1. Who is the controller
WellMaxUSA LLC ("WellMaxUSA", "we") is the controller of personal data processed through WUSA Connect (connect.wellmaxusa.com). Registered address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Contact: privacy@wellmaxusa.com.
2. What we collect
- Order data: first name, last name, email, eSIM plan purchased, delivery confirmation, order timestamps.
- Payment metadata: Stripe session ID, last 4 digits and brand of card, billing country (we never see your full card number).
- Provisioning data: ICCID of your eSIM and activation status from our upstream Providers.
- Account data (optional): if you sign in via magic-link, the same email used for purchase plus your authenticated session token.
- Support data: messages you send to support@wellmaxusa.com, including any details you choose to share.
- Technical data: IP address, browser, language, country (from Cloudflare edge), device type, referrer URL, anonymized analytics events.
3. Why we use it (legal bases under GDPR)
- Performance of a contract: to provision, deliver, and support your eSIM.
- Legitimate interest: to prevent fraud, secure our service, and improve the platform.
- Consent: for marketing emails (only if you opt in) and non-essential cookies.
- Legal obligation: to comply with tax, accounting, and law-enforcement requests.
4. Who we share with
- Stripe Inc. — for payment processing (USD billing). stripe.com/privacy.
- eSIM Providers (eSIM Go and others) — to provision the eSIM (we share order ID and plan SKU; no card data).
- Resend Inc. — to deliver transactional emails (QR code, receipts).
- Cloudflare Inc. — to host, secure, and serve the site (edge logs include IP for fraud prevention, retained 7 days).
- Tax authorities, regulators, law enforcement — when legally required.
We do not sell your personal data and do not share it with advertising networks beyond the optional pixels you consent to.
5. International transfers
Our service runs on Cloudflare's global edge network, which may process your request in any region. For EU/UK users, transfers to the US (Stripe, Resend, WellMaxUSA) are protected by Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.
6. Retention
- Order and tax records: 10 years (US tax law requirement).
- Account data: until you delete your account or 3 years of inactivity.
- Edge logs (IPs): 7 days.
- Analytics events: 26 months max.
- Support tickets: 3 years.
7. Your rights
Depending on your residence, you may have rights to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (subject to legal retention requirements).
- Restrict or object to processing.
- Data portability.
- Withdraw consent (for marketing) at any time.
- Lodge a complaint with a supervisory authority (e.g. your national DPA in the EU/UK, ANPD in Brazil, your state AG in the US).
To exercise any right, email privacy@wellmaxusa.com. We respond within 30 days.
8. Cookies and tracking
See the Cookies Policy for full details. Essential cookies are always on; analytics and marketing pixels are only loaded if you consent.
9. Children
Our service is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact privacy@wellmaxusa.com.
10. Security
All traffic is encrypted in transit (TLS 1.2+). Data at rest in Cloudflare D1 is encrypted with industry-standard ciphers. Access to admin systems is protected by a master key and audited.
11. Changes
We may update this policy occasionally. We will publish the new version here with the updated "Last updated" date and, for material changes, a banner on the home page.
12. Contact
Privacy questions: privacy@wellmaxusa.com.