Privacy Policy
Last updated: 4 October 2026
Data controller: Tiercel OÜ (registry code 17570109, address: Merivälja tee 1, Pirita linnaosa, 11911 Tallinn, Harju maakond, Estonia); destek@peregrinapp.com
Our iOS app is distributed on the App Store through Chai Ventures LLC (USA) and our Android app on Google Play through Upmotion OÜ (registry code 17071033); both are distribution vehicles only. The seller of the service and the data controller is Tiercel OÜ in every case.
Our principle: we collect no data the sale does not need. There is no sign-up form and no password; your account is your email address, opened with a one-time link or code. Ad measurement happens only within the limits described below.
Which data we process
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address | You, at checkout | Delivering the eSIM, order communication | Performance of the contract |
| Order details (plan, amount, date) | The purchase | Delivery, refunds, bookkeeping | Performance of the contract; legal obligation |
| eSIM technical details (ICCID, activation code) | Our eSIM provider | Getting your eSIM to you | Performance of the contract |
| Server logs (IP address, request time) | Automatic | Security, debugging | Legitimate interest |
| Push token | The mobile app, with your permission | "eSIM ready" and "data running low" notifications | Your consent |
| Trip reminder sign-up (email, departure date, destination) | You, on a landing page | The reminder emails you asked for | Your consent, withdrawable with the unsubscribe link in every email |
Your payment details (card number and so on) are never seen or stored by Peregrin; payments take place directly on Stripe's infrastructure.
Who we share data with
Only with processors the service cannot run without:
- Stripe (payment processing)
- Airalo (eSIM supply; the ordered plan is passed on)
- Supabase (data hosting; servers in the EU, Frankfurt)
- Vercel (site hosting)
- Postmark (transactional and reminder email)
- Expo (mobile push delivery; only the push token and the message text)
- Meta, Google and OpenAI (ad measurement only; scope described under "Cookies and ad measurement")
Your data is never sold or shared with third parties for their marketing.
Cookies and ad measurement
The site uses the cookies that are technically necessary for it to work.
To measure our advertising we use the Meta (Facebook) Pixel and Conversions API, the Google Ads tag and the OpenAI ads pixel. Events such as page views, reaching the checkout and purchases are sent to them. For purchases, your email address is shared only as an irreversible hash (SHA-256); alongside it, their cookie identifiers (ad click and browser ids), your IP address, browser details and the address of the page you paid on are sent. Each processes this data under its own policy: Meta, Google, OpenAI.
On the English and German pages and on our ad landing pages, none of these tags loads until you accept them in the cookie notice; if you decline, no measurement cookie is set and no purchase event is sent on your behalf. You can change your choice by clearing the pg_consent cookie. On the Turkish pages you can limit measurement with your browser's tracking protection or your ad settings at Meta and Google.
Retention
Order records are kept for as long as accounting law requires (seven years in Estonia); server logs are deleted automatically after a short time. Trip reminder sign-ups are kept until the departure date has passed or you unsubscribe.
Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You can switch notifications off at any time in your phone's settings or by logging out of the app. You can delete your account yourself with "Delete account" in the mobile app; order records are kept as accounting law requires but are permanently detached from your account. For anything else, write to destek@peregrinapp.com; we answer within 30 days at the latest.
You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority of your own country.