Ubigi

Is Ubigi safe?

Yes, for buying travel data. Ubigi is the consumer brand of Transatel, a French mobile operator owned by NTT, and we found no breach, fine or regulator case against it. It scores 62/100, below Holafly (65) and Airalo (70). The catch is not fraud or hacking. It is how much Ubigi shares and keeps: location and device IDs go to other companies, and traffic records stay for ten years.

The app is a self-care account for buying and topping up plans, and it is popular with travellers from Europe, Canada, Australia and South Africa. In October 2026 it sat in the Travel top 100 on the App Store in eight of the 24 countries we track, ranking 25th in France. Google Play counts more than a million downloads.

Who runs Ubigi

Unlike most eSIM brands, Ubigi is run by a mobile operator rather than a reseller. Transatel has its own network code, runs its own eSIM provisioning platform (SM-DP+) and its own packet gateways, and resells access on partner networks abroad. Ubigi is not a separate company. The privacy policy says Transatel is the data controller for everything sold under the brand, and it names a data protection officer and the French regulator, CNIL, for complaints.

That set-up has a privacy side effect. Your data traffic is routed through an operator, and the operator can see connection data. Transatel's policy lists, for Ubigi customers, "data traffic information (e.g. IP address, websites visited, etc.)", device and eSIM identifiers such as the IMEI and EID, and your country of connection derived from roaming. The same policy says traffic usage information is kept for ten years from the date of the traffic. Customer records stay for five years after the contract ends, and financial documents for ten.

What the app shares

Apple's label is short. Identifiers may be used to track you across other companies' apps and websites. Purchases, contact info and identifiers are linked to you, and location and diagnostics are collected without being linked.

Google Play gives more detail. It says precise and approximate location and app interactions are shared with other companies for analytics. Device IDs are shared for analytics and advertising, and your email and payment details go to others to make the app work. The privacy policy names categories of partners: payment providers, email and analytics services, cloud hosts, and a data and AI platform that analyses network data such as IMSI and ICCID numbers. It does not name the companies. Some processors, mainly CRM, marketing and analytics tools, may handle data in the United States under standard contractual clauses or the EU-US Data Privacy Framework. The policy does not mention selling data.

We score privacy on the broader picture from Google Play and the policy, as we do for every app where the label tells less.

Security

We found no reported breach of Ubigi or Transatel customer data. Ubigi's business pages say its data is hosted in France and Europe in data centres certified to ISO 27001 and ISO 9001. That is a claim about the buildings and hosting, not a certificate for Transatel itself, and we found no published audit or trust centre. We also found no bug bounty on HackerOne or Bugcrowd.

The account itself is basic. You sign in to the app or ubigi.me with a username and password, and we found no two-step login in the help centre. Google Play says data is encrypted in transit. Because the eSIM profile and plans are tied to that account, use a unique password.

Refunds and plans

Ubigi's refund rules are stricter than Holafly's six-month window. A preloaded eSIM bought on the website can be refunded only before you scan the QR code, and never for a carrier-locked phone. Top-ups bought in the app stop being refundable once you use them. If the service fails because of Transatel, you must ask within 14 business days with the receipt. Preloaded QR codes stay valid for six months. Monthly plans have no minimum term and can be cancelled at any time.

How to use Ubigi more safely

1. Check that your phone is carrier-unlocked before buying, since a locked phone gets no refund.
2. Scan the QR code only when you are sure of your trip.
3. Use a long, unique password for your Ubigi account.
4. Turn on a VPN or encrypted DNS if you do not want an operator to log which sites you reach.
5. Refuse tracking when the iPhone prompt appears.

How we scored it

Regulatory record (86) is the strongest factor, with no fine, order or investigation found. Privacy (50) is the weakest, because Google Play lists location and device IDs shared with other companies and the policy keeps traffic data for ten years. Security (62) reflects a clean record but no bug bounty, no company certification and password-only login. For an eSIM with fewer shared data types, see Saily.