Privacy policy

Who is responsible

WEB3 SOLUTIONS LLC, based in Indiana, United States, operates ShrimpToast and is responsible for the personal information described in this policy. You can contact us at the end of this page about privacy, your information, or your rights.

This policy covers our website, trip planner, checkout, and self-service eSIM help. Our payment and connectivity partners also process information under their own policies when providing their services.

Information we use

• Trip information: the text or bookings you submit; destinations, dates, durations, phone-use preferences, and other details extracted from them; and the plans we recommend.
• Purchases: selected plans, prices, order and payment references, payment status, and the email address provided at checkout. Stripe collects payment and billing details directly. Our application does not store full card numbers or security codes.
• eSIM service: supplier order references, eSIM identifiers and installation credentials, activation and expiry information, data allowance and reported usage, and technical settings needed to deliver and troubleshoot your plan.
• Support: the issue category, device type and current destination you select, troubleshooting progress, reported service failures, replacement details, and refund amounts and status. An optional message can be processed to choose a support category.
• Technical information: a browser access identifier, an IP-derived security identifier, request timestamps, and operational information. Our hosting and service providers may process IP addresses, browser or device information, and security logs when serving requests.

We do not request continuous GPS location. The destination you choose in support is information you provide. Mobile networks separately process information needed to connect your device and operate their networks.

Why we use it

We use this information to understand your trip, compare plans, take payment, deliver and manage your eSIM, show your purchases, troubleshoot problems, issue replacements and refunds, prevent misuse, meet legal and accounting obligations, and respond to requests.

Where a law requires a legal basis, we rely on performing a contract or taking steps you request before a purchase for planning, checkout, delivery, and support; legitimate interests for proportionate security, fraud prevention, and service administration; and legal obligations for required records and disclosures. We rely on consent where the law requires it and will explain that choice when requesting it.

We do not sell personal information, run targeted advertising, or add advertising trackers to the app. We do not currently use a separate website analytics service.

Trip reading and automated support

When AI trip reading is enabled, we send your submitted itinerary text or PDF to OpenAI to extract destinations, durations, and phone-use preferences. A booking can contain more personal information than the planner needs: remove names, passport numbers, booking references, and other unnecessary details before uploading, or enter your stops manually.

Uploads are processed in memory. The application does not save the original PDF or text file to file storage. The extracted trip and any extracted notes can be stored when a quote or order is created. The original text remains in the open planner so you can edit it.

For support, OpenAI receives the optional free-text message to choose a predefined category. Our support classifier does not receive your payment credentials or have authority to invent network settings, usage figures, or refund amounts. You can select a category directly without using this feature.

We request that OpenAI not store these responses as application history. This is not a promise of zero provider retention: OpenAI may retain API inputs and outputs for abuse monitoring, generally for up to 30 days, or longer where legally required. OpenAI states that API data is not used to train its models by default. See OpenAI’s business data privacy information.

Recommendations and support resolutions use automated rules and supplier information. You can edit the trip, choose another plan, and see the refund offered before accepting it. If you believe an automated result is incorrect or wish to exercise a legal right concerning automated processing, use our privacy contact below.

Who receives information

• Stripe: payment, billing, fraud prevention, and refund processing. We send order references, purchased plan descriptions, and amounts. See Stripe’s Privacy policy.
• Supabase: database hosting for quotes, orders, eSIM delivery, security records, and support outcomes. See Supabase’s Privacy policy.
• eSIM Access and network partners: the package and service identifiers needed to provision, manage, measure usage of, replace, or cancel an eSIM. We do not send your original itinerary document to the connectivity supplier. See eSIM Access’s Privacy policy.
• OpenAI: the trip inputs and optional support messages described above, when those features are enabled.
• Infrastructure providers: hosting, network delivery, and security services needed to run the website, which process requests and operational logs.

We may also disclose information when required by law, to establish or defend legal claims, to address fraud or security threats, or as part of a business transfer subject to applicable privacy protections. We do not provide your information to advertisers.

Cookies and browser storage

A necessary first-party cookie, roam_guest, gives the purchase browser access to its quotes and orders. It contains a random identifier; the database stores a keyed hash rather than the raw cookie. The cookie has a one-year maximum age. The older internal name does not refer to a separate service.

Demo installation previews are stored on your device under roam-demo-trips. They remain until removed or your browser’s site data is cleared. Demo purchases do not charge you or provision a real eSIM. AI-enabled trip reading can still send submitted information to OpenAI even when purchases are in demo mode.

Stripe may use cookies or similar technologies when its payment interface is loaded, including for security and fraud prevention. Browser controls let you remove or restrict storage. Clearing the purchase cookie can remove your access to My trips; it does not delete the corresponding server records or request a refund. Save your order number and installation instructions first.

How long information is kept

Retention depends on the record’s purpose: fulfilling the trip, providing support, resolving payment disputes, preventing duplicate refunds, complying with tax and accounting requirements, and handling legal claims. Quotes expire for purchasing after 15 minutes, but quote expiry does not automatically delete their database records. Order and support records remain available after the trip; they are not automatically deleted when an eSIM expires.

Original uploads are not kept in application file storage. Provider security logs and backups have their own retention rules. A browser cookie’s expiry or removal affects browser access, not all copies held by us or our providers.

You can request deletion using the contact below. We may retain records needed for legal obligations, disputes, fraud prevention, or an ongoing purchase, and will explain applicable limits. We do not promise immediate deletion from backup systems or independent provider records.

Security and international processing

We restrict order access using browser ownership checks and server-side database permissions. Installation codes are sensitive: anyone who obtains a usable code may be able to install the eSIM. Keep those codes and exported instructions private. No internet service or storage system can promise absolute security.

We are based in the United States and use international service providers. Information may be processed in the United States and other countries where our providers operate, which may have different data protection laws. Where applicable law requires safeguards for an international transfer, those safeguards must apply; accepting these terms is not a waiver of those protections. Contact us for information about the arrangements relevant to your data.

Your choices and privacy rights

You can edit trip information before purchasing, use manual destination entry, and select a support topic instead of sending an AI-routed message. To request access, correction, deletion, or a copy of stored information, email our privacy contact. Include the purchase email and order number where relevant; do not send full card details or installation codes. We may ask for proportionate proof that the request concerns your information.

Depending on your location and the law’s applicability, you may also have rights to portability, restriction, objection, withdrawal of consent, an appeal of a denied request, or safeguards around certain automated decisions. You can raise these in the same email. We will respond within applicable legal deadlines and explain any exception. Withdrawing consent does not affect earlier lawful processing.

Where provided by law, you may complain to your local data protection authority or attorney general. For Indiana requests, you can ask us to reconsider a denial by emailing with the subject “Privacy appeal.” We do not discriminate against you for exercising applicable privacy rights. Because we do not sell personal information or use targeted advertising, there is no such activity to opt out of in the current service.

Children, changes, and contact

The website is intended for people able to make their own travel purchases, not for children under 13. We do not knowingly collect personal information from children under 13. A parent or guardian who believes a child has submitted information can contact us to request removal.

We will update this policy when our practices change, show the revised date, and give additional notice or obtain consent where required. Privacy and legal email requests are separate from the automated eSIM troubleshooting flow.