Skip to content
PRIVACY POLICY

Privacy Policy

Last updated: October 24, 2026

So that you can use overseas eSIM data plans with peace of mind, Bloomy eSIM (the “Service”) establishes the following regarding the handling of personal information.

Article 1 (Basic policy)

The Service handles your personal information appropriately and complies with the laws, guidelines, and other applicable standards relating to the protection of personal information.

The Service strives to clearly explain, as far as possible, the information it collects, the purposes of use, third-party provision, integration with external services, security measures, your rights, and the like.

Article 2 (Information we collect)

For service provision, order management, payment confirmation, eSIM issuance, My Page features, support, fraud prevention, service improvement, and the like, the Service may collect the following information:

  1. Your name, email address, login information, and other information you enter when contacting us
  2. Order information such as the eSIM plan purchased, destination, planned countries/regions, period of use, order date and time, order number, payment status, and purchase amount
  3. Information needed to issue the eSIM and provide the QR code, activation information, SM-DP+ address, APN information, and other setup details
  4. Information shown on My Page, such as purchase history, eSIM information, remaining data, expiry, additional purchases, and top-ups
  5. Information needed for support, such as inquiry content, support history, screenshots of error or settings screens, device name, and country/region of use
  6. Technical information such as IP address, browser information, device information, OS information, access date and time, pages viewed, cookies, advertising identifiers, and analytics information
  7. Information needed for fraudulent-order, fraudulent-payment, impersonation, and chargeback prevention, security measures, and service improvement
  8. Information you provide voluntarily, such as surveys, feedback, reviews, your travel purpose, planned use, and use case
  9. Information notified to the Service by the payment provider (PayPal), such as the payer’s name, email address, country or region, payment status, and the amount of the payment fee
  10. Information on how you first arrived at the Service (the URL of the previous page, the medium, source, and campaign identifiers attached to the link, ad click IDs, the first page opened, and the date and time). When you make a purchase, a copy is recorded with the order. This is stored only if you have agreed to “analytics cookies” (nothing is stored before you agree)
  11. Records of the stages leading up to a purchase (only for visitors who have agreed to “analytics cookies”): a visitor ID; the stage reached (viewed a product, pressed the purchase button, logged in, proceeded to payment, completed payment, eSIM issued, and the like) and its date and time; the product, number of days, amount, currency, and language; the type of device and browser; the order number; the referral code; and, if logged in, a number that identifies the member

Article 3 (Purposes of use)

The Service uses the collected information for the following purposes:

  1. To accept orders for eSIM data plans, verify identity, confirm payment, and provide products
  2. To send QR codes, activation information, order confirmation emails, setup guidance, important notices, and the like
  3. To provide and operate features such as My Page, order history, eSIM information, remaining data, expiry, top-ups, additional purchases, and resending
  4. To provide support, including inquiries, connection troubles, setup support, order confirmation, and refunds
  5. To handle eSIM issuance, usage confirmation, remaining-data checks, top-ups, additional purchases, resending, and various procedures
  6. To prevent, investigate, and respond to fraudulent orders, fraudulent payments, impersonation, chargebacks, abusive behavior, and security issues
  7. To improve the site display, purchase flow, plan display, search, support structure, email delivery, My Page features, and the like
  8. To analyze your usage trends and use them for clearer recommendations, plan improvements, support improvements, and marketing measures
  9. To deliver, by email, LINE, or other means, important notices about the Service, support information, campaigns, and related service information
  10. To respond to requests from laws and regulations, terms, payment providers, communication-service providers, government agencies, courts, and other public bodies
  11. To handle disputes, troubles, fraudulent use, infringement of rights, breaches of terms, and other necessary matters
  12. To tally how visitors arrived and at which stage before purchase they most often leave, in order to improve the site, the purchase flow, and our guidance, and to measure the effect of advertising and referrals
  13. To compile records of purchases and usage (such as the amount of data used and the time it takes to deliver an eSIM) into statistics that do not identify any individual, and to publish them in articles and guides on this site (we do not publish any group so small that an individual could be inferred)

Article 4 (Handling of payment information)

The Service uses external payment services such as PayPal for payment processing.

