Privacy Policy

This Privacy Policy (the "Policy") describes how JEDI International Co., Ltd. (杰達國際有限公司), the operating entity of the mosimoSIM brand ("the Service", "we", "us"), collects, processes, uses, and protects your personal information when you use our website, application, and related services.

The Service is designed to provide Japanese mobile phone numbers to users living abroad. By using the Service, you agree to this Policy.

To provide the Service, we collect the following categories of personal information:

• Account Information: email address, display name, preferred language, login history (IP address, user agent).

• Contact Information: mobile phone number, country code (verified via SMS OTP).

• KYC Documents (Voice plans): passport and ID photos stored in encrypted Supabase Storage, accessible only to authorized review admins.

• Order and Payment Information: subscription plan, SIM type, shipping address, payment records (processed via NewebPay — we do not store card numbers).

• Usage Records: voice and SMS consumption (required for monthly billing), subscription status changes.

• Referral Relationships: when you sign up via a referral link, we record the relationship for commission calculation.

We use the collected information for the following purposes:

• Providing and maintaining phone number services (activation, billing, notifications).

• Performing identity verification (KYC, required by Japanese regulations for Voice plans).

• Processing payments, generating monthly invoices, sending notification emails.

• Preventing fraud and protecting account security.

• Improving product and service quality.

• Complying with legal obligations (e.g., the Basic Trading Agreement).

• Account data: retained until 30 days after account deletion request.

• KYC identity documents: retained for at least 3 years as required by Japanese telecom law.

• Order and payment records: retained for 7 years per tax regulations.

• Call/SMS usage records: retained for 12 months.

• Email delivery logs: retained for 6 months for debugging and compliance audit.

We do not sell your personal information. We may share data with third parties only in the following cases:

• Service Providers: upstream telecom carriers (for activation), NewebPay (payment processing), Supabase (database and authentication), Resend (email delivery), LINE (social login).

• Analytics & Marketing Tools: Google Tag Manager, Google Analytics, Microsoft Clarity, etc. These tools collect anonymized / hashed browsing data to help us improve the service. You can choose whether to allow them via the Cookie consent banner.

• Legal Requirements: in response to lawful requests from judicial or regulatory authorities.

• Upstream Carrier Disclosure Requests: when the Japanese upstream carrier (including regulatory authorities) requires disclosure of your identity or usage data due to abuse, investigation, or legal proceedings, we will provide such information in accordance with regulations.

• Business Transfers: in the event of a merger, acquisition, or asset transfer, your data may be transferred, subject to this Policy.

You have the following rights regarding your personal information:

• Right to access or inspect.

• Right to obtain copies.

• Right to correction or supplementation.

• Right to request cessation of collection, processing, or use.

• Right to deletion (subject to legal retention requirements).

To exercise these rights, please contact us via the channel below.

We use cookies for the following purposes:

• Essential cookies: login state, language preferences, referral code tracking, checkout flow memory, etc.

• Analytics cookies (with consent): loaded via Google Tag Manager — Google Analytics, Microsoft Clarity, etc. — to record page views, click heatmaps, and time on site to help us improve.

We use Google Consent Mode v2, defaulting to 'denied'. Analytics cookies are only enabled after you click 'Accept' on the Cookie banner. You can clear cookies in your browser settings to make a new choice anytime.

We implement reasonable technical and administrative measures to protect your data: TLS/HTTPS encrypted transport, hashed password storage, encrypted KYC document storage in private buckets, tiered admin access control, and regular backups. However, no internet service can guarantee absolute security.

The Service is not intended for users under 18 years of age. If we discover that a minor has registered without parental consent, we will delete the associated account and data.

We reserve the right to modify this Policy at any time. Material changes will be announced on our website or by email. Continued use of the Service after changes take effect constitutes acceptance of the new version.