XConnect
Documents

XConnect VPN Privacy Policy

How XConnect VPN processes, stores, and protects users' personal data.

Related Documents

This Policy applies together with the Terms of Service, the Payments and Refunds page, and the Account Deletion procedure.

1. General Provisions

1.1. This Policy defines the procedure for processing and protecting personal data of users of the XConnect VPN service (the "Service").

1.2. The data controller is ИП НЕЧАЕВ ДЕНИС ВАЛЕРЬЕВИЧ (the "Operator").

1.3. By using the Website, the Telegram bot, the Personal Account, the XConnect VPN mobile or desktop application, or a VPN connection, the User gives consent to the processing of personal data as described in this Policy.

1.4. This Policy is drawn up in accordance with applicable data protection legislation, including, with respect to data subjects located in the Russian Federation, Federal Law No. 152-FZ "On Personal Data" of 27 July 2006.

1.5. This Policy fully applies to the XConnect VPN mobile application for Android and iOS and the desktop application for Windows, macOS, and Linux (jointly, the "Application"). The Application uses the system VpnService class (Android) and equivalent system interfaces on other platforms solely to establish an encrypted VPN tunnel between the User's device and the Operator's servers. The content of traffic passing through the tunnel is not analyzed, stored, or shared with third parties.

1.6. Personal data is processed on the following legal bases: performance of a contract (the Terms of Service); the User's consent; compliance with applicable law (including tax, accounting, and other regulatory requirements); and the Operator's legitimate interest in ensuring security, preventing fraud, and protecting its rights.

2. Data We Process

2.1. The Operator processes:

  • Account identifiers: Telegram ID, username, and email address provided by the User.
  • Payment data: transaction records (amount, date, method, payment identifier). Full card details and CVV codes are not processed or stored.
  • Technical data: device type, operating system, application version, and connection service events (connection/disconnection time) — linked to the User's account.
  • Support data: the content of requests to technical support.
  • Subscription data: history of subscription requests and renewals, active plans, and aggregate traffic usage per subscription (a counter only, with no link to visited resources).
  • Balance and referral data: internal balance state, credits and debits, and referral links between accounts.

2.2. The Operator may process any other information provided voluntarily by the User (for example, in a support request), as well as information whose processing is required by applicable law.

3. Purposes of Processing

3.1. Data is used for:

  • identifying the User when providing access;
  • processing payments and record-keeping;
  • technical support and troubleshooting;
  • preventing abuse (fraud, spam, attacks);
  • complying with legal requirements (including tax accounting).

3.2. Data is also used to comply with lawful requests of state authorities submitted in the manner prescribed by applicable law; to protect the Operator's rights and legitimate interests, including in judicial and administrative proceedings; and to maintain the operability, security, and integrity of the Service infrastructure.

4. No-Logs Policy

4.1. XConnect VPN does NOT store or process:

  • browsing history of visited websites;
  • the content of transmitted traffic;
  • DNS queries;
  • persistent activity logs that would make it possible to identify the User's actions online.

4.2. Technical metadata is used only in aggregated form for debugging and does not make it possible to link a specific user to their actions on the internet.

4.3. For the avoidance of doubt: the No-Logs provisions (clause 4.1) apply exclusively to the content and destinations of traffic inside the VPN tunnel (visited resources, destination IP addresses, search history, DNS queries, web browsing content). The data listed in Section 2 (account data, connection/disconnection times, subscription history, payments, support requests) is stored linked to the User's account for the purposes and periods set out in this Policy.

5. Cross-Border Transfer of Personal Data

5.1. Because the Operator's server infrastructure is located in multiple countries, Users' personal data is processed, among others, on servers located in: Germany, the Netherlands, Sweden, Finland, Poland, Estonia, Latvia, and Japan.

5.2. The User hereby consents to the cross-border transfer of their personal data to the above countries for the purpose of providing access to the Service. Withdrawal of this consent makes use of the Service impossible.

5.3. The Operator takes all reasonable measures to protect transferred data in accordance with applicable law.

6. Storage and Protection of Data

6.1. The Operator applies legal, organizational, and technical data protection measures.

6.2. Retention periods:

  • Account and payment data: 5 (five) years from the last interaction (for tax accounting and dispute resolution).
  • Technical metadata: up to 30 (thirty) days from collection.
  • Data is destroyed upon expiry of these periods.

6.3. Data is stored for exactly as long as necessary to achieve the purposes of processing or as required by applicable law, whichever period ends later. Statutory retention periods cannot be shortened at the User's request.

7. User Rights

7.1. The User may request rectification, blocking, or deletion of their data, except data that the Operator is required to retain by law (for example, for tax accounting).

7.2. Requests may be submitted via:

8. Account Deletion

8.1. The User may at any time request deletion of their account and associated personal data by any of the following means:

The request must include account details and contact details.

8.2. Deletion requests are reviewed within 30 (thirty) calendar days of receipt.

8.3. The account and data are deleted after the expiry of the User's last active subscription plus 6 (six) months from its expiry date. This period is necessary for dispute resolution, handling payment claims (chargebacks), and abuse prevention.

8.4. Data whose retention is required by applicable law (including payment records — 5 years, clause 6.2), as well as data needed by the Operator to defend its rights in pending disputes, is excluded from deletion. Such data is blocked from any other processing and destroyed upon expiry of the statutory periods.

8.5. Submitting a deletion request does not terminate a paid subscription and does not entitle the User to a refund.

9. Data Disclosure

9.1. The Operator does not sell or share personal data with third parties for marketing purposes.

9.2. Data may be disclosed exclusively: pursuant to a lawful, duly issued request from a competent state authority of a jurisdiction applicable to the Operator; to protect the Operator's rights and legitimate interests in judicial or administrative proceedings; and to payment providers, to the minimum extent necessary to process and account for payments.

10. Contacts

For data processing matters: