We never ask for your CNIC, or for your wallet PIN or OTP, and we do not sell your data. Your WhatsApp number and email are used for your QR, messages about your order, signing in, and at most one feedback question about it. Everything else we collect has one clear job — and that job is written below.
On this page12
1. Who this policy covers
This policy covers the eJugaar website and any eSIM bought through it. “We” means eJugaar, and “you” means the person using the site or placing an order.
2. What we collect
- Email and WhatsApp number — to send you the QR. We ask for both for that reason alone: if one has a problem, the other works.
- Phone model — only to check whether the eSIM will work.
- Payment details — the screenshot of your transfer, which checkout asks for, and the transaction ID and sender’s name.
- eSIM usage — how much data was used and when activation happened. Our supplier reports this.
- IP and browser — with the order, to prevent fraud and in case of a dispute with the bank.
- Website analytics, when enabled — an anonymous browser identifier, public page paths, referring domain, browser/device information, page performance, checkout steps, support-link clicks and optional checklist feedback. Order events use an order reference and distinguish a new eSIM from a top-up. A support click or helpfulness response does not establish that a support case was resolved.
We do not ask for a CNIC, and a card number never reaches us.
3. Why we collect it
We use this information to deliver orders, keep payment records, provide support, prevent fraud and understand website performance and checkout completion.
4. How long we keep it
- Payment screenshots — 180 days. The image is deleted 180 days after the order is complete. Its hash and the reconciliation record stay, so the accounts hold up without us holding your bank screenshot.
- Order and payment records — for as long as legal and accounting requirements demand.
- The eSIM activation code — encrypted. It is a bearer credential: whoever has it can install the eSIM.
5. Who it is shared with
Each one receives only what it needs for its own job:
- The eSIM supplier — to create the profile. Your name and email do not go to them.
- Vercel and Supabase — the website and the database.
- Resend — to send email.
- Meta (WhatsApp) — to send the QR.
- Payment providers — to take payment and issue refunds.
- PostHog, when analytics is enabled — the limited website and order events described above. Our event payload excludes contact details, payment screenshots, QR/activation codes, full URLs and query strings. Session replay and automatic form capture are disabled.
We do not sell your data to anyone, and we do not give it to advertisers.
6. Where the data lives
The database is in the Mumbai region — the closest region to Pakistan our provider offers. Some service providers are outside Pakistan, so your data is also processed outside the country.
7. Security
The activation code is stored encrypted, and the QR is served only from the page behind your own login — no open link, no address anyone could guess. Every admin action is recorded, and that record cannot be erased.
8. Cookies and browser storage
This is everything the site keeps in your browser: what each item holds and how long it stays. None of it is used for advertising profiles.
Where a name has a *, that part varies, such as a project code.
Cookies
- ej_ref — A partner’s code, when you arrive through a partner’s link, so that partner is credited if you buy. Kept for 30 days.
- ej_og — Proof that this browser placed your order, so its order page can show your QR without a login. It holds your recent order numbers, signed so they cannot be changed, and is set when you place an order. Kept for 14 days.
- sb-*-auth-token* — Your sign-in to My eSIMs or to the partner console, set when you sign in. Kept until you sign out or the sign-in expires.
- ph_*_posthog — PostHog’s anonymous analytics ID: a random identifier for this browser, while optional analytics is on. Kept for a year.
Local storage
Kept until you clear this site’s data.
- ph_*_posthog — PostHog’s copy of the same anonymous ID, with its settings.
- ej_analytics_disabled — Written when you turn off optional browser analytics below, so this browser stays off.
- theme — Your light or dark choice, if you change it in the partner console.
Session storage
Cleared when you close the tab.
- ej_device_selection_v1 — The phone you picked in the phone checker, so checkout can show it.
- ej_eid_checked_v1 — The phones whose EID check (dialling *#06#) you have opened, for a phone whose eSIM depends on the model, so the home page’s buy button stops asking you to check first. It holds each phone’s brand and model, nothing more.
- ej_buybar_dismissed — That you closed the buy bar, so it stays closed.
- ej-headline-paused — That you paused the moving headline, so it stays paused.
- ej-motion-slow — That scrolling the home page was slow on this device, so its motion stays light for the rest of the visit.
- ej_wa_halo — That the ring around the WhatsApp button has played, so it plays once a visit.
- ph_* — PostHog’s notes about this tab and this visit, while optional analytics is on.
IndexedDB
- ejugaar-offline — An encrypted copy of your own eSIMs (plan, data left, expiry and the code for installing by hand, never the QR image), written while My eSIMs is open so it can still be shown without a connection. Deleted when you sign out.
Cache storage
- ejugaar-v* — Copies of pages and images you open, kept by the site’s service worker so they can open without a connection. Checkout, order, sign-in, top-up and My eSIMs pages are never kept. Replaced when the site updates, or cleared with this site’s data.
Until October 2026 the site also set ej_vid, a random visitor ID that nothing read. It is no longer set, and a browser that still has it loses it on its next visit.
The control below stops future optional browser analytics on this browser; server-side order records and fulfilment events are separate. Contact us about access or deletion of existing data.
This applies to this browser; order records are unaffected.
9. Your rights
Ask, and we will: show you your data, correct what is wrong, or delete it — except the records we are legally required to keep, such as the payment ledger.
Pakistan has not yet enacted a comprehensive data protection law. We are giving you these rights without waiting for it, because retrofitting them later would be more painful for both of us.
10. Marketing
Messages about your order — the QR, a notice that your data is running out, an expiry warning — are part of the service and will keep coming.
Marketing is a separate thing and asks for separate permission. There is no pre-ticked box for it at checkout, and there will not be.
11. Contact
The most direct route is email — hello@ejugaar.com — or on WhatsApp at +923712044479. We answer every day from 10 am to 10 pm. Include your order number — it does half the work.
12. Language
This policy exists in several languages. Where the translations differ, the English text applies. The terms of service are in the terms & conditions, and the rules for getting money back in the refund policy.
