Privacy Policy

Last updated: November 12, 2026

1. Introduction

Vanguard AI Pte. Ltd. ("Vanguard", "we", "us", or "our") operates the Steady eSIMâ„¢ service at SteadyeSIM.com. We handle personal data in line with the Personal Data Protection Act 2012 of Singapore ("PDPA"), the Personal Data Protection Act 2010 of Malaysia ("Malaysia PDPA") for customers in Malaysia, and the EU General Data Protection Regulation ("GDPR") for visitors in the European Union and European Economic Area ("EU/EEA").

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. By using our Services you consent to the practices described in this policy.

2. Data We Collect

We collect the following categories of personal data when you use our Services:

2.1 Information You Provide Directly

  • Email address provided at checkout for eSIM QR code delivery and order confirmation.
  • Name and billing address where required by our payment processor for transaction processing.
  • Payment information including card details or PayNow reference, processed and held securely by Stripe. Vanguard does not store raw card data at any point.
  • Communications you send to us via email or our support channels.

2.2 Information Collected Automatically

  • Device information including device type, operating system, and eSIM compatibility data where relevant to service delivery.
  • Browser type, IP address, and general geographic location derived from IP.
  • Usage data including pages visited, time spent on site, and actions taken during the checkout flow.
  • Cookie and tracking data as described in Section 7 of this policy.
  • Which ad, partner link or campaign brought you to our site (for example an ad click identifier or campaign tags in the link), the page you landed on and the website that referred you, as described in Section 7.

3. How We Use Your Data

We use your personal data for the following purposes. Each purpose shows why we may use your data, which is also our legal basis where the GDPR applies:

  • Delivering your eSIM QR code and order confirmation to your email address — necessary for the performance of your purchase contract.
  • Processing payments securely via Stripe — necessary for the performance of your purchase contract.
  • Sending transactional communications including receipts, order confirmations, and support responses — necessary for the performance of your purchase contract.
  • Detecting and preventing fraud, abuse, and unauthorised access — necessary for our legitimate business interests and legal obligations.
  • Analysing how our website is used, in our own records, to improve our website and Services — necessary for our legitimate business interests.
  • Complying with applicable legal and regulatory obligations — necessary for compliance with applicable law.
  • Measuring which of our ads and partner links lead to visits and purchases, using tools from Google and Reddit (and Awin, where we use its affiliate programme) that run on our website, including by sending Google an encoded copy of your email address when you buy — only with your consent, given by choosing "Accept all" in our cookie banner. You can withdraw it at any time (see Section 7).
  • Where we run an affiliate programme through Awin, reporting each sale to Awin so that partners who sent customers to us can be paid commission — necessary for our legitimate business interests (see Section 6).

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Marketing Communications

We do not send marketing emails without your explicit consent. If you opt in to marketing communications at any point, you may withdraw that consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly at support@steadyesim.com.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

  • Order and transaction records including email address and purchase details are retained for seven years from the date of transaction in accordance with Singapore's accounting and tax obligations.
  • Support communications are retained for two years from the date of the last communication.
  • Our own records of how our website is used are deleted after 26 months. Google Analytics keeps user-level and event-level data for the period set in our Google Analytics account, which is at most 14 months.
  • Cookie data is retained in accordance with the individual cookie lifespans set out in Section 7.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

6. Sharing Your Data

We do not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances:

  • Stripe — our payment processor — receives your email address, billing and payment details to process your payment, together with details we attach to the payment, such as your order number and which ad or link brought you to us. Stripe's privacy policy is available at stripe.com/privacy.
  • Our eSIM supplier receives an order reference and the plan you bought so it can issue your eSIM, and later your eSIM's identifier (ICCID) to check data usage or add a top-up. We do not send it your name or email address.
  • Our VPN provider — if you buy a Steady VPN pass, it creates your VPN account under a username we generate (not your email address), and your VPN connection runs through its servers.
  • Supabase stores our database and runs account sign-in, and Vercel hosts our website and servers. They process the personal data described in this policy on our behalf.
  • Postmark sends our emails (such as order confirmations with your eSIM QR code, receipts and reminders), so it receives your email address and the content of those emails.
  • Freshdesk runs our help desk: when you contact support, your name, email address and messages are kept there. To answer faster, we send the subject and text of your support messages, with your name, to Anthropic's Claude AI model, which sorts the request and drafts an automatic first reply.
  • Trustpilot — after an order we may ask Trustpilot to email you an invitation to review us, and give it your name, email address and order number for this. We do not do this if you have withdrawn your consent to marketing emails.
  • Sentry receives error reports when something goes wrong on our website or servers. A report can include technical details of your browser and device, the page you were on and, for some errors in the browser, a recording of the page with all text masked and images blocked.
  • Google (Google Analytics, Google Ads and Google Tag Manager) — only if you choose "Accept all" in our cookie banner. Google's tags then run in your browser and receive your IP address, browser and device details, the full address of each page you view, the plans you look at, the ad you clicked to reach us, if any (Google's ad click identifiers gclid, gbraid or wbraid), and, when you buy, your order number, the plan and the amount. Our server also sends Google Analytics details of your checkout and purchase: your order number, the plan, the amount, those ad click identifiers, the Google Analytics identifiers for your browser and visit, and your Steady account ID (a random identifier, not your name or email address). To check whether a purchase came from one of our Google ads, we also send Google an encoded copy of the email address you bought with (scrambled with SHA-256 before it leaves our systems, so we never send it in readable form). Google matches it to Google accounts that saw or clicked our ads and gives us only totals. If you choose "Necessary only", or make no choice, none of this is sent to Google.
  • Reddit (Reddit pixel) — only if you choose "Accept all". The pixel then runs in your browser and receives your IP address, browser details, the address of each page you view, the plans you look at and, when you buy, your order number, the plan and the amount. If you create a Steady account while it is running, we also give it a hashed (SHA-256) form of your email address, never the address itself, and your Steady account ID, so Reddit can match the sign-up to a Reddit account that saw or clicked our ads. We use this to measure our Reddit ads.
  • TikTok (TikTok pixel) — only if you choose "Accept all". The pixel then runs in your browser and receives your IP address, browser details, the address of each page you view, the plans you look at, when you start a checkout and, when you buy, your order number, the plan and the amount. When you buy, we also give it a hashed (SHA-256) form of your email address, never the address itself, so TikTok can match the purchase to a TikTok account that saw or clicked our ads. We use this to measure our TikTok ads.
  • Awin (affiliate network), where we use its affiliate programme — if you choose "Accept all", Awin's tag runs in your browser and receives your IP address, browser details and the pages you view. Separately, whatever you choose in the banner, when you pay for an order our server reports the sale to Awin so that partners who sent customers to us can be paid commission: we send the order number, the amount (excluding tax), the currency, any discount code used and, if you reached us through an Awin partner's link, Awin's reference for that click. We do not send Awin your name or email address.
  • Legal and regulatory authorities — we may disclose personal data where required to do so by law, court order, or at the request of a competent regulatory authority in Singapore.

