Privacy policy

1. What we collect

To sell you an eSIM and support it afterwards, we store:

• Your WhatsApp number. This is how we deliver the eSIM and how you log in. It is also your account — there is no username and no password.
• Your name, if you give it, so a human message does not open with “Dear customer”.
• Your email, only if you choose to give one as a delivery backup.
• Your phone brand and model, from the compatibility checker, so we can support you and so we know which models to verify next.
• Your order and payment reference, including the transaction ID you type in, so we can match your payment to your order.
• The eSIM's technical details and its data usage, which come from the network.
• How visitors use the site, counted on our own server: the site or link you arrived from, the pages you opened, roughly how long you stayed and how far you scrolled, your phone type and browser, and your approximate city, worked out from your IP address. The IP address itself is not stored. This tells us which posts and adverts actually help people, and which pages confuse them. If you place an order, it is linked to that order so we know what led to it — and to nothing else.

2. What we do not collect

• No passwords. There are none to steal because we never set any.
• No card numbers. We never see them. Payments are made in your own banking or wallet app.
• No CNIC, passport or ID documents. We do not ask and you should be wary of anyone selling this who does.
• No third-party analytics. The visit counting described above runs entirely on our own server and is never sent to anyone. Nothing records your screen or follows your mouse, and there is no Google Analytics on this site. Locations come from a database kept on our server (IP Geolocation by DB-IP), so your IP is never looked up anywhere else.
• No personal data in our advertising. We run ads on Facebook and Instagram, so Meta's advertising pixel loads on these pages — it is the only code on this site that comes from anyone else's server. It tells Meta that an order was placed and what it was worth. It is never given your name, your number, your email or your eSIM details, in any form, hashed or otherwise. Section 5 says how to turn it off.
• No browsing history. We have no visibility into what you do with the connection. That traffic goes through the mobile network, not through us.

3. Cookies

Ours: up to three, none shared, none used for advertising. A session cookie keeps you logged in and protects forms against cross-site request forgery. A visitor cookie (fs_vid, one year) holds a random number so that two visits from the same phone are counted as one person, not two. A referral cookie (fs_ref, 30 days) is set only when you open a friend’s referral link, so they get their reward if you buy later.

Meta's: one. The advertising pixel sets a cookie (_fbp) that lets Meta recognise the same browser later, so a sale can be matched to the ad that led to it. It holds a random number, not your identity. Blocking it, or blocking the pixel entirely, changes nothing about how this site works — see below.

4. Who else sees your data

Only where it is needed to actually deliver the thing you bought:

• The eSIM platform that issues your eSIM receives the order — not your name or phone number.
• Meta (WhatsApp) carries our messages to you, which necessarily means your number passes through them.
• Meta (advertising) receives, from the pixel described above, that a visit or an order happened and what the order was worth — never who placed it.
• An AI service (Groq) reads the WhatsApp messages you send us so our assistant can answer in seconds. It sees the message and the status of your order — never your eSIM codes. When you send a payment screenshot, it reads it too, so we can check it faster; a person still confirms every payment.
• Our hosting provider stores the database on our behalf.

We do not sell your data and we never hand your name, number or email to an advertising network. Nobody else gets it — including other sellers — for any reason.

5. Turning the pixel off

Nothing on this site needs it. Any content blocker, Firefox's or Safari's built-in tracking protection, or Meta's own ad preferences will stop it, and the site behaves exactly the same — checkout, delivery and your account are unaffected. We would rather say that plainly than put a consent banner in front of every page.

6. Security

The site is served over HTTPS. Your eSIM's installation link and activation code are treated as secrets: they are never written to our logs, never put in a URL, and never included in an error message. Anyone holding that link could install your eSIM, so we treat it the way we would treat a password.

7. How long we keep it

• Orders and payment references: seven years. Tax records for a registered business are not optional.
• eSIM credentials: deleted once the plan has expired and the support window has closed.
• Compatibility checks: kept without your name or number attached — we keep the phone model, not the person.
• Error logs: fourteen days, then deleted automatically.
• Visit records: the pages opened, 90 days; where a visit came from, 13 months. Then deleted automatically.

8. Your rights

Message us and ask. You can have a copy of everything we hold about you, have a mistake corrected, or have your record deleted — except the order and payment records we are legally required to retain. We do not charge for this and we do not make you fill in a form to ask.

9. Who to contact

First SIM, trading as FirstSIM, a sole proprietorship registered in Pakistan. Write to us, call us or message us using any of these: