Privacy policy
How we collect, use and protect information when you use our website and VPN service.
Last updated 5 November 2026
This policy explains what personal data PadVPN ("we", "us") processes when you use our website, customer hub and VPN service (together, the "Service"), why, and for how long. Our separate what we log page summarises what we record and what we don't.
1. Data we collect
Account data
Your email address, a one-way (bcrypt) hash of your password, your account creation date, and your preferences. Our staff may add internal notes to your account when handling a support request.
Subscription and payment data
Your plan, its start and end dates and limits, and your orders: amount, currency, status, the cryptocurrency and network used, and the payment processor's invoice reference. Payments are processed by Cryptomus, which receives the information needed to complete the payment under its own privacy policy. We never receive or store wallet private keys or card details.
Device data
For each device you add: its name, platform type and public key. For configurations you download from the hub, we store the device's private key encrypted so that you can download the configuration again. We also store the internal tunnel address assigned to the device at each location.
Usage data
Hourly totals of data sent and received per device and location, lifetime totals per account, and the time each device last connected to each location. We do not collect the websites you visit, DNS requests or traffic contents.
Connection records
When a device connects, we record the account or free device, the IP address it connects from, an approximate city and country worked out from that address on our own servers, the server used, and the connection times. IP addresses are encrypted when stored. We use these records to run the network, prevent abuse and understand where our service is used.
Sessions
When you sign in we store a hashed session token, your browser's user-agent string and the session's expiry date. We don't store your IP address with sessions.
Support messages
If you contact us by email or through the website, we process your name, email address, your message and any attachments so we can respond. We keep these conversations in our support system with our replies.
2. How we use data
- To provide the Service: authenticate you, provision your devices and enforce your plan's limits.
- To process payments and keep accounting records.
- To send service emails: password resets, payment receipts and plan expiry reminders.
- To answer support requests.
- To protect the Service from abuse, for example by rate-limiting sign-in attempts. Rate limiting uses IP addresses only in memory, briefly, and never stores them.
We don't sell or rent personal data, and we don't use it for advertising.
3. Sharing
We share data only with service providers we need to run the Service: our payment processor (Cryptomus), our email delivery provider (for messages we send to you), the hosting providers of our servers, and Cloudflare, which carries traffic to our websites and to CDN backup connections and so sees the connecting IP address of that traffic. If you link Telegram, we store your Telegram chat ID so our bot can answer you, and Telegram handles those messages under its own policies; you can unlink at any time. We may disclose data if required by law, but we can only disclose what we have (see what we log).
4. Retention
- Account, device and subscription data: until you delete your account.
- Hourly usage totals: up to 400 days, then deleted automatically.
- Sessions: deleted when they expire or when you sign out.
- Password reset links: valid for one hour and deleted shortly after.
- Connection records: 90 days by default, then deleted automatically.
- Support conversations: until we delete them or you ask us to. Messages marked as spam are deleted automatically after 30 days.
- Payment records: as long as needed for accounting and legal obligations.
5. Security
The website and hub are served over HTTPS only. Passwords are hashed with bcrypt, stored secrets and device keys are encrypted at rest (AES-256-GCM), and VPN traffic is encrypted end-to-end between your device and our server.
6. Cookies and local storage
We set one cookie: the session cookie that keeps you signed in. Your colour-theme choice is saved in your browser's local storage and never sent to us. We don't use analytics or third-party trackers.
7. Your rights
You can ask us for a copy of your data, to correct it, or to delete your account and all associated data. Email support@padvpn.com from the address registered on your account.
8. Children
The Service is not intended for anyone under 16.
9. Changes
We'll post any changes here and update the date above. For significant changes we'll also notify you by email.
10. Contact
Questions about privacy: support@padvpn.com.