Legal Identity and Contact Page — draft

Prepared for review by licensed counsel. Not legal advice. Part B is the proposed public text. Parts A and C are internal and must not be published. Bracket legend: [OPEN] business decision · [VERIFY] fact or authority to confirm · [COUNSEL] legal judgment · [ENGINEERING] technical fact to confirm. The page may not be published while any bracket remains in Part B.

Part A — Drafting brief (internal)

A.1 Engagement framing

Item	Value
Client	HidzoVPN, Inc.
Question presented	What must a single public page state so that every user, platform, regulator and counterparty can identify the legal provider of HidzoVPN, reach it for each purpose, and serve legal notices on it?
Deliverable	Public web page text (Part B) with drafting notes (Parts A and C). Target URL: `https://hidzovpn.com/legal` [OPEN]
Audience	Consumers worldwide; app-store reviewers; payment processors; regulators and courts; counterparties
Depends on	DEC-2026-001 (single contracting entity) — this page implements its §6.1 identity block

A.2 Facts relied on

Fact	Source	Label
HIDZOVPN, INC., Florida profit corporation, document no. P25000060442, active	EV-211a	Verified
Formed in California on 3 March 2025 as NEBULAVPN, INC.; domesticated to Florida effective 29 October 2025	EV-211b (Company's statement in the filing); California record not obtained	Verified as to the filing
Principal and mailing address as filed: 7901 4th Street North, Suite 9375, St. Petersburg, FL 33702	EV-211a, EV-211b	Verified as filed; accuracy as "principal office" is open (RSK-046)
Registered agent: Northwest Registered Agent LLC, 7901 4th Street North, Suite 300, St. Petersburg, FL 33702	EV-211a	Verified
Apple developer name "HidzoVPN, Inc."	EV-009	Verified as displayed by Apple (Level A for the displayed name)
Apple and Google EU trader status and the contact details they publish (Apple fills the organisation address from D-U-N-S)	EV-236	UNKNOWN — evidence needed: App Store Connect and Play Console screenshots
Google Play developer name historically "NebulaVPN Inc."; later "HidzoVPN"	EV-303, EV-401	Reported; current value to be confirmed (BRF-2026-001 P0-2)
Support email [email protected]	QN-01-010	Reported
legal@, privacy@, security@, legalrequests@ mailboxes do not yet exist	QN-01-011…014	Reported
Phone +1 714-292-5449 shown on Google Play; ownership unconfirmed	QN-01-015	Reported
Published Privacy Policy and Terms (1 Sep 2025) name "NebulaVPN Inc." and a Panama address	EV-001, EV-002	Reported (not yet preserved)
U.S. trademark application 99461233 for HIDZOVPN pending, with open chain-of-title questions	EV-217	Verified (record); questions [COUNSEL]

A.3 Issue matrix

Dimension	Status	Note
Corporate / entity	Core	Exact legal name; jurisdiction; former name; registered agent
Consumer protection — trader identity	Core	Cal. Bus. & Prof. Code §17538(d) (Verified, EV-219); EU CRD Art. 6(1)(b)–(c) (Reported); UK CCRs 2013 Sch. 2 [VERIFY]
Online-service provider information	Core	EU e-Commerce Directive Art. 5, UK E-Commerce Regulations 2002 reg. 6, German DDG §5 — applicability to a non-EU provider (EV-231)
EU Digital Services Act	Core	DSA Recital 29 names VPNs as mere-conduit intermediary services (Verified); Art. 11–13 contact points and EU legal representative [COUNSEL] (RSK-049)
California Civ. Code §1789.3	Touched	Verified text requires provider name, address, phone, charges and complaint procedures; but §1789.2(d) limits "goods or services" to tangible items or physical services and excludes "computerized data delivered to the consumer via a computer terminal" (Verified, EV-230). Applicability to a VPN is doubtful — Assessment; optional precautionary notice [COUNSEL]
Privacy	Touched	Privacy-request channel must match the Privacy Policy; controller identity
Security	Touched	security@ and `/.well-known/security.txt` (RFC 9116, EV-231); EU CRA intake (BRF-2026-001 P1-9)
Law enforcement	Touched	Single restricted intake; public guidelines are a separate document (DOCUMENT_PROGRAM #10)
Platform rules	Touched	Developer names on Apple and Google must match; direct-download APK source (BRF-2026-001 P0-1)
IP	Touched	Trademark statement must not claim registration (application pending; [COUNSEL] P0-5)
Staff safety / personal data	Touched	No individual names or home addresses on the page (KB-002 B9; RSK-031)
Sanctions	Touched	Publishing the Florida identity is part of the identity release; OFAC counsel to confirm no conflict with interim containment (BRF-2026-001 P0-6; DEC-2026-001 §4.9)
Tax	Touched	VAT/tax-ID row (BRF-2026-001 P2-6)
Disputes	Touched	Complaints row points to the Terms
Personal liability	Touched	A business address that differs from the principal office on file would publicly contradict the officer's filing (Fla. Stat. §607.1622; §817.155); California §17538.5(a) is a misdemeanor provision [COUNSEL]

