---
doc_id: POL-LE-001
title: Law Enforcement Guidelines (public) — draft with drafting notes
type: policy-public
status: draft
version: 0.3
created: 2026-09-25
last_reviewed: 2026-09-25
next_review: 2026-10-09
law_checked: 2026-09-25 (18 U.S.C. §§2510(15), 2702, 2703, 2705, 2706, 2711, 2713 read on uscode.house.gov by AI reviewer — Reported; Fla. Stat. §92.605(3) partly; EU e-Evidence Level D)
owner: Legal Lead (named person TBD) with CTO
reviewers: [hidzo-counsel-reviewer (AI), U.S. criminal-procedure / privacy counsel, EU counsel]
counsel_needed: yes
counsel_status: none
jurisdictions: [US, US-FL, EU, GLOBAL]
related: [POL-PRIV-002, POL-AUP-001, POL-DEL-001, POL-ID-001, POL-TOS-002, BRF-2026-001]
sources: [EV-201, EV-202, EV-203, EV-205, EV-211a, EV-236, EV-237]
supersedes: POL-LE-001 v0.2 (2026-09-25)
print: true
confidentiality: INTERNAL — LEGAL (Part B becomes PUBLIC on publication)
---

# Law Enforcement Guidelines — draft

> **Prepared for review by licensed counsel. Not legal advice.** Part B is the proposed public text; Parts A and C are internal. The internal
> response procedure and request log belong in restricted folder 12. Every actual request goes to counsel before any response (KB-002 A7).
> **The table in §3 must match the Privacy Policy (POL-PRIV-002 §§3, 11) row for row and the engineering logging attestation
> (EV-201–205). Until both exist, every row is bracketed.**

## Part A — Drafting brief (internal)

| Item | Value |
|---|---|
| Question presented | How should courts, authorities and private litigants send requests to HidzoVPN, what process is required, and what records does HidzoVPN keep in the ordinary course of business? |
| Key constraints | (1) Consistency with the Privacy Policy; (2) no logging claim without A-INT evidence (CLAIMS_REGISTER); (3) no absolute promises (emergency and mandatory-reporting exceptions exist); (4) staff and founder safety (RSK-031, RSK-036) |
| Legal drivers | Stored Communications Act, 18 U.S.C. §§2702, 2703, 2705, 2706, 2711, 2713 (Reported, EV-237); Fla. Stat. §92.605(3) (partly verified); EU e-Evidence Regulation (EU) 2023/1543 and Directive (EU) 2023/1544 (Level D) |

## Part B — Proposed public text

# Law Enforcement Guidelines

**Version:** 1.0 `[OPEN]` · **Effective:** `[OPEN: date]`

These guidelines are for courts, government agencies, law-enforcement authorities and parties to legal proceedings who want to request
information from HidzoVPN, Inc., a Florida corporation. They are not legal advice and do not create rights for any person. Users can read our
Privacy Policy for how we handle their information.

## 1. How to send a request

Send requests by email to `[OPEN: legalrequests@hidzovpn.com]`. Formal service of legal process on HidzoVPN, Inc. in Florida may be made on our
registered agent, Northwest Registered Agent LLC, 7901 4th Street North, Suite 300, Saint Petersburg, FL 33702, United States
`[COUNSEL: after Northwest confirms its appointment — RSK-050]`. Requests must be addressed to HidzoVPN, Inc.; we do not process requests sent
to individual employees, officers or contractors. Requests sent to customer support or through social media are not handled as legal requests
and will be delayed.

Each request must state: the requesting authority or party and the person making the request, with official contact details; the legal basis
for the request; the account email, installation identifier or other identifier concerned; the information sought; the relevant time period;
and any deadline.

We verify every request, including by contacting the requesting agency through its publicly listed contact details, and may refuse a request
we cannot verify.

