PAMMO — SUB-PROCESSOR LIST

Version 1 — Publication-Ready Pending Final Review Last Updated: 2026-05-18 Effective Date: 15 June 2026

This Sub-Processor List names the third parties that AEDOWON CO., LTD and AEDOWON SINGAPORE PTE. LTD. (UEN 202612161D) (together, "Pammo") engage to process personal data on its behalf. It is published in compliance with our Privacy Notice §4.1, our Data Processing Addendum §7, and Main T&C §12.

Sub-Processor Change Policy

We provide at least 30 days' prior notice before engaging any new material Sub-Processor or replacing an existing material Sub-Processor with one in a different jurisdiction. Notice is given via:

• Update to this list (with "Last Updated" date)
• Email to the billing-contact on record
• In-app banner

You may object to such change on reasonable grounds within the 30-day notice period (per Main T&C §12.2A(d) + DPA §7); if we cannot accommodate the objection, either party may terminate the affected portion of the Service with refund of unused prepaid fees.

1. AI MODEL PROVIDERS

These Sub-Processors process your Input to generate AI Output and may process small amounts of metadata for safety, abuse monitoring, and rate-limiting.

Where your Input goes, in order. Your Input reaches OpenRouter on every AI request, and OpenRouter forwards it to whichever provider above serves that request. A text chat turn goes to DeepSeek; a turn with an attached image goes to a vision model. No AI request bypasses OpenRouter.

Note on the DeepSeek transfer. DeepSeek is the only AI provider in this list processing outside the US/EEA. It is engaged through OpenRouter rather than directly. If your organisation cannot accept this transfer, contact us — routing text inference to a US-hosted model is possible at different pricing.

Note on AI training. Each provider above offers an "opt-out of training" tier for Pammo's API usage, and Pammo subscribes to it, so your Input and Output are not used to train upstream AI models. Separately, Pammo does not use your Input or Output to improve its own AI unless you have consented in Account → Privacy → AI Training, which is off by default.

2. PAYMENT PROCESSORS — DUAL-ENTITY ROUTING

These Sub-Processors handle payment authorization, settlement, chargeback management, and payouts. See also Pammo-Payment-Processor-Partners-V1.

2.1 TH Route (Omise — AEDOWON CO., LTD)

2.2 International Route (Polar.sh — AEDOWON SINGAPORE PTE. LTD.)

2.3 Affiliate / Creator Payouts

3. HOSTING / INFRASTRUCTURE

4. EMAIL / COMMUNICATION

Note on marketing email. Pammo composes and schedules marketing emails in-house (first-party system on Supabase + Vercel) and uses Resend as the email delivery transport. No third-party marketing-automation platform (Customer.io / Mailchimp / Loops / etc.) is engaged at launch.

Note on internal operational alerting (Discord). Pammo posts automated engineering health reports to a private Discord, Inc. channel — AI spend against the monthly ceiling, error counts by category, and job success rates. These carry aggregate counts and cost figures only, and no Customer Data: no message text, no listing contents, no contact details, no personal identifiers. Discord is listed here for completeness of disclosure rather than because Customer Data reaches it; if that ever changes it becomes a Sub-Processor under §Change Policy and requires 30 days' notice. (An earlier nightly job did send encrypted conversation transcripts to this channel; it was removed in full and replaced with a counts-only report that does not query message content.)

5. ANALYTICS

Note on product analytics. Pammo operates product analytics (event tracking, funnel, retention) in-house as a first-party system on Supabase (database) and Vercel (application hosting) listed in §3. No third-party product-analytics Sub-Processor (PostHog / Mixpanel / Amplitude / Google Analytics) is engaged at launch.

6. ADVERTISING NETWORKS (PER-USER OPT-IN ONLY)

These Sub-Processors receive your behavioral / inferred-preference data only where you have affirmatively opted in per network via Main T&C §13B and our Cookie Notice §2.3.

