Privacy Policy
Last updated: 2026-10-29
The controller of your personal data is Albert Sabaté Martínez, trading as Brisily ("Brisily", "we"), NIF 47986151D, with address at Carrer Gretel Ammann Martínez, 12, 6º 10ª, 08020 Barcelona, Spain. This policy explains how we process your data under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) when you use brisily.com, a partner storefront we power, or buy an eSIM from us. Privacy contact: privacy@brisily.com.
1. Data we process
- Order data: name, email address, phone number, destination, plan, order history.
- Payment data: processed by Stripe; we receive payment status, a payment reference and the billing country and postal code Stripe collects, never your full card number. We keep them with the order. For purchases above €400, Stripe also gives us your billing name and address, which we keep for the invoice. If a purchase needs a full invoice and we have no address, we ask you, or the agency you bought from, for it.
- eSIM/technical fulfillment data: ICCID, activation status and data-usage totals from our connectivity provider.
- Attribution data: which partner referred you, through its storefront or its referral link (a first-party cookie, see the Cookie Policy).
- Support communications you send us.
- Website analytics (Google Analytics 4): with your consent, using analytics cookies; without it, Google Analytics sets no cookies and receives only cookieless measurement signals (Google Consent Mode).
- Purchase measurement: when you pay, we report the purchase to Google Analytics and to our advertising platforms (Google Ads, Meta): an internal order reference, the amount, currency and plan, the IP address and browser used at checkout, and the ad click identifier if you came from an ad. Your Google Analytics identifier is added only if you accepted analytics cookies; your email address, phone number and customer number, in hashed form, only if you accepted advertising cookies. Your name is never sent.
- Error and performance diagnostics (Sentry) — technical logs that may include IP address and device metadata.
2. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Selling and delivering your eSIM, sending order emails | Contract (Art. 6(1)(b)) |
| Payment processing and fraud prevention | Contract + legitimate interest (Art. 6(1)(b), (f)) |
| Attributing sales to the partner that referred you | Legitimate interest (Art. 6(1)(f)) |
| Customer support and order recovery | Contract (Art. 6(1)(b)) |
| Tax, accounting and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Analytics | Consent (Art. 6(1)(a)); withdraw anytime via Cookie preferences |
| Measuring completed purchases and the ads that led to them (Google Analytics, Google Ads, Meta) | Legitimate interest (Art. 6(1)(f)); hashed contact details only with your consent (Art. 6(1)(a)) |
| Service security, error monitoring | Legitimate interest (Art. 6(1)(f)) |
3. Processors and recipients
We share data only with providers needed to run the service, under data-processing agreements:
- Stripe (payments)
- Airalo (eSIM provisioning — receives the technical order, not your name)
- Resend (transactional email delivery)
- Cloudflare (hosting/CDN; Workers VPC connectivity to our database host)
- OVHcloud (France) — hosting of our self-hosted PostgreSQL database
- Sentry (error monitoring, EU region), Google (analytics with your consent; purchase and ad measurement, see section 1), Meta (ad measurement, see section 1)
- The travel-agency partner whose storefront you bought through (order status for customer care; they never receive your payment details).
4. International transfers
Some providers process data outside the EEA (e.g. USA). Such transfers rely on European Commission adequacy decisions (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.
5. Retention
- Order and accounting records: 6 years (art. 30 of the Spanish Commercial Code) and any longer period tax law requires.
- Support emails: up to 2 years after the case closes.
- Analytics: per Google Analytics retention settings (14 months).
- IP address, browser, ad click identifiers and campaign tags recorded at checkout: kept with the order record.
- Attribution cookies: 90 days.
6. Your rights
You have the rights of access, rectification, erasure, restriction, portability, and objection (Arts. 15–21 GDPR), and to withdraw consent at any time without affecting prior processing. To exercise them, write to privacy@brisily.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, https://www.aepd.es) or with the supervisory authority of the EEA country where you live.
7. Children
Our services are not directed at children under 16 and we do not knowingly process their data.
8. Changes
We will post any changes to this policy here with a new "last updated" date.