Privacy policy
How we collect, use and protect information when you use our website and VPN service.
Last updated 3 November 2026
This policy explains what personal data PadVPN ("we", "us") processes when you use our website, customer hub and VPN service (together, the "Service"), why, and for how long. Our separate no-logs policy summarises what we never record.
1. Data we collect
Account data
Your email address, a one-way (bcrypt) hash of your password, your account creation date, and your preferences. Our staff may add internal notes to your account when handling a support request.
Subscription and payment data
Your plan, its start and end dates and limits, and your orders: amount, currency, status, the cryptocurrency and network used, and the payment processor's invoice reference. Payments are processed by Cryptomus, which receives the information needed to complete the payment under its own privacy policy. We never receive or store wallet private keys or card details.
Device data
For each device you add: its name, platform type and public key. For configurations you download from the hub, we store the device's private key encrypted so that you can download the configuration again. We also store the internal tunnel address assigned to the device at each location.
Usage data
Hourly totals of data sent and received per device and location, lifetime totals per account, and the time each device last connected to each location. We do not collect the websites you visit, DNS requests, traffic contents, or the IP address you connect from.
Sessions
When you sign in we store a hashed session token, your browser's user-agent string and the session's expiry date. We don't store your IP address with sessions.
Support messages
If you contact us, we process your name, email address and message so we can respond.
2. How we use data
- To provide the Service: authenticate you, provision your devices and enforce your plan's limits.
- To process payments and keep accounting records.
- To send service emails: password resets, payment receipts and plan expiry reminders.
- To answer support requests.
- To protect the Service from abuse, for example by rate-limiting sign-in attempts. Rate limiting uses IP addresses only in memory, briefly, and never stores them.
We don't sell or rent personal data, and we don't use it for advertising.
3. Sharing
We share data only with service providers we need to run the Service: our payment processor (Cryptomus), our email delivery provider (for messages we send to you), and the hosting providers of our servers. We may disclose data if required by law, but we can only disclose what we have (see the no-logs policy).
4. Retention
- Account, device and subscription data: until you delete your account.
- Hourly usage totals: up to 400 days, then deleted automatically.
- Sessions: deleted when they expire or when you sign out.
- Password reset links: valid for one hour and deleted shortly after.
- Payment records: as long as needed for accounting and legal obligations.
5. Security
The website and hub are served over HTTPS only. Passwords are hashed with bcrypt, stored secrets and device keys are encrypted at rest (AES-256-GCM), and VPN traffic is encrypted end-to-end between your device and our server.
6. Cookies and local storage
We set one cookie: the session cookie that keeps you signed in. Your colour-theme choice is saved in your browser's local storage and never sent to us. We don't use analytics or third-party trackers.
7. Your rights
You can ask us for a copy of your data, to correct it, or to delete your account and all associated data. Email [email protected] from the address registered on your account.
8. Children
The Service is not intended for anyone under 16.
9. Changes
We'll post any changes here and update the date above. For significant changes we'll also notify you by email.
10. Contact
Questions about privacy: [email protected].