1. Who We Are

Astralio Partners (“Astralio”, “we”, “us”, or “our”) operates the platform at partners.astralio.app — a wholesale eSIM storefront that allows businesses to provision global mobile connectivity for their travellers.

For questions about this policy, contact us at partners@astralio.app.

2. Information We Collect

2.1 Account & Organisation Data

• Full name and email address
• Organisation name, type, and logo
• Role within your organisation (owner, admin, member)
• Profile image (optional)

2.2 Authentication Data

• Hashed passwords (never stored in plain text)
• Passkey public keys and credential identifiers
• OAuth tokens when you sign in with a third-party provider
• Session tokens, IP address, and browser user-agent per active session

2.3 Billing & Payment Data

• Stripe customer and subscription identifiers
• Payment method details (handled directly by Stripe — we never see raw card numbers)
• Transaction history, payout records, and invoice data

2.4 eSIM Order & Usage Data

• eSIM orders placed, including product, quantity, and amount
• Traveller eSIM assignments made by your organisation
• Order status and provisioning logs

2.5 Technical & Analytics Data

• Anonymised page-view and interaction events (Vercel Analytics)
• Anonymised visit data via a self-hosted analytics script
• Browser type, operating system, and general location (country/region)

2.6 Support Communications

• Messages sent through the Crisp live-chat widget
• Emails sent to partners@astralio.app

3. How We Use Your Data

• To create and manage your account and organisation
• To process eSIM orders and provision connectivity
• To handle billing, invoicing, and payouts via Stripe
• To send transactional emails (order confirmations, invitations, eSIM delivery)
• To provide customer support via live chat and email
• To detect fraud and enforce our terms of service
• To improve the platform through aggregated, anonymised analytics
• To comply with applicable laws and regulations

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract performance — processing necessary to provide the service you signed up for
• Legitimate interests — analytics, fraud prevention, and platform security
• Legal obligation — retaining financial records as required by law
• Consent — where you have explicitly opted in (e.g. marketing communications)

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only with:

• Stripe — payment processing and billing
• Vercel — platform hosting and anonymised analytics
• Crisp — live-chat support
• eSIM providers — the minimum data required to provision eSIMs you order
• Law enforcement and legal obligations — only when required by a valid and binding legal process (such as a court order, subpoena, or statutory obligation), and only to the extent strictly necessary to comply.

All third-party processors are contractually required to process data only as instructed and to maintain appropriate security standards.

6. Data Retention

We retain account and order data for as long as your account is active and for up to 7 years afterward to satisfy tax and financial reporting obligations. Session data and verification tokens are deleted when they expire. You may request earlier deletion where permitted by law (see Section 8).

7. Cookies & Tracking

We use strictly necessary cookies to maintain your authenticated session. Vercel Analytics and our Simple Analytics scripts collect anonymised, aggregated traffic data and do not use cookies for cross-site tracking or fingerprinting.
When in use, the Crisp chat widget maintains functional cookies to persist your conversation with our team.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to certain processing
• Receive a portable copy of your data
• Withdraw consent at any time (where processing is consent-based)

To exercise any of these rights, email legal@partners.astralio.app. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures including TLS encryption in transit, hashed credential storage, passkey (WebAuthn) support, and access controls limiting data to authorised personnel. No transmission over the internet is completely secure; we cannot guarantee absolute security but commit to prompt notification in the event of a breach affecting your data.

We do not store absolute references to payment methods, only their identifiers in our payment providers. In case of any breach, payment details cannot be extracted from our platform

10. International Transfers

Your data may be processed in countries outside your own, including the United States, where our infrastructure providers operate. Transfers outside the EEA are governed by Standard Contractual Clauses or equivalent safeguards recognised under applicable data protection law.

11. Children

Astralio Partners is a business-to-business platform. We do not knowingly collect personal data from individuals under 16 years of age. If you believe a minor has provided us with personal data, contact us immediately.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect. Your continued use of the platform after the effective date constitutes acceptance of the revised policy.