Privacy Policy
Last updated: 31 October 2026
This policy explains how Rapidez Internet Solutions Limited, trading as CALA ("we", "us"), collects and uses personal data when you visit calafly.net, buy or claim an eSIM, chat with us, use our customer portal, connect an AI assistant to CALA, or apply to our partner programme. We act as data controller and process personal data under the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
- Controller: Rapidez Internet Solutions Ltd, registered office: 124–128 Fergusson House, London, EC1V 2NX, United Kingdom. Company registration number: 13185548.
- VAT: GB441 9929 65
- Privacy contact: support@calafly.net
We are not required to appoint a Data Protection Officer (Art. 37 GDPR); our privacy contact handles all data-protection enquiries. EU residents may also contact us at the same address on matters relating to the EU GDPR.
2. Personal data we collect
Information you give us
- Account data — email address and password (stored only as a secure hash by our authentication provider).
- Order data — first and last name, email, phone number (optional), plans purchased, order number, amount, currency, promo code and timestamps.
- Date of birth — collected at checkout and for free eSIM claims solely to confirm you are 18 or over. It is stored with your order and is never displayed back on the website.
- Billing address — collected by Stripe for payment, tax and fraud checks.
- Payment data — Stripe customer, payment and subscription identifiers. We never receive or store your full card details; Stripe collects them directly.
- Consent records — the fact and time you accepted our Terms and Privacy Policy, and whether you opted in to marketing emails.
- Email and review-invitation records — recipient name and email address, order/reference number, invitation status, send time, provider message identifier and delivery or rejection information where available.
- Marketing opt-outs — your email address and the time you unsubscribed, retained to prevent further marketing and review-request emails.
- Free eSIM claims — email, mobile number, first and last name, date of birth, postal address, and the time your phone number was verified.
- Chat data — messages you exchange with our AI assistant or our human support agents, and any details you choose to include.
- Support emails — the content of emails you send to us.
- Partner applications — name, agency or hotel name, contact details, website, target destinations and other information you submit on our partner form.
Information collected automatically
- Technical data — IP address, browser and device type, pages visited and referring URL (security and server logs).
- Approximate country — derived from your IP address by our hosting provider to show prices in your local currency. We do not store your precise location.
- Bot-protection signals — Cloudflare Turnstile checks your browser before we send a verification SMS.
- Cookies and similar technologies — see our Cookie Policy.
We do not intentionally collect special-category data (such as health or religious beliefs). Please do not include it in chats or emails.
3. Why we use your data and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account and customer portal | Account data | Contract — Art. 6(1)(b) |
| Take payment, deliver your eSIM, manage renewals and top-ups | Order, billing and payment data | Contract — Art. 6(1)(b) |
| Confirm you are 18 or over | Date of birth | Contract (eligibility) — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Send order confirmations, delivery and renewal emails | Account and order data | Contract — Art. 6(1)(b) |
| Verify your phone and fulfil a free eSIM claim | Free eSIM claim data | Contract — Art. 6(1)(b) |
| Answer chats and support requests, including AI-assisted replies | Chat and support data | Contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Send marketing emails about destinations and offers | Email, name | Consent — Art. 6(1)(a) (opt-in box, withdraw any time) |
| Request honest feedback about a completed purchase through Trustpilot | Name, email, order/reference number, invitation records | Legitimate interests — Art. 6(1)(f), to understand and improve our service, subject to your right to object and applicable electronic-marketing rules; consent where required |
| Respect email opt-outs and prevent duplicate review invitations | Email, opt-out time and invitation records | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Advertising measurement and analytics | Cookie and device data | Consent — Art. 6(1)(a) and PECR reg. 6 |
| Prevent fraud, bots and abuse; keep the service secure | Technical, order and bot-protection data | Legitimate interests — Art. 6(1)(f) |
| Assess and manage partner applications | Partner application data | Steps before a contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Keep tax and accounting records | Order and payment data | Legal obligation — Art. 6(1)(c) |
| Respond to your privacy requests and legal claims | Relevant data | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (section 7). If you do not provide data required for an order (such as your email or date of birth), we cannot supply the eSIM.
Email communications and your choices
Providing an email address, accepting these terms or making a purchase does not by itself constitute consent to promotional email marketing. Marketing consent is optional and separate from purchase and account communications. Our purchase-related thank-you and review-request emails may invite honest feedback; you can opt out of these as well as promotional emails.
Use “unsubscribe here” in a marketing or review-request email and confirm your choice on the linked page, or contact support@calafly.net. We record your email address and opt-out time in a restricted suppression list and check it before sending further CALAFLY marketing or review-request emails. Essential order, delivery, security and account messages are not stopped by this choice.
4. Automated decisions and AI
Our website chat assistant is AI-powered. It answers questions about plans, coverage and installation using our own catalogue; you can ask to "Talk to a human" at any time. Your messages are sent to an AI model provider to generate replies and are not used by us to train AI models. The only automated checks we carry out are the 18+ date-of-birth check, bot protection and fraud screening by Stripe; none of these produce legal or similarly significant effects without the option of human review — contact us if you think a check was wrong.
