Godwit SIM privacy policy
Effective 19 October 2026.
Who we are
Godwit SIM is a trading name of Lorikeet AI LLC, 2261 Market Street, STE 5391, San Francisco, CA 94114, United States. We also trade as Lorikeet, which makes the AI customer service platform that runs Godwit SIM's conversations. We are responsible for your personal information under this policy.
Privacy contact: hello@getwavemobile.com, or write to the address above marked "Privacy".
This policy has a main part that applies to everyone, then extra sections for Australia, the UK and California.
What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | Phone number, email address, the name you give us (any name is fine) | You |
| Conversations | SMS, WhatsApp and email messages, voice call audio and transcripts, screenshots you send | You |
| Orders | Packs bought, prices, top-ups, refunds, referral codes | You, Stripe |
| Payment and tax details | Billing country, state and postcode, card type and last four digits, payment status, IP address at checkout. We never see your full card number | Stripe |
| eSIM and usage details | eSIM identifiers (such as ICCID), install status, when it first connected, the country of the network, data used | Our network partner |
| Device details | Phone model and operating system, which you tell us or we infer from an install attempt | You |
| Identity checks | One-time codes sent and whether they were confirmed | Us |
| Marketing choices | Whether you said yes to marketing, and STOP requests | You |
We do not collect government ID. We do not need your date of birth or home address. If you tell us about hardship or family violence, we keep only what we need to help you (see "Sensitive situations").
How we use it
- To sell, deliver and support your eSIM: answering questions, sending payment and install links, checking usage, top-ups and refunds.
- To send service messages about a pack you bought, such as install help, low-data and expiry warnings.
- To confirm your identity before high-risk changes such as a replacement eSIM.
- To prevent fraud, including card testing, and to respond to payment disputes.
- To handle complaints, hardship requests and family violence support.
- To meet legal duties, including tax records and requests from law enforcement agencies that telecommunications providers must answer.
- To improve our service. Our team and our AI systems review conversations and outcomes to find what helps customers. We test changes, which means some customers get a message at a different time or in a different form than others. We measure these tests using combined results, not to single you out.
- To send marketing, only if you have said yes. You can say no at any time by replying STOP or telling us.
AI and automated decisions
Our AI assistant answers your messages and calls. It can make some decisions without a person, mainly approving refunds that fit our refund policy and offering top-ups. It does not refuse a refund the policy says you are entitled to. If you disagree with anything it decides, reply HUMAN and a member of our team will review the decision.
An AI system also helps us run the business using combined figures, such as how many installs worked first time. It does not read your individual conversations for that purpose.
We do not use your conversations to train AI models for anyone else, and the AI model providers we use are not allowed to train on them.
If you got your pack through Lorikeet
Lorikeet gives Godwit SIM packs to people it meets, such as sales prospects, job candidates and investors. If you received a pack this way, we link your Godwit SIM record to that contact so the Lorikeet person who gave it to you can see how your experience went and talk to you about it. We do not use your Godwit SIM conversations to decide whether to hire you. You can ask us to unlink your record at any time.
Who we share it with
We share personal information only as needed with these service providers, under contracts that limit their use of it:
| Who | Why | Where |
|---|---|---|
| Google Cloud | Hosts our order system and the Lorikeet platform | United States (us-central1) |
| Stripe | Payments, tax calculation and fraud screening | Stripe, Inc. (United States) |
| Twilio | Sends and receives SMS, WhatsApp messages and calls | United States |
| Meta (WhatsApp) | Delivers WhatsApp messages if you use WhatsApp, under WhatsApp's own terms | United States |
| Our network partner | Creates your eSIM and reports install status and data usage | Singapore |
| AI model providers used by Lorikeet | Generate replies and transcribe calls | Anthropic, OpenAI, Google, Baseten, Modal and TypeSafe, United States |
| Google LLC (Gmail) | Sends and receives email | United States |
We also share information with:
- the Telecommunications Industry Ombudsman, a UK alternative dispute resolution scheme, or a regulator, if you complain to them or they ask
- law enforcement and national security agencies where the law requires it
- professional advisers such as our accountants and lawyers
- a buyer of the Godwit SIM business, who would have to follow this policy
We do not sell your personal information. We do not share it for advertising on other companies' sites or apps.
