Privacy Policy

In short

• We collect only what we need to deliver your eSIM and support you.
• Stripe handles card payments; we never see or store your full card number.
• We don't sell your personal data.
• You can ask us to access, correct or delete your data at any time.

Who we are

Ahlano ("Ahlano", "we", "us") sells travel eSIM data plans through ahlano.com. Ahlano is operated from the United Arab Emirates and handles personal data in line with UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

The data we collect

• Account details: your name, email address and, if you add it, your phone number.
• Order details: the plans you buy, your eSIM identifiers (such as the ICCID) and the data usage our network partners report, so we can show what's left on your plan.
• Payment details: Stripe processes your card or wallet payment. We receive confirmation of the payment, never your full card details.
• Technical details: your IP address, device and browser type, and the cookies needed to run the site and keep you signed in.
• Messages you send us, such as support requests.

How we use your data

• To deliver your eSIM, installation instructions and receipts.
• To show your data usage and alert you when your plan is running low or about to expire.
• To answer support requests and process refunds.
• To prevent fraud and keep the site secure.
• To meet our legal and tax obligations.
• To send offers, only if you've agreed to receive them. You can opt out at any time.

Who we share it with

We share personal data only with providers that help us run the service, and only what each one needs:

• eSIM network partners, to issue and manage your eSIM. They receive an order reference, not your name or email.
• Stripe, to process payments.
• Our email delivery and hosting providers, to send messages and run the site.
• Analytics and advertising partners, only with your permission, as described in "Marketing and measurement" below.
• Authorities, when the law requires it.

We do not sell your personal data.

Transfers outside the UAE

Some of these providers process data outside the UAE. When that happens, we rely on providers that protect personal data to a standard consistent with UAE law.

How long we keep it

We keep your account data while your account is open. We keep order and payment records for as long as UAE tax and commercial law requires, then delete or anonymise them.

How we protect it

Connections to ahlano.com are encrypted, access to customer data is limited to the people who need it, and payment details stay with Stripe.

Your rights

You can ask us to:

• Give you a copy of your data.
• Correct data that's inaccurate.
• Delete your data, unless the law requires us to keep it.
• Stop or limit how we use your data, including for marketing.
• Withdraw a consent you gave us.

To use any of these rights, contact us using the details below. We aim to reply within 30 days.

Cookies

We use cookies that keep the site working and remember your language and currency. Analytics, marketing and personalisation cookies are used only if you allow them in the privacy choices banner; until you choose, they stay off. You can change your choice at any time from "Privacy choices" at the bottom of every page, and clear or block cookies in your browser settings.

Marketing and measurement

When you first visit, we ask which kinds of measurement you allow: analytics, marketing and personalisation. What is strictly necessary to run the store is always on; everything else waits for your choice, which you can change at any time from "Privacy choices" on the website or in the app's account screen.

On our own servers we keep a record of how you reached us (for example the ad, link or search engine), the pages and screens you view and your searches and checkouts, under a random identifier stored on your device. We use it to count which campaigns bring customers. It is linked to your account when you sign in, is kept for 90 days, and is never sold.

With your permission, the following partners receive information about your visit and, where you allowed marketing, about your purchases:

• Google Analytics 4 (Google) — Analytics: counts visits and which pages and screens are used, and receives our own record of purchases and refunds, so we can see what works and improve the store.
• Meta Pixel and Conversions API (Meta, for Facebook and Instagram) — Marketing: measures our ads on Facebook and Instagram and shows them to people likely to find them useful; it receives the pages you view, searches, checkouts, sign-ups and purchases, with your email address and phone number only in hashed (scrambled) form.
• Google Ads (Google) — Marketing: measures which of our Google ads lead to purchases and shows our ads again to people who visited; it receives the ad click identifier, the plans you view and checkouts from your browser, and from our servers the purchase, with your email address and phone number only in hashed (scrambled) form.
• TikTok Pixel and Events API (TikTok) — Marketing: measures our ads on TikTok and shows them to people likely to find them useful; it receives the pages you view, searches, checkouts, sign-ups and purchases, with your email address and phone number only in hashed (scrambled) form.
• Snap Pixel and Conversions API (Snap, for Snapchat) — Marketing: measures our ads on Snapchat and shows them to people likely to find them useful; it receives the pages you view, searches, checkouts, sign-ups and purchases, with your email address and phone number only in hashed (scrambled) form.
• Microsoft Advertising UET tag (Microsoft, for Bing) — Marketing: measures our ads on Bing and Microsoft's ad network and shows them again to people who visited; it receives the pages you view, searches, plan views and checkouts from your browser only.
• X Pixel (X) — Marketing: measures our ads on X; it receives plan views, plans added to the cart, checkouts and sign-ups from your browser only.
• AppsFlyer (in the Ahlano app) — Marketing: tells us which ad or link led to an app install and passes the app's events (plan views, checkouts, sign-ups and purchases) to the advertising partners above; on an iPhone it uses the advertising identifier only if you allow tracking, and our servers tell it about refunds.

If you refuse analytics, Google Analytics may still receive an anonymous count of a purchase, without any identifier that could link it to you. If you refuse marketing, nothing is sent to advertising partners. We never send your name, and your email address and phone number leave our servers only in hashed form. These partners process the data under their own privacy policies and may do so outside the UAE.

Advertising audiences: if you allowed marketing after we added this purpose (privacy choices version 2), we may send your email address and phone number, hashed so they cannot be read, to Meta, Google, TikTok and Snapchat to build lists of customers for our ads, for example to show offers to recent travellers or to leave existing customers out of ads for new ones. These platforms match the hashes against their own users and do not receive the readable values from us. If you withdraw marketing, close your account or unsubscribe from marketing emails, we remove you from these lists on the next update, usually within a day.

The Ahlano app: notifications and in-app activity

When you use the Ahlano app we record a device identifier, its language, currency and time zone, the country it is used in, and in-app events such as the destinations you browse, your searches and started checkouts, so we can show relevant plans and send notifications you choose to receive.

You can turn marketing notifications off with one tap in your account's Notifications screen; account and eSIM alerts can be turned off there too. Location, where you allow it, is read only while the app is open and only the country is kept.

Apart from the measurement partners you allow (see "Marketing and measurement"), we do not share this data with any third party. Notifications travel through Expo's push service, which sees the device identifier and the message, nothing else. Usage events are deleted after 180 days.

Children

Ahlano isn't intended for children under 18, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date at the top of this page and tell you by email about any significant change.

Contact us

Questions about this policy or your data? Reach us through our Contact page