privacy
policy.

Cielo Cell AB (org. no. 559579-6912), Målarevägen 24, 227 30 Lund, Sweden, is the data controller responsible for your personal data when you use CieloCell. CieloCell is a travel eSIM and mobile data application. We collect and use personal data only as necessary to provide the Service, comply with legal obligations, and improve the app experience. We do not sell your personal data. Questions? Contact us at hello@cielocell.com.

ACCOUNT DATA — When you register: your name, email address, and credentials (or tokens from Apple/Google sign-in). DEVICE AND TECHNICAL DATA — Device model, OS version, app version, eSIM EID, IP address, and connection type. eSIM AND USAGE DATA — eSIM activation status, data plan details (plan type, country, start and expiry dates), and data consumption records from our network partners. PAYMENT AND TRANSACTION DATA — Purchase history (plan type, amount, currency, date, transaction ID). Full card details are held by payment processors only — CieloCell never stores raw card numbers. SUPPORT DATA — Content of messages and attachments you send us when you contact support. WEBSITE DATA — Standard server log data (IP address, browser type, pages viewed) when you visit cielocell.com. LOCATION DATA — Approximate location only — the country determined from your IP address or SIM registration — to determine available data plans. We do not collect precise GPS location.

Provide and manage your account and eSIM service → Contract performance (Art. 6(1)(b)) Process payments and issue refunds → Contract performance / Legal obligation (Art. 6(1)(b)(c)) Activate eSIM profiles and provision data plans → Contract performance (Art. 6(1)(b)) Provide customer support → Contract performance / Legitimate interest (Art. 6(1)(b)(f)) Detect and prevent fraud and abuse → Legitimate interest / Legal obligation (Art. 6(1)(f)(c)) Improve app performance and fix bugs → Legitimate interest, using anonymised/aggregated data (Art. 6(1)(f)) Send service communications (activation confirmations, expiry alerts) → Contract performance (Art. 6(1)(b)) Send optional marketing communications → Consent, opt-in only (Art. 6(1)(a)) Comply with legal obligations → Legal obligation (Art. 6(1)(c))

TELECOM AND eSIM PARTNERS — Your device EID and plan details are shared with our licensed MVNO partner in the country where you activate a plan, to provision your eSIM and deliver mobile data. PAYMENT PROCESSORS — Apple processes App Store purchases. Google processes Google Play purchases. Stripe processes direct purchases. Each handles payment data under their own security standards. AUTHENTICATION PROVIDERS — If you sign in with Apple or Google, we receive only your name and email from that service. CLOUD INFRASTRUCTURE — We host the CieloCell platform on cloud providers (such as AWS or Google Cloud) under binding data processing agreements. ANALYTICS AND CRASH REPORTING — We use analytics and crash-reporting tools to monitor performance and fix issues. Data is pseudonymised or aggregated where possible. CUSTOMER SUPPORT TOOLS — We use a support platform to manage inquiries. Staff access only data needed to resolve your issue. LEGAL AND COMPLIANCE — We may disclose data to law enforcement, courts, or regulators when required by law. We disclose only the minimum data necessary. BUSINESS TRANSFERS — In a merger, acquisition, or asset sale, your data may transfer to the successor entity with prior notice and equivalent data protection standards.

Cielo Cell AB is based in Sweden (EU). Some service providers operate outside the EU/EEA. We ensure appropriate safeguards are in place: • EU Standard Contractual Clauses (SCCs) — European Commission Decision 2021/914 • UK International Data Transfer Agreements (IDTAs) where applicable • Transfers to countries with an EU adequacy decision Request a copy of applicable safeguards: hello@cielocell.com

Account data → Account duration + 7 years after closure → Legal/tax obligation Transaction records → 7 years → Swedish Bookkeeping Act (BFL) eSIM and usage data → 12 months from date of use → Contract/legal obligation Support communications → 3 years from last interaction → Legitimate interest Crash and analytics data → Indefinite in anonymised form → Legitimate interest Marketing consent records → Until withdrawal + 3 years → Compliance After the applicable period, data is securely deleted or irreversibly anonymised.

