Personal data policy

1. Data controller

The data controller is Галиуллина Элона Маратовна, self-employed individual and professional income tax payer, taxpayer identification number 026307629963, address: 453850, Республика Башкортостан, г. Мелеуз, ул. Правды, д. 18. This policy covers https://vpnchick.net, the cabinet, registration, VPN access, and support requests.

Questions about data can be sent to [email protected]. Do not send a password, VPN key, or full card details in a support message.

2. Data we may receive

• email and a password hash for registration and sign-in;
• account ID, plan, access term, and technical VPN subscription or key identifiers;
• a technical device identifier used to enforce the device limit;
• Telegram ID and username when Telegram sign-in or support is used;
• referral or promo code, language, and settings entered by the user;
• support messages and attachments sent by the user;
• payment status, amount, plan, and data needed for a payment or refund. We do not store full card data;
• technical request data such as time, IP address, user-agent, API route, response code, and request ID for security and diagnostics.

3. VPN activity

VPNchick does not build an account history of the websites a user visits through the VPN or use a list of those resources for advertising profiles. Website and API operations may have technical logs for security and troubleshooting; these are not a browsing history of sites opened through the VPN.

We do not ask for passport details, home address, biometrics, or card data for ordinary registration.

4. Purposes and legal bases

• create an account, authenticate the user, and restore access;
• provide VPN access and apply the plan, device limit, and term;
• answer support requests and diagnose access problems;
• protect the site, API, payment flow, and infrastructure;
• process payments, refunds, receipts, and mandatory accounting;
• comply with law and lawful government requests;
• improve the interface when optional analytics are enabled.

5. Cookies and analytics

Required cookies support sessions and secure sign-in. Language and interface settings may be stored in browser local storage. If PostHog or another analytics tool is enabled in a particular build, it may receive anonymized interface events and technical browser parameters. It does not receive card data.

6. Recipients

We do not sell personal data. Data may be accessed by the provider and vendors needed for the selected function:

• hosting, infrastructure, databases, and technical providers;
• email providers for system messages and recovery;
• Telegram when Telegram sign-in or support is used;
• the payment provider shown at checkout;
• analytics providers when enabled;
• authorities or other recipients when required by law.

7. Retention

Account data is kept while the account is needed to operate the service. After deletion, operational data is deleted or anonymized within a reasonable period unless it must be kept to protect rights, perform the agreement, or comply with law. Payment, receipt, and technical records are kept for the period required for their purpose.

8. User rights

Send a request to [email protected] from the account email. We may ask for reasonable verification. We usually reply within 10 business days unless the law sets another period.

• request information about processing;
• correct inaccurate data;
• request account and data deletion where there is no legal reason to retain it;
• withdraw consent for optional processing;
• complain to a regulator or court under applicable law.

9. Security and updates

We use HTTPS, password hashing, access controls, and technical safeguards. No internet transfer is absolutely secure, so use a unique password and report suspicious activity.

We may update this policy when the service, law, or processing changes. The new edition is published on this page and applies from publication unless it states otherwise.