Part B — Proposed public text

Legal information

Version: [OPEN: 1.0] · Effective: [OPEN: publication date]

Who provides HidzoVPN

HidzoVPN is provided by HidzoVPN, Inc., a corporation organized under the laws of the State of Florida, United States (Florida Department of State document number P25000060442). HidzoVPN, Inc. provides the HidzoVPN apps, websites and services.

HidzoVPN, Inc. was formerly Nebulavpn, Inc., a California corporation [COUNSEL: Florida corporate and U.S. trademark counsel to confirm wording; consider adding "(shown in some places as 'NebulaVPN Inc.')"].

Company details

Item	Details
Legal name	HidzoVPN, Inc.
Type of entity	Florida profit corporation
Florida document number	P25000060442
Business address	[OPEN: address where the business is established — DEC-2026-001 §4.4; RSK-046]
Mailing address	7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States
Registered agent in Florida	Northwest Registered Agent LLC, 7901 4th Street North, Suite 300, Saint Petersburg, FL 33702, United States [COUNSEL: publish or omit]
Telephone	[OPEN: company-owned number that is answered — QN-01-015]
Website	https://hidzovpn.com
VAT or other tax identification number	[OPEN: only if registered — BRF-2026-001 P2-6]

How to contact us

Purpose	Contact
Help with the app, your account or a web purchase	[email protected]
Purchases made through the App Store or Google Play (refunds and billing)	App Store: Apple handles billing and refunds (reportaproblem.apple.com). Google Play: request a refund from Google Play, or write to [email protected] as described in our Refund and Cancellation Policy
Privacy questions and requests about your personal information	[OPEN: [email protected] — mailbox to be created]. See our Privacy Policy for how requests are handled
Reporting a security vulnerability	[OPEN: [email protected] — mailbox to be created]. See our Vulnerability Disclosure Policy and `https://hidzovpn.com/.well-known/security.txt` [ENGINEERING]
Reporting abuse of our service (spam, attacks or other misuse coming from our servers)	[OPEN: [email protected] — mailbox to be created]. See our Acceptable Use Policy
Complaints about our service	[email protected]. Sections 27 and 28 of the Terms of Service explain how disputes are handled
Legal notices	[OPEN: [email protected] — mailbox to be created], with a copy by post to the mailing address above
Requests from courts, government or law-enforcement authorities	[OPEN: [email protected] — restricted mailbox to be created]. See our Law Enforcement Guidelines [OPEN: link — POL-LE-001]

[OPEN: state an acknowledgement time for each channel only if operations can meet it]

Sending us legal notices or court papers

Legal notices to HidzoVPN, Inc. can be sent in writing to the legal-notices email address above, with a copy by post to our mailing address. Service of process on HidzoVPN, Inc. in Florida may be made on our registered agent. Nothing on this page limits any method of service or notice permitted by law.

