Privacy Notice

Effective October 28, 2026. This policy applies to FreeSIM services that are actually available. Publication does not announce a service launch or establish that technical controls have passed verification.

1. Who runs FreeSIM

The EQ Company ("EQ", "we", "us") operates FreeSIM. This notice concerns FreeSIM accounts, participation in tasks, mobile-data rewards, eSIM purchases and related support. It does not replace a separately applicable notice for an EQ staff, contractor or applicant platform.

Our company contact is The EQ Company, 11949 Goshen Avenue, Los Angeles, CA 90049, USA; support@eq.company. We are responsible for the personal information described here, subject to any separately identified independent provider responsibilities.

FreeSIM research participation and purchases are intended for adults aged 18 or older. Do not submit information about children through tasks or support. We investigate reports that an account does not meet eligibility requirements.

2. Information involved

Accounts and security. We process account identifiers, contact details, your selected sign-in method, authentication/session information and security or fraud-prevention events. If you choose a social sign-in provider, it may supply its account identifier, verified email and profile information under the permissions shown to you. An Apple private relay email can differ from your usual address. Verification credentials are used to secure access; never send passwords or verification codes to support.

Study profile. Research setup asks for country and age; gender, profession and education are optional. You may decline those optional questions without reduced earning access. The birthday control calculates age; the app submits age rather than a full birthday through the profile-registration flow. Profile information may be associated with your participation and task records as described in the applicable study notice.

Answers and task activity. Depending on the enabled study policy, we record answers and changes, the content of task-specific text fields and edits, task control interactions, image inspection, zoom/pan/scroll activity, timing, interruptions and device/display/language/network context. These records help evaluate AI systems, understand the task experience and assess submission quality. The task collector does not capture the contents of other apps or login, checkout, Settings or support screens. Those features process their own account, payment or support information.

Verification drawings. Completing a human check can require processing a drawing and recognized text. If you separately opt in to research retention, the drawing, recognized OCR text and related stroke/clear history may be selected for the disclosed AI research uses and retained for up to 36 months from collection, subject to earlier applicable deletion and shorter requirements. This optional choice is separate from completing the human check. The verification result and necessary technical metadata can still be processed when research retention is declined; declining does not authorize keeping the drawing/text/history as a research dataset.

Country suggestions. You may select a country manually. If you request a location-based suggestion in the mobile app, the operating system obtains a foreground location and reverse-geocodes it to suggest a country. Coordinates are not saved to your participant profile through this feature. Your operating system or its geocoding service may process the lookup. Location permission is optional and background tracking is not used by this feature.

Orders and service. We process plan, price, currency, order status, MB applied, payment references and eSIM fulfillment/usage information necessary to supply and support a plan. Payment providers process payment details under their notices. Do not send card numbers, activation codes or other secrets in support messages.

Support and diagnostics. We process messages you send, ticket/account references, service communications and technical diagnostics. Crash reporting, when enabled for a release, may include error details, device/OS information and a per-install identifier. The app source configuration disables crash screenshots, session replay and breadcrumbs; the enabled release configuration must be checked separately, and this does not mean that all diagnostics are anonymous or that no technical information is transmitted.

If you choose AI help, we explain before the first send which support messages are shared with OpenAI to generate answers and ask for your permission. Human help remains available. FreeSIM does not reuse support chats for research or model training by default. AI cannot independently change your account, refund a payment or award MB. Provider handling and retention must be verified for the enabled configuration; our support retention period does not override a provider's shorter processing period.

3. Why information is processed

We use information to operate and secure accounts; administer study eligibility and consent; deliver tasks and evaluate responses; perform research, AI training/evaluation and quality checks within the disclosed study scope; credit and reconcile eligible MB; supply eSIM orders; answer support requests; diagnose failures; prevent misuse; and meet legal obligations.

Your task responses and related task activity may be selected to train, evaluate, and improve AI systems. Selected research data may be shared with our customers for these purposes.

Where a law requires a legal basis, we identify it for the particular processing: performance of the requested service, an applicable legal obligation, a properly assessed legitimate interest, or consent where required. Accepting service terms does not substitute for consent to optional research retention or an operating-system permission. We seek new permission where a new use requires it.

4. Recipients and international processing

Authorized staff and contracted service providers may process information for authentication, hosting/databases, private storage, email, security/attestation, diagnostics, payments, connectivity fulfillment and support. Apple or Google may process information when you use their sign-in, operating-system, location or payment services. Some providers act independently for their own security, legal or payment obligations.