5. Who we share data with
We use service providers to operate the service. Processors act under data-processing terms; some recipients, including Trustpilot for its own review platform, may also act as independent controllers.
| Provider | What they do | Location |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe Inc. | Payments, billing address, fraud checks, subscriptions | EU / UK / USA |
| Lovable AB (Lovable Cloud) | Website hosting, database, sign-in, email sending and AI gateway | EU / USA |
| Brevo (Sendinblue) | Email delivery for customer thank-you and review-request emails; recipient details, email content and delivery information | Processing locations depend on Brevo and its subprocessors; see its privacy policy |
| Trustpilot | Automatic Feedback Service review invitations using customer name, email address and order/reference number; operates its review platform under its own privacy policy | Processing locations depend on Trustpilot and its subprocessors; see its privacy policy |
| Supabase Inc. | Database and authentication infrastructure (via Lovable Cloud) | EU / USA |
| Cloudflare Inc. | Content delivery, security, DDoS protection and Turnstile bot checks | Global |
| Twilio Inc. | Sending SMS verification codes for free eSIM claims | USA / global |
| AI model providers (e.g. Google, OpenAI) via Lovable AI Gateway | Generating AI chat replies | USA / EU |
| Google Ireland Ltd / Google LLC | Google Tag Manager, Analytics and Ads — only with your consent; Google Fonts | EU / USA |
| Meta Platforms Ireland Ltd | Advertising measurement — only with your consent | EU / USA |
| Our eSIM network partners and operations team | Provisioning and activating your eSIM | UK / EU / global |
Order and free eSIM details are passed securely to our operations team so your eSIM can be issued. We may also disclose data where required by law, to protect our rights, or to a buyer if our business is sold (subject to this policy). We do not sell your personal data.
Our Brevo review-request email is sent to you, with a hidden copy (BCC) to Trustpilot’s Automatic Feedback Service. That copy contains the email content and structured customer name, email address and order/reference number so Trustpilot can send a separate review invitation. We do not include date of birth, residential address, phone number or payment-card details in this review-invitation data. The Trustpilot invitation address is not sent to our eSIM provisioning team.
Read Brevo’s Privacy Policy and Trustpilot’s Privacy Policy for their processing practices. Unsubscribing from CALAFLY stops future triggers from us but cannot recall a copy already sent to Trustpilot. Use the preferences or unsubscribe option in Trustpilot’s own emails to manage messages it already has scheduled.
6. International transfers
Some providers process data outside the UK and EEA, mainly in the USA. Where this happens we rely on UK adequacy regulations, the EU–US Data Privacy Framework and its UK Extension (where the provider is certified), or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. You can request a copy of the relevant safeguards from support@calafly.net.
7. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices, date of birth and billing records | 6 years after the end of the financial year (UK tax law), then deleted |
| Account data | While your account is active; deleted after 24 months of inactivity, following notice |
| Free eSIM claims | Up to 24 months after the claim, to prevent duplicate claims and abuse |
| SMS verification records | Verification codes expire after 30 minutes; records are deleted within 90 days |
| Chat transcripts (AI and human) | Up to 24 months |
| Partner applications | Up to 24 months if unsuccessful; for the life of the partnership plus 6 years if accepted |
| Marketing consent | Until you unsubscribe, plus a record of the opt-out so we respect it |
| Marketing suppression records | A minimal email address and opt-out timestamp for as long as necessary to honour your preference; not used to send marketing |
| Review invitation and email dispatch records | Kept as necessary to prevent repeat invitations and investigate delivery issues; provider logs are subject to the provider’s retention settings and privacy policy |
| Server and security logs | Up to 90 days |
| Cookie consent record | 12 months, then we ask again |
8. Your rights
Under UK and EU GDPR you have the right to:
- Access a copy of your data;
- Rectify inaccurate data;
- Erase your data where there is no lawful reason to keep it;
- Restrict our processing;
- Portability — receive your data in a machine-readable format;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent at any time (for marketing emails use the unsubscribe link; for cookies use "Cookie preferences" in the footer), without affecting earlier processing;
- Not be subject to solely automated decisions with significant effects.
Email support@calafly.net from the address linked to your order. We reply within one month (extendable by two months for complex requests) and may need to verify your identity. Requests are free unless manifestly unfounded or excessive.
You can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, if you live in the EU/EEA, to your local data-protection authority. We'd appreciate the chance to resolve your concern first.
9. Security
We use encryption in transit (TLS), access controls on our database so customers can only see their own data, hashed passwords and verification codes, least-privilege staff access, bot protection and rate limits. Card data is handled solely by Stripe (PCI-DSS Level 1). If a breach is likely to put your rights at risk, we will notify the regulator within 72 hours and inform you without undue delay.
10. Age
Our services are only for people aged 18 or over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
11. Changes
We will update this page when our practices change and show the new date above. Material changes will be notified by email or a notice on the website.
12. Contact
Rapidez Internet Solutions Ltd, 124–128 Fergusson House, London, EC1V 2NX, United Kingdom. Company registration number: 13185548 — support@calafly.net.