Our apps

Our apps are published on the Apple App Store under the developer name "HidzoVPN, Inc." and on Google Play under the developer name [VERIFY: current Google Play developer name after BRF-2026-001 P0-2]. We also offer an Android app for download from our website at [ENGINEERING: official download URL]; we publish the SHA-256 checksum of the current release and the fingerprint of our signing certificate at [ENGINEERING: URL]. We distribute our apps only through the sources listed above. Copies obtained from other sources are not distributed by us and may have been modified.

Trademarks

HidzoVPN and the HidzoVPN logo are trademarks of HidzoVPN, Inc. [COUNSEL: wording while U.S. application 99461233 is pending; no ® symbol until registration issues — BRF-2026-001 P0-5; confirm the Company owns the logo (designer assignment)]

Our legal documents

Document	Link
Terms of Service	[OPEN: link on publication]
Privacy Policy	[OPEN]
Refund and Cancellation Policy	[OPEN]
Acceptable Use Policy	[OPEN]
Cookie Notice	[OPEN]
Account and Data Deletion Policy	[OPEN]
List of Service Providers	[OPEN]
Law Enforcement Guidelines	[OPEN]
Vulnerability Disclosure Policy	[OPEN]

Earlier versions of these documents are available on request at the legal-notices address. [OPEN: or publish a version archive]

Information for users in the European Union and the United Kingdom

[COUNSEL: EU/UK counsel to confirm each item below before publication — RSK-049]

Item	Details
Point of contact for authorities of EU Member States, the European Commission and the European Board for Digital Services (Digital Services Act, Article 11)	[OPEN: dedicated email address]. Languages: [OPEN: English and an official language of the Member State where our Article 13 representative is established — DSA Art. 11(3)]
Point of contact for users of our service (Digital Services Act, Article 12)	[OPEN: at least two means, e.g. email and a web form, not relying solely on automated tools — DSA Art. 12(1)]
Legal representative in the European Union (Digital Services Act, Article 13)	[OPEN: name, postal address, email address and telephone number of the representative, once designated]
Representative in the European Union and in the United Kingdom for data-protection matters (GDPR Article 27; UK GDPR Article 27)	[COUNSEL: whether required; if so, name and contact details]
Geographical address, telephone number and email address	See "Company details" above

Information for California users

[COUNSEL: optional precautionary notice under Cal. Civ. Code §1789.3 — applicability to a VPN service is doubtful (§1789.2(d)); if included, state the provider's name, address and telephone number, a reference to the charges shown at purchase, how to resolve a complaint ([email protected]), and the Complaint Assistance Unit of the Division of Consumer Services, California Department of Consumer Affairs, [VERIFY: current address and telephone number on dca.ca.gov].]

Language

This page is written in English. Translations are provided for convenience; if a translation differs from the English text, the English text prevails, unless the law of your place of residence requires otherwise.

Part C — Drafting notes (internal)

