daily aggregates use the Beijing-time calendar day, are retained for 13 months, and are available only to authorized administrators.
Private order access uses an HttpOnly cookie for up to 90 days. Security logs record IP address, path without query parameters, status, timing, and browser information, with short-term IP rate limits. Clearing cookies or local data resets preferences and may require order-access recovery. Do not forward the order page or payment link.
Data Use And Requests
Order, notification, payment and refund, processing-result, and security records are used for support, refunds, fulfillment, security review, and necessary record management, with corresponding access controls and backup measures.
To request access, correction, or deletion of order data, email salrgcsl@gmail.com from the checkout email address and provide the order ID. Handling remains subject to applicable requirements and necessary record retention.
GCSL is the data controller for personal data processed by this website in connection with orders, payments, pickup, customer support, and after-sales service. It handles data-access, correction, deletion, privacy, and customer-support requests through salrgcsl@gmail.com. An on-site service party may independently verify a passport where necessary for activation, but it is not the controller of the website, order, payment, or support data unless it separately identifies its own processing.
Optional analytics · Google Analytics 4
We load Google Analytics 4 (GA4) only after you allow analytics. It uses cookies and pseudonymous identifiers to analyse visits, sources, approximate regions and booking performance. Google processes technical connection information and may process data abroad. We do not enable ad personalisation or Google Signals.
We send selected page, language, plan and interaction data. Server-confirmed payments and refunds use an opaque transaction reference and actual amounts. Names, email addresses, passport details, original order numbers, order links and access credentials are excluded from these events.
Your analytics choice and GA4 cookies last up to 180 days. Encrypted identity links and delivery records on our server are retained for up to 90 days. You can withdraw through Analytics preferences. Declining, withdrawing, or enabling Global Privacy Control or Do Not Track does not affect purchases. Withdrawal stops future sends; it does not automatically delete data already sent to Google. Contact salrgcsl@gmail.com for assistance.