You can delete your account and request erasure of your personal data at any time: • In the app: Profile → Settings → Delete Account • By email: hello@cielocell.com with subject "Delete my account" We will process your deletion request within 30 days. Some data (such as transaction records) may be retained for the period required by law. You will receive confirmation when deletion is complete. Account deletion is permanent. Any active data plans or credits are forfeited and are non-refundable.

Under the GDPR and equivalent laws, you have the following rights. Contact hello@cielocell.com — we respond within 30 days. Access (Art. 15): Request a copy of your personal data. Rectification (Art. 16): Request correction of inaccurate data. Erasure (Art. 17): Request deletion of your personal data. Restriction (Art. 18): Request restriction of processing in certain circumstances. Portability (Art. 20): Receive your data in a machine-readable format. Object (Art. 21): Object to processing based on legitimate interests, including marketing. Withdraw Consent (Art. 7): Withdraw consent at any time. Complain: Contact the Swedish DPA (IMY) at imy.se, or your local supervisory authority. To unsubscribe from marketing, click "Unsubscribe" in any email or contact hello@cielocell.com.

If you are a California resident, the CCPA/CPRA gives you additional rights. WHAT WE COLLECT (preceding 12 months): • Identifiers: name, email, IP address, device ID • Commercial information: purchase history, plan activations • Internet/electronic activity: app usage, session data • Geolocation: country-level only • Inferences: derived from usage for fraud prevention and service improvement WE DO NOT SELL OR SHARE YOUR PERSONAL INFORMATION for cross-context behavioural advertising. YOUR CALIFORNIA RIGHTS: • Right to Know: categories and pieces of personal information collected • Right to Delete: request deletion, subject to legal exceptions • Right to Correct: request correction of inaccurate data • Right to Non-Discrimination: we will not discriminate for exercising CCPA rights Submit requests to hello@cielocell.com from your registered email. We respond within 45 days. Residents of other US states (Virginia, Colorado, Connecticut, Texas, etc.) with comprehensive privacy laws may have similar rights — contact hello@cielocell.com.

CieloCell is not directed to children under 13 (or 16 in the EU/EEA). We do not knowingly collect data from children. If you believe we have, contact hello@cielocell.com and we will delete it promptly. Users must be at least 18 to register.

The CieloCell website uses cookies for: • Strictly necessary functions (required, cannot be disabled) • Analytics: aggregate, anonymised data about site usage (you can opt out via browser settings) The CieloCell mobile app does not use tracking cookies. App analytics use pseudonymised or aggregated data only. Where required by law, we obtain consent before placing non-essential cookies.

We implement industry-standard security measures: • Encryption in transit (TLS 1.2+) and at rest (AES-256) • Role-based access controls and least-privilege principles • Regular security assessments • Incident response with regulator notification within 72 hours of a confirmed breach (GDPR Art. 33) • Payment data handled exclusively by PCI DSS-certified processors To report a security vulnerability: hello@cielocell.com

DATA COLLECTED AND LINKED TO YOU: • Contact info (name, email) • Identifiers (device ID) • Purchases (transaction history) • Usage data (app interactions, eSIM activation status) DATA COLLECTED BUT NOT LINKED TO YOU: • Crash data (anonymised) • Performance diagnostics (aggregated) DATA NOT COLLECTED: • Precise location • Contacts, photos, or media • Health or fitness data • Sensitive personal information No data is sold or shared for advertising. Data is encrypted in transit. You can request deletion at any time (see Section 07).

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via in-app notification and, where possible, by email, with at least 14 days' notice before the change takes effect.

Cielo Cell AB — Privacy Team Målarevägen 24, 227 30 Lund, Sweden hello@cielocell.com EU/EEA: Swedish DPA (IMY) at imy.se · UK: ICO at ico.org.uk · EU ODR: ec.europa.eu/consumers/odr