Privacy Policy

Last updated: October 1, 2026

1. Data Controller

Company: SabraConnect LLC

Registered address: 2108 N St Ste N, Sacramento, CA 95816, USA

Email: support@sabraconnect.com

WhatsApp: +972 50-333-3319

SabraConnect LLC, a California limited liability company, is the data controller responsible for your personal information under the EU General Data Protection Regulation (GDPR) and applicable Israeli privacy law (Protection of Privacy Law, 5741-1981).

2. Information We Collect

Identity and Contact: Email address and phone number when you purchase or contact us via WhatsApp.
Order Data: eSIM order ID, plan details, activation status, and assigned mobile number (top-up orders).
Payment Data: Payments are processed by Stripe. We do not store card details.
WhatsApp Communications: Your phone number and message content for support and purchase processing.
Usage Data: With consent - pages visited, clicks, scroll depth and plan interactions (Google Analytics 4).
Technical Data: Browser type and general country-level location for fraud prevention and service delivery.
Chatbot Interactions: Messages sent to our automated assistant for real-time support.
Network and Roaming Data: Network-level data may be processed by Pelephone and roaming partners according to their policies.
Lead Capture: When you submit our "leave your details" form (web chat or WhatsApp), we collect the name, email, phone, and free-text message you provide, plus your IP address for fraud prevention.
Operational Logs: Customer email addresses are pseudonymised in our server logs (e.g. "g***@e***.com") so that long-lived logs cannot be used to identify individual customers.
WhatsApp Updates (optional): If you tick “Keep me updated on WhatsApp” at checkout, we use the phone number you entered to send activation help and order-status messages on WhatsApp. The box is unticked by default, buying does not depend on it, and you can opt out at any time by replying STOP or emailing support@sabraconnect.com.

3. Legal Basis for Processing (GDPR Art. 6)

We process personal data only when we have a valid legal basis.

Processing Activity
Legal Basis

Fulfilling your eSIM order and activating service
Contract - Art. 6(1)(b)

Processing payment via Stripe
Contract - Art. 6(1)(b)

Sending purchase confirmation and activation emails
Contract - Art. 6(1)(b)

Customer support via WhatsApp or email
Contract - Art. 6(1)(b)

Fraud prevention and security
Legitimate interest - Art. 6(1)(f)

Retaining records for tax/accounting obligations
Legal obligation - Art. 6(1)(c)

Google Analytics usage tracking
Consent - Art. 6(1)(a)

Optional WhatsApp activation-help and order-status updates (checkout checkbox)
Consent - Art. 6(1)(a)

Where we rely on consent, you may withdraw it at any time — via Cookie Preferences for analytics, or by replying STOP on WhatsApp (or emailing us) for WhatsApp updates.

4. Data Sharing and Third-Party Processors

We share personal data only when needed and under data processing agreements (DPAs).

IsraSIM / Pelephone (Israel)

Purpose: eSIM activation and network connectivity
Data: phone number, plan details, connectivity metadata
Safeguard: EU adequacy for Israel and contractual measures where applicable

Stripe (USA)

Purpose: payment processing
Data: email address only
Safeguard: SCCs

AWS and MongoDB (USA)

Purpose: infrastructure and order storage
Data: order data, email, phone
Safeguard: SCCs under provider DPAs

Meta WhatsApp Business API (USA)

Purpose: customer support messaging
Data: phone number and message content
Safeguard: SCCs

We never sell personal data for marketing purposes.

5. International Data Transfers

Some processors are located outside the EEA and Israel. When data is transferred internationally, we rely on appropriate safeguards, including EU Standard Contractual Clauses (SCCs).

6. Data Retention

Data Category
Retention Period
Reason

Order records
7 years
Tax and accounting obligations

WhatsApp conversations
2 years
Support continuity

Chatbot logs
Up to 90 days
Quality and safety checks (auto-deleted via database TTL)

Analytics data
14 months
Consent-based analytics

Admin audit log
1 year
Forensic investigation of admin actions

Lead captures
Up to 2 years from submission
Sales follow-up and conversion attribution

7. Your Rights Under GDPR

You can exercise your rights by contacting support@sabraconnect.com. We respond within 30 days.

Right of Access
Right to Rectification
Right to Erasure
Right to Restrict Processing
Right to Data Portability
Right to Object
Right to Withdraw Consent
Right to Lodge a Complaint

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights. Submit requests to support@sabraconnect.com; we verify your identity using the email or phone number on your order and respond within 45 days. You may use an authorized agent.

Right to Know: the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of third parties we disclose it to (see Sections 2 and 4).
Right to Delete personal information we collected from you, subject to legal exceptions (e.g. tax records).
Right to Correct inaccurate personal information.
Right to Opt Out of Sale or Sharing: we do not sell personal information for money. Advertising cookies may count as “sharing” for cross-context behavioral advertising; use the “Do Not Sell or Share My Personal Information” link in the site footer or a Global Privacy Control signal to opt out.
Right to Limit Use of Sensitive Personal Information: we do not use sensitive personal information for purposes that require offering this right.
Right to Non-Discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised these rights.

9. Cookies

Non-essential cookies are set only after explicit consent. You can change preferences anytime via Cookie Preferences.

10. Data Security

We use technical and organizational measures including HTTPS, encryption at rest, least-privilege access controls, and periodic security reviews.

11. Children's Privacy

Our services are not directed to individuals under 18. If we become aware of unintended collection, we delete such data promptly.

12. Changes to This Policy

We may update this policy periodically. Material changes are communicated by email or site notice before taking effect.

13. Contact and Complaints