Privacy Policy

1. Who we are

Avena is a travel eSIM service operated by LamaTech, LLC, a Delaware limited liability company (Delaware file number 10518240), trading as “Avena” (“Avena”, “we”, “us”, “our”). This policy applies to the website getavena.app, the Avena apps for iOS and Android, and the services we provide through them (together, the “Services”).

2. Data controller

LamaTech, LLC is the data controller for the personal data processed through the Services. You can reach us at [email protected] or by post at 1111B S Governors Ave #82096, Dover, DE 19904, United States. We have not appointed a separate data protection officer; privacy questions go to the same email address.

3. How we collect personal data

• Directly from you, when you create an account, buy a plan, add credit or contact us.
• Automatically from your device, when you use the app or the website.
• From third parties, such as Apple or Google when you sign in with them, our payment provider Stripe, and our connectivity partners when your eSIM is installed or used.

4. Personal data we collect

4.1 Data you give us

• Identity and contact data: your email address and, if you provide it, your name.
• Purchase data: the plans you buy, order numbers, amounts, dates, payment status, Avena credit top-ups and how credit was used, coupons and referral rewards.
• Payment data: payments are handled by Stripe. We never see or store your full card number. Stripe shares with us the card brand, the last four digits and the expiry date so you can recognise your saved cards.
• Support data: messages and attachments you send us by email or WhatsApp.
• Sign-in data: if you sign in with Apple or Google, they share your email address and, if you allow it, your name. With Apple’s Hide My Email we receive a relay address.
• Newsletter data: your email address, if you subscribe on our website.

4.2 Data collected automatically

• Device data: an app-specific device identifier (identifierForVendor on iOS, Android ID on Android) and the device model. We use them to keep your eSIM linked to one device.
• App settings: app language, notification preferences and your push token.
• eSIM and usage data: the ICCID of your eSIM, the EID of the chip it was installed on (reported by our eSIM provider), install status, and how much data each plan has used.
• Technical data: IP address and request logs processed by our servers and hosting providers for security and to keep the Services running.
• Crash reports: technical details about app errors (Sentry). Personal data is not sent with crash reports by default.
• Product analytics: how the app is used, for example which screens are opened (PostHog). This is linked to your account and you can turn it off in the app under Profile › Privacy settings.

4.3 Data from third parties

• Basic profile data from Apple or Google when you sign in with them.
• Payment results and fraud signals from Stripe.
• eSIM install, status and data usage events from our connectivity partners.

4.4 Data we do not collect

We do not collect your location, contacts, photos, microphone audio, call or SMS data, or advertising identifiers (IDFA or Google advertising ID). We do not ask for special categories of data such as health, race, religion, political opinions or sexual orientation. The Services are not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, contact us and we will delete the account and its data.

5. How we use personal data

To provide the Services

• Create and manage your account and sign you in.
• Process purchases, top-ups, refunds and coupons, and keep your credit balance.
• Provision your eSIM, deliver plans to it, show install status and remaining data.
• Send service messages: login codes, order confirmations, setup guides, low-data and expiry alerts.

To support and improve the Services

• Answer support requests and investigate problems.
• Find and fix bugs and crashes, and understand which features are used.
• Detect and prevent fraud, abuse and unauthorised use.

To communicate with you

• Promotional push notifications and emails, only if you opted in. You can turn them off at any time in the app or with the unsubscribe link.

To understand our business

• Analyse demand by destination and plan type using aggregated data.

To meet legal obligations

• Keep tax and accounting records, respond to lawful requests and enforce our terms.

6. Legal bases for processing

Where data protection laws such as the GDPR apply, we rely on:

• Contract: to create your account, sell and deliver plans, take payments and provide support.
• Legitimate interests: to keep the Services secure, prevent fraud, fix errors and improve the app, where these interests are not overridden by your rights.
• Consent: for product analytics and promotional messages. You can withdraw it at any time.
• Legal obligation: to keep financial records and respond to lawful requests.

7. Who we share personal data with

We share personal data only as needed to run the Services, with:

• Stripe, to process payments and store saved cards.
• Telco Vision and our eSIM provider partners, to issue eSIM profiles and deliver data. They receive eSIM identifiers and usage data, not your name or payment details.
• Resend, to send emails.
• Apple, Google and Expo push services, to deliver notifications.
• Sentry, for crash reports, and PostHog, for product analytics.
• Railway and Cloudflare, to host and protect our servers and website.
• Apple and Google, when you use them to sign in.
• WhatsApp, if you choose to contact support there.
• Authorities or other parties when the law requires it, to protect our rights or users, or as part of a merger or sale of the business under the same privacy commitments.

These providers act as our processors under contract, or as independent controllers for their own services (for example Apple, Google and Stripe). We do not sell your personal data.

8. Cookies

Our website does not use advertising or analytics cookies. The app does not use cookies; it stores your login session and preferences securely on your device. Details are in our Cookie Policy.

9. Advertisements

Avena does not show ads, does not use advertising identifiers and does not track you across apps or websites owned by other companies.

10. Security

Data is encrypted in transit with HTTPS, payment data stays with Stripe, and access to our systems is restricted to people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable technical and organisational measures and will meet the security obligations the law places on us.

11. How long we keep data

• Account and profile data: while your account exists. Deleted when you delete the account.
• Device and eSIM links, push tokens and notification data: deleted with the account.
• Order, payment and credit records: kept for tax and accounting, typically up to 10 years. When you delete your account they are anonymised so they no longer identify you.
• Server and security logs: up to 90 days.
• Support messages: up to 2 years.
• Crash reports and analytics: as long as needed for that purpose, then deleted or anonymised.

12. International transfers

LamaTech, LLC is based in the United States and our providers process data in the United States and the European Union. When data leaves the EEA or the UK, we use safeguards recognised by law, such as adequacy decisions or the European Commission’s Standard Contractual Clauses.

13. Your rights

Depending on where you live, you can:

• Ask whether we process your data and get a copy of it.
• Know why we process it and who we share it with.
• Correct inaccurate or incomplete data.
• Delete your data. You can delete your account yourself, see below.
• Receive your data in a portable format.
• Object to or restrict certain processing, and withdraw consent.
• Not be subject to decisions based solely on automated processing.
• Complain to a data protection authority.

To delete your account, use Profile › Danger zone › Delete account in the app, or our account deletion page. For any other request, email [email protected]. We may ask you to confirm your identity and we reply within 30 days.

California residents (CCPA/CPRA)

• We do not sell or share personal information, and have not done so in the last 12 months.
• We do not use sensitive personal information to infer characteristics about you.
• You have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive information, and not be discriminated against for using these rights.

EEA and UK residents (GDPR and UK GDPR)

• The legal bases we rely on are listed in section 6.
• Your eSIM connects through local carriers, so connectivity data is handled by networks in the countries you travel to.
• Transfers outside the EEA and UK follow section 12.
• You can complain to your local supervisory authority.
• We do not make decisions with legal or similarly significant effects by automated means alone.

Requests from authorities

We disclose personal data to authorities only when it is required by a binding legal obligation or valid legal process and is proportionate to the request. We push back on requests that are too broad.

Data minimisation and breach notification

We review the data we hold and delete or anonymise what we no longer need. If a data breach is likely to put your rights at risk, we notify the competent authority within the legal deadline and tell you without undue delay, unless the law says otherwise.

14. Changes to this policy

We may update this policy. The new version is published here with a new date. If a change is material, we tell you in the app or by email before it takes effect and ask for your consent where the law requires it.

Contact

LamaTech, LLC, 1111B S Governors Ave #82096, Dover, DE 19904, United States
Email: [email protected]