7. IDENTITY VERIFICATION / KYC (CREATOR PROGRAM)

At launch, no third-party KYC vendor is engaged. Creator NID / passport verification is performed by manual review by Pammo personnel (acting as authorized agents of the contracting Pammo entity per Pammo-Privacy-Notice-V1 §1 and Pammo-Data-Processing-Addendum-V1 §6). Submitted NID / passport images are stored in our Supabase-managed file storage (§3) and accessed only by authorized personnel for identity verification, anti-fraud, and tax-residency confirmation as disclosed in Pammo-Creator-Program-Terms-V1 §11.

Where Pammo later engages a third-party KYC vendor (e.g., Sumsub, Onfido, Persona, Veriff, Jumio, IDNow, NDID), this section will be updated and the 30-day Sub-Processor change notice in the introduction above will apply.

8. SANCTIONS / RESTRICTED-PARTIES SCREENING

At launch, no dedicated sanctions-screening vendor is engaged. Sanctions screening (OFAC SDN, UN Consolidated List, EU Sanctions Map, UK OFSI, Thailand AMLO, MAS Singapore) is performed via the built-in sanctions / fraud screening of our payment providers (Omise for TH Route; Polar for International Route; Currenxie / Wise / PayPal on payout rails), each of which performs screening on relevant payment counterparties as a regulatory obligation of its own licenses.

Pammo additionally retains discretion to perform manual screening at Affiliate / Creator approval per the eligibility criteria in Main T&C §3 and the Program Rules §10.

Where Pammo later engages a dedicated sanctions-screening vendor (e.g., ComplyAdvantage, Refinitiv World-Check, sanctions.io), this section will be updated and the 30-day Sub-Processor change notice will apply.

9. CUSTOMER SUPPORT / HELPDESK

Customer support is delivered through Pammo's in-house support team (LINE OA + email) and an AI chatbot operated by Pammo internally. Support conversations, ticket metadata, and chat content remain under Pammo's joint-controllership and within the protections of our Privacy Notice and Data Processing Addendum.

Where support escalation requires email correspondence (e.g., billing disputes, legal notices, DPO requests, Affiliate / Creator disputes), the email Sub-Processors listed in §4 above are used.

10. PROPERTY-DISCOVERY DATA SOURCES (FIRST-PARTY INFRASTRUCTURE; NOT SUB-PROCESSORS)

Pammo's Property Discovery module aggregates publicly-available real-estate-portal data on the User's instruction. The infrastructure used to perform this aggregation runs on Pammo's own Supabase + Vercel stack (§3) and does not engage a third-party scraping-as-a-service vendor at launch. Data sources include publicly-accessible Thai real-estate portals, with respect for source-side terms of service per Main T&C §10.2(f).

Where a third-party scraping-infrastructure vendor is later engaged, this list will be updated under the 30-day notice mechanism.

11. ADVERTISING-PLATFORM INTEGRATIONS (USER-INITIATED OUTBOUND)

When you instruct Pammo to publish or push Output to an external advertising platform, that platform processes your Input / Output and audience data as a separate controller per your instruction. These are not Sub-Processors of Pammo but recipients to whom you direct disclosure:

• Meta Business (Facebook / Instagram Ads Manager)
• Google Ads / Google Business Manager
• TikTok Ads Manager
• LINE Official Account Manager / LINE Ads Platform
• DDproperty / Hipflat / Baania / Estopolis (where outbound listing-sync is enabled by the User)

For data Pammo sends on your behalf at your instruction, the receiving platform's privacy policy governs subsequent processing.

12. RECORD OF CHANGES

CONTACT

DPO: dpo@pammo.co Sub-Processor Objections: dpo@pammo.co (recommended subject line: "Sub-Processor Objection" plus the relevant provider name)

END OF PAMMO SUB-PROCESSOR LIST — V1 (PUBLICATION-READY PENDING FINAL REVIEW) Last Updated: 2026-05-18