Research outputs may be provided to authorized customers or research collaborators within the specific study disclosure and permission. The disclosure must identify the relevant recipient categories, what information is shared and its purpose, including use with third-party AI where applicable. Pseudonymous information is not automatically anonymous. This notice does not authorize sharing undisclosed data or unrestricted onward use.

Customer research deliveries must exclude names, email addresses, phone numbers, account/payment identifiers and precise location. Only approved research fields and disclosed optional demographics may be delivered, with a project-specific research identifier where needed. This restriction also applies to identifiers inside free text or OCR/drawings; simply dropping identity columns is insufficient. Operational payment/connectivity providers have a separate necessary-service scope. These restrictions govern customer deliveries. This policy does not authorize a delivery until its field/content controls and recipient obligations have been verified.

Customer deliveries require written permitted-use restrictions, no re-identification, controlled onward transfers and enforceable expiry/deletion obligations with confirmation. A recipient unable to honor those requirements cannot receive a delivery under this policy. Actual contracts and downstream handling must be verified before a delivery is made under these requirements.

We may also disclose information where lawfully required or necessary for legal claims and authorized corporate transactions, with applicable safeguards. Processing may occur outside your country. Where required, we use an appropriate transfer mechanism and safeguards and explain them on request. The applicable feature or study notice must identify its actual providers, processing regions and required transfer safeguards before the processing begins. Contact support for the current details; this general notice does not authorize undisclosed processing.

5. Retention and account deletion

We retain participant-linked task responses and related task activity for up to 36 months from collection, only while needed for the disclosed purposes. Records may be deleted earlier, including unsuitable or unnecessary records and records subject to an applicable deletion request. Optional-retention choices and applicable shorter requirements can further limit retention. This maximum does not postpone an applicable deletion obligation or authorize indefinite participant-linked research retention.

The approved operational schedule is:

Category	Maximum or necessity rule
Necessary account/profile records	While the account exists and the information remains needed; review necessity and honor applicable deletion. No silent inactivity deletion to remove earned balances.
Support messages	Up to 12 months after the conversation closes, subject to earlier applicable deletion.
Raw crash diagnostics	Up to 30 days, with restricted access.
Ordinary security logs	Up to 90 days, with restricted access.
Rolling backups	Expire within 30 days; restoration must not return deleted records to ordinary service.

Specifically legally required records are restricted to the necessary fields, purpose and required period. The exact categories, jurisdictions and statutory durations still need verification; this is not a blanket exception for payment or research records. The research maximum is not a 36-month rule for operational records. These are required policy limits. Automated expiry, deletion and restore enforcement have not yet been verified across all systems. Publishing this schedule is not a receipt that any particular record has expired or been erased.

Retained deletion controls: the current implementation design retains minimal request references and one-way account/participant fingerprints to bind deletion evidence and prevent erased identities or records returning through a restore. These are restricted operational controls; hashing does not establish anonymity or a statutory retention exception. The exact fields, access, necessity reviews and expiry/removal schedule are still being reconciled with this deletion policy. This unresolved control inventory prevents a claim that full erasure has been verified. These controls are not confirmed erased, are not approved for indefinite retention and must not be used for research or training.

Our deletion policy requires removal of the account, associated personal information and participant-linked research data, retaining only specifically required legal records. The operational-control reconciliation above remains outstanding; receiving a request is not proof that this scope has been erased. We acknowledge within two business days and target completion within 30 calendar days, sooner where required. Any lawful extension needs an explanation. Business days follow Pacific Time (America/Los_Angeles), Monday–Friday excluding observed U.S. federal holidays. Relevant copies, processors, releases and restoration controls are included; removing an identity link alone is insufficient. We confirm completed erasure only after the relevant stages are verified.

6. Choices and requests

You can decline optional location permission and choose your country manually. You can change the optional handwriting-retention choice in Settings. You can stop participating and ask to withdraw consent; stopping alone is not confirmation that earlier records have been erased. Use the account-deletion flow or contact us to exercise deletion rights.

Depending on applicable law, you may request access, correction, deletion, portability or restriction, object to certain processing, withdraw consent, or complain to the relevant privacy regulator. Contact the privacy address above. We verify ownership proportionately and handle authorized representatives as applicable. We do not require you to send a password, full payment-card details or unrelated personal information. Requests and appeals are handled within applicable legal deadlines.

7. Safeguards and changes

We use access controls and technical/organizational safeguards appropriate to the information and service. No system is perfectly secure. We address incidents and provide notifications when required by law.

This notice displays its effective date. Material changes will be explained before they take effect where required, and new consent will be requested where necessary. This policy and its contact details are accessible independently of task participation.