Payment information such as credit card numbers, expiry dates, and security codes is processed on the secure payment system of the payment provider, and the Service does not directly collect or store card numbers and the like.

For order management, refunds, fraud prevention, accounting, and support, the Service may confirm and store payment status, payment date and time, amount paid, order identifiers, payment identifiers, and the like to the extent necessary.

Saved payment methods

If you save a payment method or use auto top-up, VPN auto-renewal, or the like, card details and other payment-method information are stored by the payment provider (PayPal or the like). The Service never obtains or holds your card number itself.

Article 5 (Sharing with external services)

The Service passes your information to external companies only in the cases below. We list only what is actually passed.

  • To take payment — we pass the order number, product name, amount, and currency to PayPal. We do not pass your name or email address to PayPal. Card numbers and PayPal account details are entered on PayPal’s own screen, and we never receive them. To confirm the payment, PayPal notifies us of the payer’s name, email address, country or region, payment status, and fee amount.
  • To deliver email — we pass the recipient address and the body of the email to Postmark. This covers order confirmations, eSIM setup details, data-remaining notices, and replies to your enquiries.
  • For access analytics — when a purchase is completed (only for visitors who have agreed to “analytics cookies”), our server sends Google the order number, amount, currency, product, type of payment method, purchase-count category (first purchase / repeat), and first source of the visit. If you are logged in, we also send a code that contains no name or email address and cannot be reversed to the original number. The same is sent when a refund is made. For purchases by visitors who have not agreed to “analytics cookies”, we send only the order number, amount and currency, with a single-use code that applies to that order only (we do not send the product, payment method, source of the visit or the logged-in code, and we do not send information about your device or your IP address).

Information sent directly from your device to external parties is described in Article 9-2.

We do not pass your information to the following.

  • Our eSIM supplier — when issuing an eSIM, we send only a transaction number and a product number. We do not send your name, email address, or payment information.
  • Comparison sites and other listing partners — we provide our plan catalogue only; it contains no customer information.
  • Referral partners — as referral results, the order number, date, amount, and product name are shown. Your name and email address are not shown.

Article 6 (Processing and storage outside Japan)

For payment processing, eSIM issuance, email delivery, access analytics, server operation, authentication, security measures, and the like, the Service may use services of businesses located outside Japan.

In this case, your information may be processed or stored outside Japan. When using external services, the Service handles information to the extent necessary to provide the Service and strives to ensure appropriate management as far as possible.

Article 7 (Provision to third parties)

Except in the following cases, the Service does not provide your personal information to third parties without your consent:

  1. When you have consented
  2. When entrusting or sharing with external businesses to the extent necessary for service provision, payment processing, eSIM issuance, email delivery, support, and the like
  3. When disclosure is required by law
  4. When it is necessary to respond to fraudulent use, fraudulent payment, fraud, chargebacks, impersonation, or security issues
  5. When necessary to protect a person’s life, body, or property
  6. When a legitimate request is received from a public body, court, government agency, payment provider, communication-service provider, or the like
  7. When transferring information to the extent necessary due to a business transfer, merger, company split, business succession, or other business reasons

Article 8 (Use of cookies, etc.)

To improve site convenience, maintain login status, analyze access, prevent fraudulent use, measure ad effectiveness, improve the purchase flow, optimize displayed content, and the like, the Service may use cookies, similar technologies, analytics tools, ad-measurement tools, and the like.

If you do not wish to allow cookies, you can disable them in your browser settings. However, if you disable cookies, some features such as login, purchase, My Page, payment, and display optimization may not work properly.

Referral and partner measurement cookies

When you visit via a partner referral link, we store a cookie identifying the referrer and record purchases within its validity period as referral results. This cookie is valid for 24 hours in principle, or up to 30 days under specific partner agreements.

Display preferences

We may use cookies to adjust what is displayed based on, for example, purchase history or language settings. You can delete or block cookies in your browser settings, though some features may stop working.