All third-party service providers are contractually required to process your data only for the purposes for which it was shared and to maintain appropriate security standards.

Some of these providers are based outside Singapore and Malaysia (for example, Google, Reddit, Stripe and Anthropic are based in the United States, and TikTok processes data in several countries), so your personal data may be transferred to and processed in other countries, including the United States. When we transfer personal data outside Singapore, Malaysia or the EU/EEA, we do so as the law that applies to you requires, relying on our providers' contractual commitments to protect it.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on SteadyeSIM.com for the following purposes:

  • Necessary cookies keep the website, sign-in and checkout working, and remember your cookie banner choice for one year. They are always on.
  • Analytics cookies — only if you choose "Accept all". Google Analytics sets its own cookies to recognise your browser and your visits. This data is not anonymous: it is linked to identifiers for your browser and, for checkouts and purchases, to your Steady account ID.
  • Advertising tools — only if you choose "Accept all". Google Ads (through Google Tag Manager), the Reddit pixel, the TikTok pixel and, where we use it, Awin's tag measure which ads and partner links lead to visits and purchases, and may set their own cookies. If you accept, we also send Google and TikTok an encoded copy of your email address when you buy, as described in Section 6.
  • Our own record of how you reached us — whatever you choose in the banner. When you arrive from an ad or a link with campaign tags, we save in our own cookies which ad or link it was (for example Google's gclid, gbraid or wbraid, Reddit's click ID, Awin's click reference, and the campaign tags), the page you landed on and the website that referred you. These cookies last 90 days (30 days for Awin's click reference), are read only by our own servers and are stored with your order. We pass Google's click identifiers to Google only if you choose "Accept all"; Awin's click reference is sent to Awin with the sale, as described in Section 6.

Nothing in the analytics and advertising categories above loads until you choose "Accept all". You can change your choice at any time with "Cookie settings" at the bottom of our website's pages. If you switch to "Necessary only", the page reloads so those tools stop straight away; cookies they have already set stay in your browser until they expire or you clear them. Choosing "Necessary only" does not affect checkout.

8. Data Security

Vanguard implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include industry-standard TLS encryption for all data in transit, secure third-party payment processing via Stripe, and restricted internal access to personal data on a need-to-know basis.

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

9. Your Rights

Under the PDPA, the Malaysia PDPA and, if you are in the EU/EEA, the GDPR, you have the following rights:

  • The right to access personal data we hold about you.
  • The right to correct any inaccurate or incomplete personal data we hold about you.
  • The right to withdraw consent to the collection, use, or disclosure of your personal data, subject to legal or contractual restrictions.
  • The right to request the deletion of personal data we hold about you, subject to our legal retention obligations.
  • If you are in Malaysia: the right to ask us to stop processing your personal data in a way that is likely to cause you substantial damage or distress, and to stop using it for direct marketing.
  • If you are in the EU/EEA: the rights to restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw your consent at any time without affecting processing that took place before you withdrew it.

To exercise any of these rights, please contact us at support@steadyesim.com. We will respond within the time the law that applies to you allows: 21 days for access and correction requests under the Malaysia PDPA, one month under the GDPR, and otherwise within 30 days.

If you are unsatisfied with our response, you may complain to the data protection authority where you live: in Malaysia, the Personal Data Protection Commissioner; in the EU/EEA, your local data protection supervisory authority; in Singapore, the Personal Data Protection Commission at pdpc.gov.sg.

10. Children's Privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at support@steadyesim.com and we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on SteadyeSIM.com with a revised "Last updated" date. Your continued use of the Services after any update constitutes your acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Vanguard AI Pte. Ltd.

Email: support@steadyesim.com

For complaints that cannot be resolved directly with us, you may contact the data protection authority where you live: in Malaysia, the Personal Data Protection Commissioner; in the EU/EEA, your local data protection supervisory authority; in Singapore, the Personal Data Protection Commission at pdpc.gov.sg.