Subprocessors & Cross-Border Processing
Last updated: August 6, 2026
PANAM eSIM and Travel AI Rescue use external providers for eSIM issuance, payments, authentication, AI processing, cloud, email, and safety measures. The table below shows each provider's name, service, the information it handles, the country or region of processing, retention, and whether the data is used for general-purpose AI training. We review our subprocessors' contracts, security management, retention, deletion, and sub-outsourcing.
Subprocessor list
| Provider | Role | Information handled | Processing country / region | Retention | General AI training |
|---|---|---|---|---|---|
| SoftBay Co., Ltd. | eSIM platform (issuance, status, usage) | Encrypted identity information (name, nationality, contact, date of birth, and, where required, images of a passport or ID), orders, eSIM identifiers | Japan and others | Per the provider's policy | Not applicable |
| PAY, Inc. (Pay.jp) | Card payments (JPY), refunds, fraud measures | Card token, amount, order ID | Japan | Per the provider's policy | Not applicable |
| Stripe, Inc. | Card payments (USD), refunds, chargebacks | Email address, order ID, amount, dispute materials | United States | Per the provider's policy | Not applicable |
| OpenAI, L.L.C. | AI answers, image understanding, translation, web search, text-to-speech | Your consultation text, images you selected (with location data and EXIF removed), the destination, device, and product information needed for an answer, and recent conversation | United States | Configured so OpenAI does not retain data sent via the API (store:false). May be retained for up to about 30 days for misuse monitoring | Not used |
| Resend, Inc. | Transactional email delivery (orders, important notices) | Recipient email address, subject, body, attachments (receipts, QR codes) | United States | Per the provider's policy | Not applicable |
| Google LLC | External login (optional), usage statistics (after consent) | OAuth credentials / browsing statistics (IP anonymized) | United States | Per the provider's policy | Not applicable |
| Microsoft Corporation (Clarity) | Usage analytics (after consent, excluding sensitive screens) | Interaction and screen statistics (AI consultations, health, itinerary, and passport information are not sent) | United States | Per the provider's policy | Not applicable |
| Cloudflare, Inc. | Hosting, edge, database, short-term file storage, jobs, bot protection, cloud-backup area | Application data (at rest), traffic, and IP. Cloud backup holds encrypted data only (we cannot decrypt it either) | Global edge | Follows our retention policy (retention periods) | Not applicable |
Processing countries and regions are the primary ones; depending on a provider's configuration, other regions may be involved. We do not use a dedicated external error-monitoring service (platform logs only). We do not use SMS, a dedicated identity-verification (KYC) provider, or a maps API.
Scope of what we send to AI providers
We do not automatically send an entire order or on-device information to AI providers. To the extent needed for an answer, we may send the consultation you entered, the photos you selected, the destination, trip dates, device, and product information needed for the answer, and the immediately preceding conversation with any necessary summary. Where possible, we avoid sending your name, email address, order number, passport number, card number, detailed hotel address, or precise location. We do not include personally identifying information in web-search queries.
Handling in foreign countries
When personal data is handled in a foreign country, we review that country or region's framework and our subprocessor's security management, contract, sub-outsourcing, retention, and deletion. Where consent is required, we request it after providing the information required by law.
Changes
When we make a change with a significant impact on users — such as using a new provider, changing a processing country, extending a retention period, or changing an AI-training setting — we will, where appropriate, provide notice before it takes effect and request consent.
Contact
Please use our contact form (Jag Project, LLC, PANAM TravelSIM division). See also our Privacy Policy and cookies and external transmissions list.