Wavynn Privacy Notice Who is responsible Lempart LLC, Sheridan, Wyoming, United States. Privacy contact: support@lempart.app. What we collect and why • Email address — to send your receipt and eSIM details and to answer support requests. On the website this is the only thing we ask you for: no name, no phone number, no address, no password, and no account is created. • Order details — the plan, price, payment status and the eSIM issued (activation code, ICCID) — to deliver and support what you bought and to keep accounting records. • Sign-in identity — only if you choose to sign in with Apple or Google: the identifier they give us and, if you share it, your name and email. Signing in is optional and nothing on the website requires it. We never see your Apple or Google password, and where you use Apple's Hide My Email we never learn your real address. • Support messages and, if you send them, your phone model and system version — to solve your problem. • Data usage of your eSIM, as reported by the network — shown to you in the app, and on the website against your order number. • Technical logs (IP address, app version, request times) — for security and to keep the service running. Kept briefly. • Website analytics — only if you press “Accept” in the website's cookie banner: through Google Analytics and Google Ads (conversion measurement), the pages you visit, the page that sent you, your browser and device type, an approximate location and, when you buy, the order reference, plan, price and currency (never your email address, name or card details) — to count visits and see which pages lead to purchases. The apps do not use analytics. We do not collect your card number (our payment provider handles it), your location, your contacts or the content of your communications. We do not sell personal data and we do not use it for advertising. Why we are allowed to hold it Each purpose above rests on one of three grounds. Performing our contract with you: your email address, your order and the eSIM we issue — without them there is nothing to deliver and nothing to support. A legal obligation: the order and payment records we have to keep for tax, and the records we keep to meet anti-fraud and sanctions rules. Our legitimate interests: keeping the service secure, stopping abuse and fraud, and seeing what breaks so we can fix it — a light touch, weighed against your privacy, and you can object to it at any time. We do not run the shop on consent, so there is nothing you have to agree to in order to buy; where we do ask for consent, you can take it back whenever you like. Website analytics is the one exception: it runs only on your consent, given in the cookie banner, and you can withdraw it at any time through “Cookie settings” on the website. Where your data is We are a United States company, and your data is stored and processed in the United States: our database sits in a United States region, and our hosting, email and payment providers are United States companies. If you live in the European Economic Area or the United Kingdom, that is a transfer out of your country. The safeguard we rely on for it is the European Commission's Standard Contractual Clauses, and for customers in the United Kingdom the UK International Data Transfer Addendum to them; each provider named below publishes those clauses as part of its data-processing terms, and we take them in the company's name. Write to support@lempart.app and we will tell you which clauses cover which provider. Who receives data • The wholesale connectivity partner that issues your eSIM: your order and the eSIM profile. They do not receive your name or email. • Our payment provider (Stripe): the payment and your email for the receipt. Stripe decides for itself how it handles payment data, so for that data it is an independent controller and not our processor; your card details never reach us. • Our hosting and database providers, which process data on our behalf under contract: Cloudflare for the website, the API, DNS and email routing, and Supabase for the database and file storage, in a United States region. • The transactional email provider we use to send order and support email: your email address and what the message says. It processes data on our behalf under contract. • Apple or Google, when you choose to sign in with them, or install our app through their services. • Google (Google LLC), only if you accept analytics on the website: the analytics data described above. Google processes it on our behalf under its data-processing terms, with Google signals and ad personalisation switched off. If you accept, Google Ads (Google LLC) also receives each purchase’s order reference, price and currency, to measure our ads; no advertising cookie is set. • Authorities, only where the law requires. How long we keep it Order and payment records: 7 years, for tax and dispute rules. Support messages: 2 years. Technical logs: up to 90 days. An account you delete is removed within 30 days, except the records above. Your rights You can ask to see, correct or delete your personal data, or to receive a copy, by writing to support@lempart.app. You can also ask us to restrict what we do with it — to hold it and stop using it — while a question about its accuracy or our grounds is being settled. Where we asked for your consent to something, you can withdraw that consent at any time; withdrawing it does not undo what we did lawfully before. We answer within 30 days. If you live in the European Economic Area or the United Kingdom you also have the right to object and to complain to your data-protection authority; if you live in California you have the rights of the CCPA, including to know and to delete, and we do not sell or share your data for cross-context advertising. Age The service is not offered to anyone under 18, and we do not knowingly collect data about children. Security Data travels encrypted (TLS) and is stored with access limited to the service itself. Sign-in uses Apple or Google, so we hold no passwords. Changes We will post updates here, on the website and in both apps; material changes are announced before they take effect. Effective: on publication.