Privacy Policy
Version 2026-08-22.2 — effective 22 August 2026
1. Controller
Tayfun Gülcan, trading as Vryne.com, Franz-Liszt Str. 38, 38106 Braunschweig, Germany — email support@vryne.com. Full details are in the Legal Notice.
2. Our starting point: we keep almost nothing
vryne has no customer database. We do not store your order history on our own servers. Your order record lives with our payment provider Stripe, and your account page is rebuilt on demand by asking Stripe for the orders belonging to your email address. When you are not on the site, we are not holding a profile of you.
3. What we process, why, and on what legal basis
3.1 Visiting the website
When you load a page, our server processes your IP address, the time of the request, the page requested, the referrer and your browser’s user agent. This is technically unavoidable and is used to deliver the page and to detect abuse.
- Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in operating a secure, functioning website.
- Retention: short-lived server logs, deleted or anonymised within 7 days.
3.2 Buying an eSIM
At checkout we transmit the selected plan, the quantity and the price to Stripe. You enter your email address, your billing address and your payment details directly on Stripe’s page — card numbers never touch our servers. Together with the order we store, as proof of consent, the version of the Terms of Service and of the withdrawal declaration you accepted and the time you accepted them. Because we are the seller, the invoice is issued in our name and carries your billing address and, if you supplied one, your VAT identification number.
- Legal basis: Art. 6 (1) (b) GDPR — performance of the contract; Art. 6 (1) (c) GDPR — our legal obligation to be able to demonstrate the withdrawal declaration under § 356 (5) BGB and to retain invoices under § 14b UStG and § 147 AO.
- Retention: stored with Stripe for as long as our commercial and tax record-keeping obligations require (in Germany: 8 to 10 years).
3.3 Supplying the eSIM
To fulfil your order we send the plan identifier and quantity — not your name or email — to our eSIM supplier, which issues the profile. We then email you the QR code.
- Legal basis: Art. 6 (1) (b) GDPR.
3.4 The QR code download link
The QR code is delivered through a link that carries a signature and an expiry timestamp. The link stops working 72 hours after it is issued. This exists so that your eSIM profile cannot be retrieved by anyone who guesses an order reference.
- Legal basis: Art. 6 (1) (f) GDPR — securing the delivery of digital content.
3.5 Signing in to your account
Signing in uses a magic link: you enter your email address, we send you a link, and clicking it sets a session cookie. Both the link and the cookie are cryptographically signed values containing your email address and an expiry time — they are not stored in any database on our side. The magic link expires after 15 minutes.
- Legal basis: Art. 6 (1) (b) GDPR.
- Retention: the session cookie is strictly necessary for the sign-in function and requires no consent under § 25 (2) TDDDG. It expires by itself.
3.6 Transactional email
We send you a sign-in link and an order confirmation containing your order reference and QR code link. We do not send marketing email and there is no newsletter.
- Legal basis: Art. 6 (1) (b) GDPR.
3.7 Visitor statistics
We use Fathom Analytics to count page views and a small number of interactions (which plan length was picked, whether the checkout was reached, whether a purchase completed). Fathom is privacy-focused analytics: it sets no cookie, stores nothing on your device and reads nothing from it, it does not use advertising identifiers and it does not track you across other websites. To distinguish one visit from another it derives an irreversible hash from your IP address, your user agent and our site identifier, using a salt that is discarded and regenerated every day; the IP address itself is not stored. No profile of you is built and the data cannot be linked back to your order.
Because nothing is stored on or read from your terminal equipment, § 25 (1) TDDDG does not apply and no consent is required. The processing rests on:
- Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in knowing which pages are used and where the purchase process fails. Given that no identifiers are stored and no profile is created, we consider your interests not to be overridden.
- Objection: you can switch the statistics off at any time under Privacy Settings in the footer of every page. Your choice is remembered in the cookie described in 3.8.
- Retention: aggregated statistics only; no personal-level records are kept.
3.8 Remembering your privacy choice
If you use the Privacy Settings, we store a cookie vryne_consent containing nothing but the version of the settings and whether statistics are switched on. It expires after six months. This cookie exists solely to honour your decision and is strictly necessary within the meaning of § 25 (2) no. 2 TDDDG.
- Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 21 GDPR — giving effect to your objection.
4. Recipients and processors
| Recipient | Role | What they receive | Where |
|---|---|---|---|
| Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland (and Stripe, Inc., US) | Payment service provider — processor for the payment we instruct, and an independent controller for fraud prevention and its own legal duties | Your email address, billing address, payment details, purchased item, optional business name and VAT ID | EU / US |
| eSIM Go (upstream eSIM supplier) | Processor | Plan identifier and quantity only; no personal identifiers | EU / UK |
| Resend (transactional email) | Processor | Your email address and the contents of the message | EU / US |
| Conva Ventures Inc. (Fathom Analytics) | Processor | The request data described in 3.7; no cookies, no identifiers we could resolve to you | EU only — Germany and Finland |
| Railway Corporation (hosting) | Processor | Server log data as described in 3.1 | EU West (Amsterdam, NL) |
We have data processing agreements under Art. 28 GDPR in place with our processors. For the parts of the payment that Stripe carries out to meet its own obligations — fraud and money-laundering checks, card-scheme rules — Stripe acts on its own responsibility and under its own privacy notice.
5. International transfers
Where a recipient processes data outside the EU/EEA, the transfer is covered by an adequacy decision of the European Commission or by the European Commission’s Standard Contractual Clauses together with supplementary measures. You can request a copy of the safeguards at support@vryne.com.
Fathom Analytics is configured for Extreme EU Isolation: the script is served from, and all visitor data is processed on, servers in Germany and Finland, regardless of where the visitor is. No analytics data leaves the EU.
6. Cookies and similar technologies
We use no advertising cookies, no profiling and no third-party tracking. Our visitor statistics (see 3.7) are cookieless — they store nothing on your device at all.
The only cookies we set are strictly necessary within the meaning of § 25 (2) no. 2 TDDDG and therefore require no consent:
| Cookie | Purpose | Lifetime |
|---|---|---|
vryne_session | Keeps you signed in after you use a magic link or complete a payment | 30 days |
vryne_checkout | Ties a payment in progress to your browser, so that completing it can sign you in without a magic link | 2 hours |
vryne_consent | Remembers whether you have objected to the visitor statistics | 6 months |
You can review and change your choice at any time under Privacy Settings in the footer of every page.
Paying takes you to Stripe’s own payment page, on Stripe’s domain. Stripe sets cookies there for fraud prevention and to keep your payment session working. Those cookies are governed by Stripe’s own privacy notice and are outside our control — nothing is set on this website when you leave for it.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17), subject to statutory retention periods for invoices and tax records;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21) — for the visitor statistics you can do this yourself, immediately, under Privacy Settings in the footer.
To exercise any of these, email support@vryne.com. Because our records are keyed to your email address, a request sent from the address used at checkout is normally enough for us to identify you; if there is doubt, we may ask for further evidence. Note that invoices and payment records are subject to statutory retention periods and cannot be erased before those expire.
You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or place of work. The authority competent for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
8. Is providing data mandatory?
Providing an email address and payment details is necessary to conclude the purchase. Without them the contract cannot be performed. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.
9. Changes
We may update this policy as our processing changes. The current version is always the one published here; the version and date are shown at the top.
See also: Terms of Service · Right of Withdrawal · Legal Notice