Article 9 (Access analytics and ad measurement)

For service improvement, ad-effectiveness measurement, understanding site usage, improving the purchase flow, and the like, the Service may use Google Analytics and other analytics tools and ad-measurement tools.

These tools may use cookies and the like to collect access information in a form that does not directly identify individuals. For the information collected, purposes of use, opt-out methods, and the like, please review the terms and privacy policies of each external service.

Recording how you arrived (Google Analytics)

Only if you have agreed to “analytics cookies”, we send Google your first source of arrival (type of medium, referrer, and first page opened) as a user attribute in Google Analytics. If you have not agreed, it is not sent.

Transmission from our server when a purchase is completed

When a purchase is completed, our server — not your device — sends the details of the purchase (described in Article 5) to Google Analytics. For purchases by visitors who have not agreed to “analytics cookies”, only the order number, amount and currency are sent (Article 5). In that case too, nothing is sent from your device to Google, and nothing that identifies you is included.

Transmission from our server when a payment is not completed

If a payment is not completed (a failed payment or an expired checkout), our server sends the following to Google Analytics: the stage and type of reason (such as the payment provider's error code), payment method, currency, amount, plan, and device type (smartphone, tablet or computer). This applies only if you have consented to "analytics cookies". If you have not consented, nothing is sent. We never send your name, email address or card details.

Records of the stages leading up to a purchase (kept by us)

Only if you have agreed to “analytics cookies”, we save a visitor ID (bloomy_vid) on your device and record the stages leading up to a purchase (described in Article 2) in our database. This is the same when you pay with PayPal. This record is used to see at which stage visitors most often leave, and is not sent externally. If you are logged in as a member, the visitor ID is recorded linked to your member ID. Within our systems, it may also be matched with order records. If you have not agreed, nothing is recorded.

Article 9-2 (Information sent from your device to external parties)

When you view pages of the Service, some information is sent directly from your device to companies other than us. As of October 17, 2026, the recipients and the content actually being sent are as follows.

Google LLC (Google Analytics 4 / Google Tag Manager)

  • Recipient: www.google-analytics.com / www.googletagmanager.com
  • Information sent: the URL of the page you are viewing, the page title, the referrer, your browser language setting, screen size, browser and device information, IP address, an identifier assigned per browser, and your consent status
  • Purpose of use: understanding how the site is used, and improving the Service
  • How to stop it: you can change this at any time from "Cookie settings" on the page. By default, cookies for analytics are not stored. You can also stop it with the opt-out browser add-on provided by Google.

The Google Analytics tag also loads before you consent to "analytics cookies", or if you do not consent. In that case, no cookies are stored and no per-browser identifier is used. Only the following is sent: that a page was opened or an interaction occurred, your consent status, the page URL and referrer, and browser and device information (Google "Consent Mode"). Ad click identifiers are removed before sending.

Google LLC (Google Fonts) — Chinese (Simplified / Traditional) pages only

  • Recipient: fonts.googleapis.com / fonts.gstatic.com
  • Information sent: IP address, browser and device information, and the referrer (the URL of the page you are viewing)
  • Purpose of use: to display Chinese text in a Chinese typeface when your device does not have one
  • How to stop it: no cookies are used. If you block external fonts in your browser settings, your device's own fonts are used.

Based on our measurement of the public pages on October 17, 2026, there were no recipients other than the above to which information is sent automatically from your device. Flag images have been delivered from our own servers since September 8, 2026 (previously we used an external image delivery service).

Payment procedures take place on the screens of our payment provider (Article 4).

We re-measure the actual communications periodically and update this list.

Article 9-3 (Information we store on your device)

For display and functionality, the Service stores information on your device. All of it is stored by us and is not sent to any external company (information sent to external parties is described in Article 9-2). The following reflects what we confirmed on September 11, 2026, in both the code and an actual browser.