How long we keep it
| Record | How long |
|---|---|
| Orders, payments, refunds and tax records | 7 years, to meet Australian tax law |
| Conversations, call transcripts, identity checks and complaint records | 2 years after your last contact with us |
| Marketing choices and STOP requests | As long as we have your number, so we keep respecting them |
| Hardship or family violence details | Only until we have finished helping you |
After that, we delete it or make it permanently anonymous.
Keeping it safe
We use encryption in transit and at rest, access controls, multi-factor checks before high-risk eSIM changes, and limited staff access. If a data breach is likely to cause you serious harm, we will tell you and the relevant regulator as the law requires.
Your choices and rights
You can ask us to:
- show you the personal information we hold about you
- correct it
- delete it, unless we have to keep it by law (for example, tax records)
- stop marketing (reply STOP at any time)
- unlink a Lorikeet contact record
Message us, or email hello@getwavemobile.com. We will check it is you, usually with a code sent to your phone number, and reply within 30 days. There is no charge.
Sensitive situations
If you tell us you are in financial hardship or experiencing domestic or family violence, we use that information only to help you, limit who can see it, and do not share it with anyone else on your order. See our financial hardship and domestic and family violence policies.
Children
Godwit SIM is for people aged 18 and over. We do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.
Where we don't operate
We do not sell to people in the European Union and do not target them.
Our website
Our website uses no analytics and sets no cookies. Stripe's payment page uses cookies to process payment and prevent fraud.
Changes
We will post any change here with a new effective date. If a change matters to how we use information we already hold, we will tell you by message or email first.
Complaints about privacy
Contact us first at hello@getwavemobile.com. We will reply within 30 days. If you are not satisfied, you can contact the regulator listed in your section below.
Australia
We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles.
- Overseas disclosure. We disclose personal information to the providers listed above in the United States, Singapore and the countries where our network partner's carriers operate. We take reasonable steps, through contracts, to make sure they handle it consistently with the Australian Privacy Principles.
- Telecommunications records. As a telecommunications provider we may have to keep some account records and help law enforcement agencies under the Telecommunications Act 1997 and the Telecommunications (Interception and Access) Act 1979.
- Complaints. If you are not satisfied with our answer, contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. You can also contact the Telecommunications Industry Ombudsman about telecommunications privacy issues.
United Kingdom
For people in the UK, Lorikeet AI LLC is the controller under the UK GDPR and the Data Protection Act 2018. ICO registration number: [to be confirmed].
Lawful bases
| Use | Lawful basis |
|---|---|
| Selling, delivering and supporting your eSIM | Contract |
| Identity checks, fraud prevention | Legitimate interests (protecting you and us) |
| Tax records, regulator and law enforcement requests | Legal obligation |
| Service improvement and testing | Legitimate interests (improving the service) |
| Marketing | Consent |
| Linking a Lorikeet contact record | Legitimate interests (you can object) |
International transfers. Your information is transferred to Australia, the United States and other countries listed above. We rely on the UK International Data Transfer Addendum or Agreement, or on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified.
Your rights. As well as the rights above, you can object to processing based on legitimate interests, ask us to restrict processing, ask for a copy of your data in a portable format, and ask for a person to review any decision made only by automated means that significantly affects you.
Complaints. You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
California
This section applies to California residents.
What we collected in the last 12 months, using the CCPA categories: identifiers (phone number, email, name, IP address, eSIM identifiers), customer records and commercial information (orders, payment status, billing address), internet or other electronic activity (conversations, install and usage events), audio information , and inferences (device type). Sources and purposes are in the main tables above.
Sale and sharing. We do not sell or share personal information as the CCPA defines those terms, and have not done so in the last 12 months. We do not knowingly sell or share information of anyone under 16.
Sensitive personal information. We collect only what is needed to provide the service (such as the one-time codes used to access your order), and do not use it to infer things about you.
Your rights. You can ask to know what we collect and how we use it, to delete it, and to correct it. We will not treat you differently for using these rights. You can use an authorised agent, including an AI agent, to make a request. We will confirm the request with you directly, using your phone number or email.
Shine the Light. We do not share personal information with third parties for their own direct marketing.
Retention. See "How long we keep it" above.