Last updated: 2026-05-16
This document is provided in English. Translations may be available for convenience; in case of conflict, the English version is authoritative.
The Wanderer mobile application and related services (the "Service") are operated by Softr Solutions d.o.o., a company registered in Bosnia and Herzegovina with its registered office at Jadranska br. 13/17, 71000 Sarajevo, Bosnia and Herzegovina ("Wanderer", "we", "our", "us").
For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and equivalent national laws, Softr Solutions d.o.o. is the controller of the personal data we process about you. You can contact us about anything in this policy at support@wanderersim.com.
This Privacy Policy explains what personal data we collect about you when you use the Service, why we collect it, on what legal basis, with whom we share it, how long we keep it, and what rights you have. It applies to all use of the Service.
It does not cover personal data processed by third parties on their own account — for example, Paddle as merchant of record, your mobile network operator, or app-store providers — who act as separate controllers under their own privacy policies.
We collect only the data we need to operate the Service.
Account data. Email address, display name, language preference, hashed password, email-verification status, and admin flag (where applicable).
Authentication data. One-way BCrypt password hashes (we never store or have access to your plaintext password); short-lived JSON Web Tokens for session access; SHA-256 hashes of refresh tokens; one-time passcodes for email verification and password reset.
Purchase data. Order history including the Data Packages you purchase, prices, currency, timestamps, payment status, applied promotional codes, and Paddle transaction identifiers. Payment-card data is collected and processed exclusively by Paddle and is never stored on our systems.
eSIM data. The eSIM profiles associated with your account, their activation status, validity dates, and aggregated data-usage figures reported back to us by upstream operators.
Wallet data. Your store-credit balance and a ledger of credits, debits, expiries, and forfeitures.
Device and notification data. Platform (iOS or Android), push-notification tokens issued by Apple or Google for your device, and basic device metadata required for delivery of notifications.
Audit logs. Records of security- and finance-relevant account actions (purchases, eSIM lifecycle events, wallet transactions, authentication events), retained for fraud prevention, support, and legal compliance.
Product analytics. Anonymised behavioural events about how the app is used — for example, which countries are viewed, when checkout starts and completes, and when crashes occur — tied to a pseudonymous identifier linked to your account. We do not collect advertising identifiers and do not build cross-app or cross-site profiles.
Support correspondence. When you email us, we keep the email content, your email address, and any attachments necessary to respond.
Source of data. Most of the categories above are collected directly from you when you register, place an Order, or use the Service. eSIM usage figures and network-attachment information are received from the connectivity partners that provision and operate the underlying eSIM profiles on our behalf. Payment-method details are collected directly by Paddle, not by us. Device push-token data is generated by your operating system and provided to us via Apple Push Notification Service or Firebase Cloud Messaging.
We process your personal data only where we have a lawful basis under Article 6 GDPR (and equivalent national rules). The principal purposes and the lawful bases on which we rely are:
We share personal data only to the extent necessary to operate the Service. Each recipient processes data on our behalf under a written data-processing agreement, or as a separate controller under its own policy.
We do not sell your personal data. We do not share your personal data with advertisers, ad networks, or data brokers.
Some of the recipients listed above may process personal data outside the European Economic Area. Where this happens, we rely on appropriate safeguards under Chapter V of the GDPR — most commonly the European Commission's Standard Contractual Clauses, or an adequacy decision where one is in force. You can request a copy of the safeguards we rely on by emailing support@wanderersim.com.
We use product analytics to understand which features are used, where users encounter friction, and where the Service crashes, so we can improve it. The events are anonymised at source — personally identifiable values such as email address, phone number, payment-card data, eSIM identifiers, and authentication tokens are filtered before being sent.
The legal basis for product analytics is our legitimate interest in operating and improving the Service. You have the right to object to this processing at any time. To opt out, email support@wanderersim.com and we will disable analytics events for your account. We are working on a self-service opt-out toggle that will be available in the account settings; this Privacy Policy will be updated when it ships.
Transactional push notifications. We use push notifications to deliver Service-critical messages — for example, low-data alerts, eSIM expiry warnings, and order updates. These are processed under contract performance and as a legitimate interest in keeping you informed about the eSIMs you have purchased. You can turn off all push notifications in your device's operating-system settings at any time.
Marketing emails and push. We do not send marketing or promotional messages — whether by email or by push — without your separate, explicit opt-in. Where you have opted in:
The Service is a native mobile application and does not set cookies on your device for our own purposes. When you complete a payment, the Paddle checkout screen may use cookies and similar technologies under Paddle's own privacy policy. Our website (where applicable) may use a small number of strictly necessary cookies; we will publish a separate cookie notice if and when we introduce any non-essential web cookies.
We retain personal data only for as long as necessary for the purposes for which it was collected, plus any period required by law.
We implement technical and organisational measures designed to protect your personal data:
No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours and you without undue delay, as required by Articles 33–34 GDPR.
Subject to applicable conditions and exemptions, you have the following rights under the GDPR and equivalent laws:
Some of these rights are not absolute — for example, we may decline to delete data that we are required by law to retain.
Email support@wanderersim.com from the email address registered to your account. We will respond within thirty (30) days of receipt and, where strictly necessary because of the complexity or number of requests, may extend that period by a further two (2) months with notice to you.
We may ask you for information to verify your identity before acting on a request. We will not charge you a fee for exercising your rights unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.
You also have the right to lodge a complaint with the data-protection supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A list of supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
You can delete your account at any time from the Account section of the Service. Deletion is immediate and permanent for the data categories listed below — there is no grace period or recovery window. Please make sure you have used or transferred anything important before initiating deletion.
Deleted on account closure:
Retained after account closure (with personal identifiers minimised where possible):
Any remaining Wallet balance is forfeited on account closure and is not refundable as money.
The Service is not directed to children under the age of sixteen (16), and we do not knowingly collect personal data from children under sixteen. If we learn that we have collected personal data from a child under sixteen without verified parental consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact support@wanderersim.com.
We may update this Privacy Policy from time to time. When we make material changes — for example, to the categories of data we collect, the purposes of processing, or the recipients of data — we will notify you through the Service or by email, and update the "Last updated" date at the top of this document. Continued use of the Service after the change takes effect constitutes acceptance of the updated policy where consent is not required; where consent is required, we will obtain it before the change applies to you.
For any question, request, or complaint regarding this Privacy Policy or your personal data:
You also have the right to lodge a complaint with your local data-protection supervisory authority, as described in Section 13.