Plain English. No dark patterns. We collect the minimum we need to run your eSIMs, airtime, bills, gift cards and wallet — and nothing for advertising.
This policy explains what data Portal Verse Resources collects when you use our website, mobile app, and API, why we collect it, what we do with it, and the choices and rights you have. If anything below is unclear, email us — we'll do our best to clarify in plain language.
1. Overview
Portal Verse Resources (referred to as "we", "us", or "our") operates a platform that provides eSIM data plans, airtime, utility bill payments, gift cards, and a digital wallet. We are committed to handling your personal data lawfully, fairly, transparently, and with the minimum collection necessary to deliver our services.
This Privacy Policy applies to all visitors and customers of our website (portalverse.io), our mobile applications on iOS and Android, and any related APIs or services we operate.
2. Data we collect
We collect only the data we need to deliver the service you asked for. Specifically:
- Account data. Email address, password (hashed), display name, and account preferences you choose.
- Payment data. When you top up your wallet we record the amount, currency, and payment method. We do not store full card numbers — that information is held by our PCI-DSS certified payment processors.
- Transaction data. Records of services you order (eSIM plans purchased, airtime, bills, gift cards, etc.) and the wallet movements that result.
- Communication data. The contents of support tickets, chat messages, and any feature requests or bug reports you send us.
- Device & technical data. IP address (truncated after 30 days), device type, OS version, app version, and crash logs — collected purely to keep the service stable and secure.
- Identity verification data. If a feature requires proving who you are, we receive a verification decision and a small set of confirmed details — never the document itself. See "Identity verification & fraud prevention" below.
- Contacts (only if you choose to use it). If you use the optional "pick from your contacts" feature when sending money, we read your phone's contact list on your device to show you a searchable list. Your contact list is never uploaded to or stored on our servers — only the name and number of the one contact you actually select is used, exactly as if you had typed it in yourself.
What we never collect: your full contact list stored on our servers, your location in the background, your browsing habits on other sites, your raw ID document or selfie image, or anything for advertising profiling.
3. Identity verification & fraud prevention
We never see or store your ID document or selfie. Document capture and the liveness check happen inside our verification partner's own secure, hosted flow. Only their decision — and a small set of confirmed details — comes back to us.
Certain features (including funding your wallet, buying gift cards, redeeming Gift Points, and receiving a crypto deposit address) require you to verify your identity first. We use a dedicated identity-verification partner to run this check. When you complete it, we receive:
- The verification decision (approved, under review, or rejected).
- Your full name and date of birth as they appear on your document, used to confirm you're the accountholder and that you meet our minimum age requirement.
- A one-way cryptographic fingerprint of your document number — not the number itself — used only to detect if the same document is being used to open more than one account.
- Signals the check itself produces (for example, whether the camera used looked like a live camera rather than a recording or a virtual device), used to keep the check reliable.
We also run automated and manual fraud and anti-money-laundering (AML) screening on accounts and transactions, including comparing verified names and details against government and international sanctions and watch lists (such as the US Treasury's OFAC Specially Designated Nationals list). A possible match, or any other signal our fraud systems flag, can place a temporary hold on funds or an account while it's reviewed by a person. We keep a record of these checks and their outcomes as part of our legal obligation to monitor for financial crime.
We do not use your identity or fraud-screening data for advertising, and we do not share it with anyone except the verification and fraud-prevention partners who help us run these checks, or where the law requires it (see Section 6, "When we share data").
4. How we use your data
We use your data only for the following purposes:
- To create and manage your account.
- To process your orders and credit your wallet correctly.
- To deliver eSIM activations, airtime, bills and gift cards you purchased.
- To send you transactional notifications (receipts, order updates, security alerts).
- To verify your identity where a feature requires it, and to detect, prevent, and investigate fraud or abuse of our service.
- To comply with our legal obligations (e.g. financial record-keeping for tax purposes, anti-money-laundering and sanctions-screening law).
- To improve the product based on aggregated, anonymized usage signals — never on personally identifiable behavior.
5. Legal basis for processing
Under data-protection regulations (including the GDPR), we process your personal data based on:
- Contract. Most processing is necessary to deliver the service you asked for.
- Legitimate interest. Fraud prevention, service stability, and security monitoring.
- Consent. Optional marketing emails — you can unsubscribe at any time with one click.
- Legal obligation. Identity verification (KYC) and anti-money-laundering checks where they apply, sanctions-list screening, tax records, and responses to lawful court orders.
6. When we share data
We do not sell, rent, or trade your personal data. We share specific information only with:
- Payment processors (card processors, mobile money operators and other payment partners) to settle your top-ups, withdrawals and refunds.
- Identity-verification & fraud-prevention partners who run the checks described in Section 3.
- Connectivity & carrier partners who deliver the eSIM data, airtime and other services you order.
- Infrastructure providers (cloud hosting, error monitoring) bound by strict data-processing agreements.
- Authorities when we are legally compelled by a valid court order — and we push back on overbroad requests.
7. Data retention
We keep personal data only as long as we need it. Truncated IP logs within 30 days; account and transaction records for as long as your account is active plus the period tax and anti-money-laundering laws require. Identity-verification decisions and document fingerprints are kept for as long as your account is active, plus whatever period applicable anti-money-laundering and financial-recordkeeping law requires afterward (commonly several years in the jurisdictions we operate in), after which they are deleted. When you ask us to delete your account, we will honor it within 14 days, except for records we are legally required to keep.
8. Security measures
Security isn't a checkbox for us — it's a daily practice. We use:
- TLS 1.2 or higher for all data in transit.
- Encryption of sensitive data at rest.
- Salted, slow-hashed (scrypt) password storage. We never see your password in plaintext.
- Mandatory 2-factor authentication for our admin team and engineering staff.
- Hardware-backed key storage for mobile app secrets (iOS Keychain, Android Keystore).
- Continuous automated monitoring of our systems.
- Regular security reviews, and a way to report vulnerabilities to [email protected].
9. Your rights
Depending on your jurisdiction, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectify — ask us to correct inaccurate or incomplete data.
- Erase — request deletion of your account and personal data, subject to legal retention requirements.
- Restrict — ask us to limit how we process your data while a question is being resolved.
- Object — opt out of any processing based on legitimate interest.
- Portability — receive an export of your data in a machine-readable format.
- Withdraw consent — for anything you originally consented to (such as marketing emails).
- Lodge a complaint with the data-protection authority in your country.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
10. Cookies & tracking
We use a minimal set of strictly necessary cookies to keep you logged in and protect against cross-site request forgery. We do not use advertising cookies, cross-site tracking pixels, or behavioral profiling cookies. Aggregated, privacy-respecting analytics help us understand which pages are useful — they cannot identify you personally.
11. Children's privacy
Portal Verse Resources is not directed at children under 16. We do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. International transfers
Portal Verse Resources operates globally. Your data may be processed in countries other than your own, including the United States and the European Union. When data leaves your jurisdiction, we rely on Standard Contractual Clauses or equivalent legal mechanisms, and we ensure the receiving party offers an adequate level of protection.
13. Changes to this policy
We may update this policy when we ship new products or when laws change. When we make material changes we'll notify you in-app and by email, and we'll always update the "Last updated" date at the top of this page. Continued use of the service after an update means you accept the revised policy.
14. Contact us
Privacy questions, requests to exercise your rights, or anything else related to your data:
- General privacy team[email protected]
- EU / UK privacy requests[email protected]
- Customer support[email protected]
See also our Terms of Service and About page for context on how Portal Verse Resources operates.