C.1 Legal basis for each element

Element	Basis	Label
Legal name and street address before accepting payment (California purchasers)	Cal. Bus. & Prof. Code §17538(d)(1): "the legal name under which the business is conducted and … the complete street address from which the business is actually conducted"; placement on the first screen, offer, order or payment screen, or for non-browser apps with a reasonable opportunity to review, with an adjacent statement on how to receive the information by email (§17538(d)(2))	Verified (EV-219; EV-236)
Private-mailbox route	§17538(d)(3) refers to §17538.5(b)(2), which applies only if the business is conducted from the person's residence, the business or home address is on a USPS Form 1583 filed with USPS, and an acknowledgement appointing the mail agency as agent for service of process is signed	Verified (EV-236). If the business is not conducted from a residence, Suite 9375 alone does not satisfy §17538(d)
Advertising disclosure	§17538.5(a): a person conducting business in California that uses a private mailbox must disclose its legal name and the complete street address from which business is actually conducted in all advertising and promotional materials; violation is a misdemeanor	Verified (EV-236); whether the Company "conducts business in this state" [COUNSEL]
Trader identity, geographical address, telephone, email (EU consumers)	Directive 2011/83/EU Art. 6(1)(b)–(c) as amended by Directive (EU) 2019/2161; if a contact form or chat is offered, it must also be listed [VERIFY]	Reported [VERIFY: EUR-Lex consolidated text CELEX 02011L0083-20220528; the legislation.gov.uk copy shows only the pre-2019/2161 text]
UK equivalent	Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 Sch. 2 paras (b) identity, (c) geographical address and, where available, telephone and email, (e) complaints address if different	Verified by AI reviewer on legislation.gov.uk (EV-236) — Reported
Provider information for online services	e-Commerce Directive 2000/31/EC Art. 5 applies to providers established in a Member State (Reported — low relevance); UK E-Commerce Regulations 2002 reg. 6 territorial reach [VERIFY]; German DDG §5 (Impressum) — application to non-EU providers targeting Germany is disputed [COUNSEL]	Reported (EV-231)
DSA contact points and legal representative	Regulation (EU) 2022/2065: Recital 29 lists "virtual private networks" among the generic categories of "'mere conduit' intermediary services" (Verified, EV-231); Art. 2(1) applies the Regulation irrespective of the provider's place of establishment; Art. 11 (point of contact for authorities), Art. 12 (point of contact for recipients), Art. 13 (written designation of a legal representative in a Member State where services are offered, with name, postal address, email and telephone made public) — Reported (AI research quoting the Official Journal; operative text not opened first-hand) [VERIFY]. Assessment: the Company is likely to be within scope as a mere-conduit provider not established in the Union [COUNSEL]
California electronic commercial service notice	Cal. Civ. Code §1789.3 (text) and §1789.2(d) (definition excluding computerized data)	Verified (EV-230); applicability — Assessment: doubtful
Service on the registered agent	Fla. Stat. §48.081(2) (service on a corporation's registered agent); §607.0501 (appointment)	Reported (EV-236; EV-229)
German Impressum	DDG §5(1): name of the authorised representative of a legal person (Nr. 1), fast electronic contact (Nr. 2), register and number (Nr. 4), VAT ID (Nr. 6) — if it applies, the officer's name must be published, which conflicts with KB-002 B9 and RSK-031	Reported (EV-236) [COUNSEL: German counsel; staff-safety review]
Store trader data	Apple publishes EU DSA trader contact details on the product page and fills an organisation's address from D-U-N-S	Reported (EV-236)
security.txt	RFC 9116: served over HTTPS at /.well-known/security.txt; "Contact" and "Expires" fields must be present	Reported (EV-231)
No staff names or home addresses	KB-002 B9; RSK-031	Internal rule

C.2 Conditions before publication

DEC-2026-001 adopted (BRF-2026-001 D1).
Mailboxes created and monitored: legal@, privacy@, security@, legalrequests@, abuse@ (DEC-2026-001 §6.1 and row 17).
Business-address decision taken (BRF-2026-001 D8; RSK-046) and phone number confirmed.
Google Play developer name confirmed (BRF-2026-001 P0-2).
EU/UK section completed on counsel's advice.
Published together with, or after, the interim correction of the Privacy Policy and Terms, so that no published document still names "NebulaVPN Inc." or Panama after this page goes live (RSK-034, RSK-047).
The live page snapshotted into 03-Evidence/snapshots on publication.
SHA-256 publication for the website APK exists before the "Our apps" sentence is published (BRF-2026-001 P0-1).
The Privacy Policy is updated in the same release so that privacy requests go to the same channel as this page (the v2 draft currently uses support@ with the subject "Privacy Request", EV-301).
Operational requirements behind the EU contact points: the Article 11 contact states the languages in which it can be contacted; the Article 12 contact lets users choose a means of communication that does not rely solely on automated tools [VERIFY: Art. 12(1)].
No link to the EU online dispute resolution (ODR) platform is added (Regulation (EU) 2024/3228; ODR ended 20 July 2025 — Reported, EV-232).
California on-screen disclosure: the first screen of the website, the web checkout and the in-app paywall show "HidzoVPN, Inc.", the street address from which the business is actually conducted, and "To receive this information by email, write to [email protected]"; the Refund and Cancellation Policy is linked before payment (§17538(d)).
The address, telephone and email on this page equal the Apple and Google EU trader data and the D-U-N-S profile.
Each document listed in "Our legal documents" is approved and live; otherwise its row is removed. Earlier versions (all languages) are snapshotted before the sentence on earlier versions is published.
If the business address differs from the principal office on file with the Florida Department of State, Florida counsel first decides whether to amend the principal office, and any filing precedes publication. The operating location (DEC-2026-001 CP-7) is recorded.
Northwest Registered Agent LLC's written confirmation of its appointment is on file (RSK-050).

