Information we collect
We collect order ID, email, package information, payment status, selected language, theme preference, guest device identifier, and order recovery data needed to display your eSIMs on the current device.
If you contact support, we may process the device model, destination, screenshots, issue description, and communication history you provide.
If you sign in with a passwordless email link, we process your email, one-time login tokens (stored only as a hash, never in plain text), and a signed login session cookie that lasts up to 60 days.
How we use information
We use this information to process checkout, deliver eSIM installation details, remember guest orders on the current device, provide support, prevent abuse, and improve package selection experience.
Service providers
To operate the service we share only the necessary data with: Stripe (payment processing â Stripe handles your card details under PCI-DSS; we keep the order amount, status, and Stripe transaction reference, not your full card number); our eSIM supplier (eSIM Access, to issue your eSIM); hosting and database providers (Vercel and Supabase); and our email provider (Resend, for receipts, eSIM delivery, support, and login emails).
We use Google Analytics 4 (with IP anonymization) to understand page views, device and browser type, approximate region, and conversion behavior so we can improve the buying experience. We do not send payment secrets or full eSIM activation credentials to analytics.
These providers may process data in countries other than where you are located. We share only what each provider needs to deliver its part of the service.
Retention and choices
Order and support records are kept for service delivery, accounting, dispute handling, and compliance needs. You can request access, correction, deletion, or export by contacting support@sohogoto.com.
Financial and order records are kept for the period required by applicable law; in Hong Kong, accounting records are kept for at least 7 years. When data is no longer needed, we delete or anonymize it.