Privacy Policy

11. Data Controller

CFJ Global LLC (registered in Colorado, USA, Entity ID: 20261588242, referred to as 'CFJ-LINK' or 'we') is the data controller for the processing activities described in this Privacy Policy.

This Privacy Policy applies to all CFJ-LINK products and services, including the website, mobile application, and enterprise API. We are committed to processing your personal data in accordance with applicable data protection laws, including GDPR and U.S. state privacy regulations.

22. Data We Collect

In accordance with the data minimization principle, we collect only the minimum information necessary to provide our services. The categories collected are:

• Account Information: Email address (when registering an account) and account username.
• Device Identifiers: EID (Embedded SIM Identifier), used to bind eSIM profiles to your device. EID does not contain any personally identifiable information.
• Transaction Information: Order number, plan type, payment method (without full card number), transaction time, and amount.
• Usage Data: Plan usage statistics (total and remaining data). We do not log the specific websites you visit, IP destinations, or communication content.
• Support Information: Information you voluntarily provide to our support team when resolving service issues.
• Crypto receiving address: When you choose digital-currency payment (e.g., USDT), the receiving wallet address you provide or that we generate, used to reconcile on-chain payments.
• Referral & invitation data: Invitation code ownership, referral source, and referrer/referee relationships, used to operate our referral program and settle rewards.

We do not require you to provide a passport, national ID, or physical address as a prerequisite for purchasing a standard eSIM plan, unless applicable compliance requirements trigger an identity verification process (see Section 3).

33. Identity Verification (KYC) & Third-Party Service Provider Didit

CFJ-LINK is committed to maximizing data minimization. The vast majority of individual users purchasing personal eSIM plans are not required to undergo any form of KYC identity verification.

The following circumstances may trigger the KYC verification process:

• Enterprise API partners applying for high-quota access credentials;
• Applicable laws, regulations, or carrier compliance requirements mandating identity verification for certain user groups;
• Accounts exhibiting abnormal transaction activity triggering risk control rules;
• You proactively requesting enterprise billing or VAT invoices or other services requiring real-name information.

When KYC verification is triggered, CFJ-LINK uses identity verification services provided by Didit (website: didit.me), a professional AI-driven identity verification service provider.

During the KYC process, you may be required to provide Didit with: government-issued valid identity documents (front and back images of a passport, national ID, or driver's license); and liveness detection selfie photos (to prevent identity document fraud).

Data flow disclosure: The above identity document images and biometric data are collected and processed directly by Didit, and stored in accordance with Didit's own privacy policy. CFJ-LINK only receives the verification conclusion returned by Didit (Pass/Fail) and necessary identity attributes (such as name and nationality). CFJ-LINK does not hold your original document images or raw biometric data.

To understand Didit's data processing practices, please visit the Didit website to review their privacy policy. You have the right to request that Didit delete your personal data held by them (see Section 7).

44. How We Use Your Data

We use the information collected solely for the following explicitly defined purposes:

• Providing, maintaining, and improving eSIM services;
• Processing transactions and sending order confirmations and QR codes;
• Responding to support requests and providing technical assistance;
• Fulfilling legal obligations and compliance requirements (including OFAC sanctions screening);
• Detecting and preventing fraud and abuse;
• Sending product updates or marketing communications, subject to your explicit consent.

55. Third-Party Sharing & Disclosure

We do not sell your personal data. We may share necessary information with third parties in the following circumstances:

• Identity verification service provider Didit: As described in Section 3, only when KYC is triggered.
• Carrier partners: EID and necessary plan activation information are provided to carriers to complete eSIM profile delivery.
• Payment processors: Transactions are processed through PCI DSS-certified third-party payment gateways. We do not retain complete payment card information.
• Cryptocurrency payments & blockchain networks: When you pay with digital currency (e.g., USDT), the transaction is recorded on a public blockchain; receiving addresses and on-chain transactions are used by our crypto-payment processing to confirm receipt.
• Legal requirements: When we receive legally binding judicial orders, court orders, or MLAT requests, we process them in accordance with our Law Enforcement Cooperation Policy (law.html).
• Business succession: If CFJ-LINK undergoes a merger, acquisition, or asset sale, relevant user data may be transferred as a business asset. Affected users will be notified in advance.
• Live chat provider SaleWisely: Its script loads only after you open the customer-service window yourself. When you use that entry while signed in to our Web App, your member ID, registered email address and nickname are provided to this provider automatically so it can identify your account without asking you to re-enter them. When you are not signed in, or when you use this website only, the provider receives just the name, email address, phone number and issue description you enter in the chat and in the pre-chat survey. Nothing is transmitted to this provider unless you open the chat.

66. Data Retention

We retain your data according to the following principles:

• Account information: retained for 90 days after account deletion to handle pending disputes, then permanently deleted.
• Transaction records: retained for up to 7 years in accordance with applicable accounting and tax law.
• KYC verification conclusions: retained for 30 days after account deletion, or longer as required by applicable regulations.
• Usage statistics: retained in aggregated, anonymized form for service optimization analysis.
• Support communication records: retained for 12 months after dispute resolution.

77. Your Data Rights

Under applicable data protection laws, you have the following rights:

• Right of Access: Request a copy of personal data we hold about you.
• Right of Rectification: Request correction of inaccurate personal data.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data we hold (except where legally required to retain).
• Right to Restrict Processing: Request restriction of our processing of your data in certain circumstances.
• Right to Data Portability: Obtain a copy of your data in machine-readable format.
• Right to Withdraw Consent: Withdraw consent you have previously given for data processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, submit a written request through the contact details provided in Section 10. We will respond within 30 calendar days of receipt.

For KYC data held by Didit, please contact Didit directly (didit.me) to exercise your data rights.

88. Cookies & Tracking Technologies

Our website uses the following types of cookies:

• Essential Cookies: Maintaining session state, saving language and theme preferences (stored in localStorage, not uploaded to servers).
• Analytics Cookies: Collecting anonymized visit statistics to improve website performance (e.g., Google Analytics with anonymized IP mode).
• Functional Cookies: Remembering your preferences to provide a more personalized experience.
• Chat widget storage and event logs: Once you open the chat window, the widget stores a random device identifier and window state locally in your browser (localStorage keys deviceKey, salewisely-user, salewisely-chat-size, salewisely-ball-position; sessionStorage key salewisely-client-instance-id) and sends event logs such as page URL, referrer and browser type to the provider endpoint event.salewisely.com. This data is not uploaded to our servers. When the provider opens a support session it records the page URL, referrer and browser type; if you use the chat while signed in to our Web App, that session also carries the member ID and email address described above.

You can decline non-essential cookies through your browser settings. Declining analytics cookies does not affect your access to core platform features.

99. Protection of Minors

The services on this platform are not directed at individuals under 18 years of age. We do not intentionally collect personal data from minors. If you believe we may have inadvertently collected personal data from a minor, please notify us immediately through the contact details in Section 10 and we will delete the relevant data promptly.

1010. Contact Us

For any questions about this Privacy Policy, data rights requests, or complaints, please contact our data protection team through the following:

• Email: [email protected]
• Business & Legal: [email protected]
• Telegram Support: @cfjglobal_bot