C.3 Surfaces that must show the same identity (consistency sweep)

Website footer and first screen; web checkout; in-app paywall; this page; Terms; Privacy Policy; App Store and Google Play listings, developer pages and EU trader contact details; Stripe public business details; in-app About/Legal screen; Stripe account, receipts and invoices; checkout page; support email signatures and store-review reply templates; security.txt.

C.6 Why earlier identities are not described on this page

The correction of earlier references to "NebulaVPN Inc." and to an address in Panama belongs in the change notice that accompanies the updated Privacy Policy and Terms (DEC-2026-001 §7), not on this permanent page (RSK-047). The page states only what a user needs to identify the provider; dates of corporate events are available from the Florida Department of State.

C.4 Limits of this analysis

Verified first-hand (25 Sep 2026): Sunbiz record; Articles of Domestication; Cal. Bus. & Prof. Code §17538(d); Cal. Civ. Code §§1789.2, 1789.3.
Verified first-hand: also DSA Recital 29 (Official Journal text, Publications Office) and Cal. Bus. & Prof. Code §17538.5 (25 Sep 2026).
Reported only: EU CRD Art. 6(1)(c) as amended; UK CCRs Sch. 2; e-Commerce Directive Art. 5; UK E-Commerce Regulations reg. 6; German DDG §5; DSA Arts. 2, 11–13; RFC 9116; Fla. Stat. §607.0501.
Not reviewed: trader-identity rules of other countries in which HidzoVPN is marketed (for example Turkey, Indonesia, Saudi Arabia, UAE — sites exist in TR/AR/ID); platform rules on developer contact information beyond those cited.
Facts unknown: place where the business is actually conducted; telephone ownership; current Google Play developer name.
Counsel required: Florida corporate (former-name wording; registered-agent publication); U.S. consumer (California); EU/UK counsel (trader identity, DSA, representatives); U.S. trademark (trademark statement).

C.5 Review log

Date	Reviewer	Verdict	Notes
2026-09-25	Drafted	—	v0.1
2026-09-25	hidzo-counsel-reviewer (AI), full draft review on v0.2	REVISE (no Blockers; 11 Majors, 14 Minors)	v0.3: §17538.5 residence condition and advertising misdemeanor (verified first-hand); §17538(d)(2) placement; store trader data; sanctions/tax/disputes/personal-liability rows; neutral C.6; apps sentence; Google refund wording; DSA Arts. 11(3), 12(1); DDG §5 conflict; §48.081; conditions 12–16
2026-09-25	hidzo-counsel-reviewer (AI), draft review	REVISE (no Blockers; 9 Majors)	Incorporated in v0.2: former-name sentence without dates and subject to counsel; earlier-identity sentence removed from public text (C.6); address label as filed; tax-ID row; complaints row; "can be sent"; logo ownership; publication conditions 8–11
2026-09-25	hidzo-counsel-reviewer (AI) — cross-document final audit; research memos EV-232–235	REVISE (set: 1 Blocker, 8 Majors)	v0.4: cross-document redlines X-01–X-31 applied where they concern this document; authority labels updated from first-hand and research-memo checks (EV-238–264)