Privacy Policy
Last updated October 8, 2026
1. Who is responsible for your data
Privasee VPN is the controller of the personal data described in this policy. Contact: [CONTACT ADDRESS - see note].2. What we do not collect
We do not record, and are therefore unable to produce:- the contents of your network traffic;
- the websites, services or IP addresses you connect to through the Service;
- your DNS queries;
- your browsing history, search history, or any profile of your activity; and
- any behavioural advertising data. We do not sell, rent or share personal data with advertisers, data brokers or analytics networks.
3. What we do collect
3.1 Account data
Your email address; a cryptographic hash of your password (never the password itself); your account status and plan; if you enable it, a two-factor authentication secret, held encrypted; and the date, time and IP address of your most recent sign-in to the website. We retain the sign-in address for the life of the account, to detect account compromise.We ask for an email address because it is how we deliver account recovery, expiry notices and security notifications. We do not require your legal name, postal address or telephone number, and you should not send them to us.
3.2 Device data
For each device you register: a name you choose, a certificate issued to that device, and an identifier derived from the device, used to enforce the device limit of your plan.3.3 Connection records
When a device connects, we record: which of our servers it connected to; the certificate name used; the internal address assigned inside the tunnel; the time the session started and ended and its duration; and the number of bytes sent and received. This exists to enforce plan limits, to show you your own active sessions, and to operate the network. It does not describe what you did.Source address. A connection record also contains the public IP address your device connected from, together with the source port. We hold a salted cryptographic hash of that address; the address also appears in the session identifier used to match a disconnection to its connection. Both are removed when the record is deleted under the retention schedule in clause 5. We do not store the source address anywhere else, and we do not associate it with any destination. You can utilize Tor to connect to our service, so that we only see a Tor exit node instead of your IP read here on how it works
3.4 Payment data
We record which payment method was used, the amount, the currency, the status, and a reference issued by the payment processor. We never receive or store your card number.Card payments are processed by Stripe, who act as an independent controller of the data you provide to them. Cryptocurrency payments are processed through BTCPay, which does not require you to provide personal data to us; if you wish to minimise the personal data attached to your account, this is the method to choose.
3.5 Diagnostic reports
The client applications include a “send to developers” function. It transmits nothing unless you press it. When you do, it sends the application log, your account email, the device name, the platform and the application and operating system version, together with any note you write. The log and the note are stored encrypted. Application logs describe the state of the VPN connection; they are not a record of your browsing.3.6 Administrative and server logs
We keep an audit record of administrative actions taken on an account, including the IP address from which the action was taken. Our VPN servers keep operational logs of the VPN daemon, which record connection and disconnection events, including the source address of the connecting device. These are rotated and overwritten on the servers and are not aggregated into any profile.4. Why we are permitted to process it (UK/EU GDPR)
- Performance of a contract — account data, device data, connection records and payment records: without these we cannot provide the Service or enforce the limits of your plan.
- Legitimate interests — sign-in addresses, audit records and server logs, for the security and integrity of the Service. We have assessed that this does not override your rights, because the data is minimal, retained briefly, and never used to profile you.
- Consent — diagnostic reports, which are sent only when you press the button, and which you may withdraw by not sending them.
- Legal obligation — retention of payment and tax records.
5. How long we keep it
| Data | Retention |
|---|---|
| Connection records (including the source address and its hash) | A short, operator-configured period, 7 days by default, after the session ends. Then deleted automatically. |
| Server performance metrics | 4days by default |
| Administrative audit records | 365 days |
| VPN server operational logs | Rotated on the server; a small number of rotations are kept |
| Account data, including last sign-in address | For the life of the account |
| Payment records | As long as tax and accounting law requires, typically several years |
| Diagnostic reports | Until resolved and no longer needed |
6. Who we share it with
We do not sell your personal data. We do not share it:- Payment processors (Stripe, pay with Monero for ultimate security) to take payment;
7. Law enforcement requests- haha fuck that
We disclose data only where we are presented with legal process that is valid and binding on us in our jurisdiction. We assess each request, and refuse those that are defective, overbroad, or not binding on us.What we can disclose is bounded by clause 2: we hold no record of your traffic, destinations or DNS queries, so no order can compel us to produce them. Where we are legally permitted to do so, we will make reasonable efforts to notify an affected Subscriber before disclosure.
8. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you; to have it corrected; to have it erased; to restrict or object to its processing; to receive it in a portable format; and to withdraw consent where processing is based on consent. If you are in California, you additionally have the right to know what is collected and to whom it is disclosed, the right to delete, and the right not to be discriminated against for exercising those rights — noting that we do not sell or share personal information as those terms are defined under the CCPA.To exercise any right, write to info@privasee.org. We will respond within the period required by applicable law. You may also close your account at any time from your dashboard, which revokes every device certificate immediately. If you believe we have handled your data unlawfully, you may complain to your local supervisory authority.