Airtime and data for 80+ countries. Costs shown before you pay.
A top-up carries a phone number, a payment and a person waiting on the other end. Each one is protected on its own terms. This page says how, in plain words.
Card handling has its own page. Read the PCI-DSS Level 1 detail for that. Here we cover the data around the payment.
A top-up takes five to seven seconds on average. Four things happen in that window. Each one is closed off before the next begins.
The link between your browser and us is encrypted. That holds on hotel Wi-Fi and on a phone abroad.
Your card goes straight to our payment partner. It is swapped for a token. The real number never lands on our servers.
Our link to each operator is encrypted as well. Only the number and the amount travel. Nothing about you goes with them.
What is left is a receipt: the number, the amount, the time. It is encrypted where it rests.
Encryption at rest means the stored file is unreadable on its own. It needs a key, and the key lives elsewhere.
We hold the least we can. Every row below exists because a top-up cannot be delivered, repeated or proven without it. Anything that fails that test is not collected in the first place.
We do not sell personal data. We do not pass it to advertisers. There is no behavioural ad tracker on this site.
Strong encryption fails if too many people hold the key. So the harder rules here are about people, not maths.
The stored records and the keys that unlock them live in separate systems. Holding both in one place would waste the effort.
Support staff see the fields needed to answer your question. Nobody browses the wider database for interest.
Each look at a record leaves a trail. We review those trails, because a log nobody reads is just storage.
The 230+ operator links we run carry a number and a value. Your identity is not part of that message.
No. It is replaced by a token at the moment you pay. A token is a stand-in value that only works in our payment path.
The connection is encrypted end to end. Someone watching the network sees traffic, not content.
Wherever the operator sits, across 80+ countries. Transfers run on standard clauses approved under the GDPR.
Yes, within the limits set for paid orders. Write to us and we start it the same week.
Ask, and we send it in a readable file. Corrections and deletions start the same way. A person reads every message.
If our handling changes in a way that affects you, we say so by email first. Silence is never treated as consent.