1. To remember your display choices

  • bloomy_currency (365 days) — the currency you chose to display
  • bloomy_lang (30 days) — the language you chose to display
  • bloomyLangSeen (until deleted) — whether you have already seen the language notice
  • bloomyAcctTabSwitch (until you close your browser) — prevents flicker when you switch tabs in My Page
  • bloomy_vpn_favs (until deleted) — the countries you marked as favourites in Bloomy VPN
  • bp_lang (1 year) — the language of the referral partner screens (partners only)

2. So we do not show you the same notice again

These remember that you closed a notice. Only the fact that it was closed is stored.

  • bloomy_promo_dismissed / bloomy_atpromo_dismissed_… — when you close a campaign notice
  • bloomyStatusDismiss — when you close a service-status notice
  • bloomy_dataused_dismissed_… / bloomy_ach_modal_… / bloomy_armed_bar_… — when you close a notice in My Page
  • bloomy_bubble_done — so the AI support bubble does not repeat on the same visit
  • bloomy_topup_celebrate / bloomy_acct_refresh_toast — to show a message once after a top-up or a usage refresh
  • bloomy_pk_propose_dismissed_v2 (until deleted) / bloomy_pk_propose_session_v2 (until you close your browser) — when you close the passkey suggestion

Items ending in "…" are stored separately per notice. Unless stated otherwise, these last until you close your browser.

3. To record how you reached us

  • bloomy_ft (90 days) ── how you first arrived at the Service (the URL of the previous page, identifiers attached to the link, ad click IDs, the first page opened, and the date and time). It is stored only if you have agreed to “analytics cookies” (nothing is stored before you agree) and is deleted if you withdraw your consent. When it is stored and you make a purchase, a copy is recorded with the order. It is sent to Google only if you have agreed (Article 9)
  • bloomy_ai (30 days) ── a mark that you arrived through the AI support guidance or an external AI service
  • bloomy_ga4_ft (until deleted) ── created only if you have agreed to “analytics cookies”, to keep a copy of how your arrival was classified
  • bloomy_ref (30 days) — if you arrived through a referral link, which partner referred you
  • bloomy_disc (30 days) — if that referral carries a discount, the details of the discount
  • bloomy_pc_usd (until you close your browser) — if you arrived from a referral card, to switch the initial currency once

bloomy_ref, bloomy_disc and bloomy_pc_usd are stored only if you arrive through a referral link or card.

4. To recognise the same device

  • bloomy_vid (365 days) ── a number that distinguishes this device. If you are logged in as a member, we record it linked to your member ID within our systems. We do not send it externally linked to your name or contact details. Within our systems, it may also be matched with order records (Article 9). It is stored only if you have agreed to “analytics cookies”, and is deleted if you withdraw your consent.
  • bloomy_customer (1 year) — whether you have purchased before, so we do not show first-time guidance to existing customers
  • bloomy_ga4_purchase_… (until deleted) — so the same purchase is not counted twice

5. For login and security

  • bloomy_cookie_consent_v1 (until deleted) — your cookie choices themselves
  • bloomy_chat_sid (until you close your browser) — keeps your conversation with AI support connected while you stay on the site
  • bloomy_ml_rk (15 minutes) — when you use an email login link
  • bloomy_oauth_state / bloomy_oauth_return (10 minutes each) — for the round trip of signing in with Google and returning you to the page you came from
  • bloomy_pk_creds_v1 (until deleted) / bloomy_pk_hint_v1 (180 days) — so you can sign in quickly next time on a device where you use a passkey. The passkey itself and its private key are not stored here (they are kept inside your device)

6. About our operational screens

Only if you open a screen we use to operate the business (such as BLOOM HQ) do we store that screen's display settings on your device (abTab / hqTheme / hqMask / sushiTab / bloomy_chat_dev / bloomy_internal). These are never stored during ordinary use of the Service.

When the operator opens the admin screens on a device, we store a marker (bloomy_internal) on that device indicating operator access, and exclude it from analytics totals. It is never stored on customers' devices.

Deleting or refusing, and what changes

You can delete or refuse all of the above in your browser settings. You can also change analytics cookies at any time from the cookie settings on the page (by default they are not stored). If you refuse them, the following changes:

  • Your currency and language choices are not remembered, and the default display returns on your next visit
  • Notices you have already closed will appear again
  • If you arrive through a referral link, the referral and any discount are not recorded
  • Your conversation with AI support starts over each time you move to another page
  • If you refuse the items used for signing in, login may not complete

We do not store anything for advertising purposes. If the above changes, we will update this article.

