Privacy policy

Last updated: 19 October 2026

Who is responsible

The controller of your personal data is PINHAN GROUP LLC, a Delaware limited liability company, 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA. COTA eSIM is a product of PINHAN GROUP LLC.

For any privacy question or request, email [email protected].

Data we collect

Account and contact: your email address (required to sign in and to deliver your order); the first name, last name, phone number and country requested at checkout.

Purchases: your order history, the plans you bought, the amount and currency paid, promo codes used, your wallet balance and transactions, and referral (invite) relationships.

eSIM: the technical identifiers of the profile you bought (ICCID, activation code) and the data usage figures we receive from our supplier.

Support: the name, message and optional phone number you send through the support form (plus your account email address if you are signed in), and the emails you send us. If you choose to contact us on WhatsApp, we also see your phone number and messages there.

Mobile app devices: if you allow notifications, your device’s push token, platform, device model, operating system version and time zone. We use the time zone to avoid sending non-urgent notifications at night.

Technical data: your IP address and basic browser information, which our hosting, security and payment providers process to deliver the service and to prevent fraud and abuse.

We never see your card details. Payments are processed by our payment provider, Stripe; your card number is entered directly into Stripe’s secure field and never reaches our apps or our servers.

Our website and apps contain no advertising identifiers and no analytics or crash-reporting tools. We do not track your behaviour.

Signing in with a social account

If you sign in with Apple, Google or Facebook, we receive ONLY the following from the provider: your name, your email address and your user ID at that provider. That ID is stored so we can match you to the same account on your next sign-in.

We do NOT receive your friends list, your posts, your contacts or any other content, and we never post anything on your behalf.

If you use Apple’s “Hide My Email”, we receive a relay address. That address is a real, deliverable address: your order and eSIM details are sent to it and Apple forwards the mail to your real inbox.

You can unlink a provider at any time; deleting your account also revokes the Apple sign-in authorisation on Apple’s side.

Why we use your data

To perform our contract with you: to create your account, process your order, deliver your eSIM, email your QR code and installation details, show your usage and provide support.

For our legitimate interests: to keep the service secure, prevent fraud and abuse (including a bot-protection check when you sign in or check out), and improve the service.

To send notifications: order and usage alerts are part of the service. Campaign notifications are sent according to your notification preferences, which you can change at any time in the app.

To comply with legal obligations, such as keeping tax and accounting records.

Who we share it with

We share data only with service providers that run the service on our behalf, and only what each of them needs:

Stripe — payment processing and fraud prevention.

Our eSIM connectivity suppliers and the mobile network operators they work with — to issue and run your eSIM. They receive the technical data of the eSIM (such as plan and ICCID), not your name or email address.

Resend — sending our emails, including your eSIM details.

Cloudflare — domain name service, content delivery, security, bot protection (Turnstile) and encrypted backup storage.

Hetzner Online — hosting of our servers in Germany.

Google Firebase Cloud Messaging — delivery of push notifications to our mobile apps.

Apple, Google and Meta — only when you choose to sign in with them; we only ask whether your sign-in token is valid and do NOT tell them what you buy or do in our service. WhatsApp (Meta) — only if you contact us there.

We may also disclose data when required by law, or to a successor if our business is merged or sold.

We do NOT sell your data, do not share it for advertising, and do not use it to track you across other apps or websites.

International transfers

PINHAN GROUP LLC is based in the United States and our servers are located in Germany. Some of our providers process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Turkey is transferred to a country without an equivalent level of protection, we rely on the safeguards required by applicable law, such as the standard contractual clauses offered by our providers.

How long we keep it

We keep account data for as long as your account is open.

Order, invoice and payment records are kept for as long as tax and accounting laws require. If you delete your account, these records remain in a form that is no longer linked to your identity.

Support messages are kept for as long as needed to handle your request and any follow-up.

Deleting your account

You can delete your account from inside the app: Profile → Delete my account. Your personal data is irreversibly deleted 30 days after the request; within that window you can sign in and cancel the deletion.

Step-by-step instructions and the full list of what is deleted: /en/legal/delete-account

Your rights

Depending on where you live, including under the EU and UK GDPR and the Turkish Personal Data Protection Law (KVKK), you have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given.

To exercise these rights, email [email protected]. We will respond within the time limits set by law. You also have the right to lodge a complaint with your local data protection authority.

Cookies and local storage

We do not use advertising or analytics cookies. Our website uses only storage needed for it to work:

cota-theme — remembers your light or dark theme (1 year).

cota-currency — remembers the display currency you chose (1 year).

A language cookie set by the site so it opens in your language.

Your browser’s local storage keeps your sign-in session and the checkout details you entered, so they are pre-filled next time. This data stays on your device until you sign out or clear it.

Stripe and Cloudflare may set their own cookies on the payment form and bot-protection check for fraud prevention and security.

Security

All connections to our website, apps and servers are encrypted (HTTPS). Access to personal data is limited to what is needed to run the service.

Children

The service is not directed at anyone under 18 and we do not knowingly collect data from children.

Changes to this policy

We may update this policy. The date at the top of this page shows when it was last updated.

Contact

PINHAN GROUP LLC

501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA

[email protected]