Article 10 (Contact by email, LINE, etc.)

The Service may send order confirmations, eSIM setup details, important notices, support responses, payment confirmations, usage-status guidance, and the like by email, LINE, My Page, or other methods designated by the Service.

In addition, with your consent or to the extent permitted by law, the Service may deliver campaigns, service improvements, related services, and information related to living abroad and studying abroad.

For communications that can be stopped, you can opt out using the method designated by the Service. However, communications necessary for service provision—such as order confirmations, payments, eSIM issuance, important notices, changes to terms, security, and support—may still be sent after you opt out.

Article 11 (Information management)

The Service takes reasonable security measures to prevent unauthorized access, loss, destruction, alteration, leakage, and misuse of the personal information it collects.

When using external services, the Service shares information to the extent necessary for service provision and strives to ensure appropriate management as far as possible.

However, due to the nature of Internet communication, external services, user devices, email-receiving environments, and the like, complete security of information cannot be guaranteed.

Passkeys (biometric sign-in)

If you sign in with a passkey, biometric data such as your fingerprint or face is processed only on your device and is never sent to or stored by the Service. We store only the public key used for authentication.

Push notifications

If you enable browser push notifications, we store the subscription data needed to send them. You can unsubscribe at any time in your browser or device settings.

Article 12 (Retention period)

The Service retains the collected information for the period necessary for service provision, order management, inquiry handling, payment confirmation, accounting, legal compliance, fraud prevention, dispute handling, and improving support quality.

For information that no longer needs to be retained, the Service strives to delete or anonymize it by reasonable means.

However, for information that needs to be retained for a certain period for laws, accounting, fraud prevention, dispute handling, order-history management, support, and the like, the Service may continue to retain it to the extent necessary.

Server access logs (IP address, date and time, pages viewed, browser type, etc.) are deleted approximately three months after they are collected. However, to the extent necessary for legal proceedings, they are retained for the duration of those proceedings.

Records of the stages leading up to a purchase (including the visitor ID) are deleted, as a guide, 180 days after they are recorded.

Article 13 (Your rights)

Regarding your own personal information held by the Service, you may request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, suspension of provision to third parties, and the like.

If you wish to make a request, please contact the inquiry channel designated by the Service. After verifying your identity, the Service will respond within a reasonable scope in accordance with law.

Depending on the content of your request, we may ask you to submit additional information for identity verification. Also, for information necessary for order management, accounting, legal compliance, fraud prevention, dispute handling, and service operation, we may not be able to delete or suspend its use immediately.

Article 14 (Use by minors)

If you are a minor, please use the Service only after obtaining the consent of a parent or legal guardian.

If a minor uses the Service, it is deemed that they did so with the consent of a parent or legal guardian.

Article 15 (Surveys and feedback)

For service improvement, plan improvement, improving recommendations, enhancing the support structure, and the like, the Service may ask for your voluntary cooperation with surveys, reviews, feedback, and the like.

These responses are voluntary, and not responding will not result in any disadvantage in using the Service.

The Service may analyze and use survey results and feedback in a form that does not directly identify individuals.

Article 16 (Changes to this privacy policy)

The Service may revise this privacy policy in response to changes in laws, service content, the external services used, operating policy, and the like.

The revised content applies from the time it is posted on this site or from a time otherwise specified by the Service. In the event of material changes, we will notify you by posting on the site or by other appropriate means.

Article 17 (Contact)

For inquiries regarding the handling of personal information, please contact us through the channels below.

Operator
BLOOM CONSULTING
Privacy inquiry desk
Bloomy eSIM Support
Contact
Contact form
Contact
Please contact us via our contact form.

This page shows the above information as the contact point regarding personal-information protection. For the disclosure under the Specified Commercial Transactions Act and other legally required business information, please see the separate “Legal Notice (Specified Commercial Transactions Act)” page.

Back to home