## 2. Legal process we require

2.1 **United States authorities.** Except in the emergencies described in Section 5, or where the law requires us to report, we disclose user
information to U.S. authorities only in response to valid legal process `[COUNSEL: HidzoVPN's status as a provider of electronic communication
service to the public]`:

| Information | Process generally required |
|---|---|
| Basic subscriber records listed in 18 U.S.C. §2703(c)(2) (e.g. name, address, session times and durations, temporarily assigned network address, means of payment) | Subpoena |
| Other non-content records | Court order under 18 U.S.C. §2703(d), or a search warrant |
| Content of communications | Search warrant (our policy; the statute also allows other process in some cases — 18 U.S.C. §2703(b)) `[COUNSEL]` |

As a Florida business, we produce records in response to a subpoena, court order or warrant issued by another U.S. state as if a Florida court had issued it, as Florida law requires (Fla. Stat. §92.605(3)) `[COUNSEL: whether HidzoVPN provides electronic communication service to the public]`.

2.2 **Authorities outside the United States.** As a matter of company policy, we respond to authorities outside the United States only through a mutual
legal assistance request or another procedure that U.S. law recognizes `[COUNSEL: CLOUD Act executive agreements; EU European Production
Orders under Regulation (EU) 2023/1543 — whether HidzoVPN is a covered provider (EV-237, Level D)]`.

2.3 **Civil and private requests.** We do not disclose the content of communications to private parties. We disclose other user information to
private parties only in response to a subpoena or court order that is valid under applicable law, after notifying the user where we can and
allowing `[OPEN]` days to object `[COUNSEL: including subpoenas under 17 U.S.C. §512(h)]`.

2.4 We review every request for its legal validity and scope. We may reject, narrow or challenge a request that is invalid, overbroad or lacks
jurisdiction.

## 3. Records we keep in the ordinary course of business

We can only provide records that exist when we receive a valid request. The table below describes the records we keep in the ordinary course
of business as of `[OPEN: date]`, and how long we keep them (see Section 11 of our Privacy Policy). `[ENGINEERING and COUNSEL: every row must
match the logging attestation (EV-201–205) and the Privacy Policy exactly]` `[COUNSEL: wording on orders that require future collection]`

| Category | Do we keep it in the ordinary course of business? | How long |
|---|---|---|
| Content of a user's internet traffic | `[ENGINEERING: No — attestation EV-201; claims register approval]` | — |
| Websites or destinations visited, and DNS queries, through the VPN | `[ENGINEERING: No — EV-201, EV-202]` | — |
| IP address from which a user connects to a VPN server; server, tunnel address, start and end times, data volume (live session information) | `[ENGINEERING]` | Up to `[ENGINEERING: 15 minutes]` after the connection ends |
| Usage statistics linked to an account or device | `[ENGINEERING]` | `[ENGINEERING: 24 hours]` |
| Sign-in sessions and tokens | `[ENGINEERING]` | No longer than `[ENGINEERING: 30 days]` |
| Free Service limit state (installation identifier and timing) | `[ENGINEERING]` | `[ENGINEERING]` |
| Marketing preferences | `[ENGINEERING]` | Until the user unsubscribes; a minimal suppression record is kept |
| IP address used to reach our apps, website and account systems (API, security and abuse records) | `[ENGINEERING]` | Up to `[ENGINEERING: 30 days]`; up to 24 months where needed for a specific incident, dispute or legal obligation |
| Account email, sign-in method, Apple or Google identifier, linked devices | Yes, for users with an account `[ENGINEERING]` | While the account exists |
| Installation or device identifier, device model and operating system | `[ENGINEERING]` | `[ENGINEERING]` |
| Blocked device and payment identifiers (fraud and abuse) | `[ENGINEERING]` | Up to `[ENGINEERING and COUNSEL: 24 months]`, or longer only for a documented incident or legal claim |
| Subscription and payment records (plan, dates, amounts, payment token and last four digits of a card) | `[ENGINEERING: Yes, for website purchases; limited records for Apple and Google purchases — PP §3.4]` | For the period tax and accounting law requires `[VERIFY and tax counsel]` |
| Cryptocurrency wallet address and transaction hash | `[OPEN — BRF-2026-001 D7]` | `[OPEN]` |
| Crash and diagnostic reports | `[ENGINEERING]` | Up to `[ENGINEERING: 90 days]` |
| Analytics and measurement data | `[ENGINEERING]` | Up to `[ENGINEERING: 13 months]` |
| Support messages | `[ENGINEERING: Yes]` | Up to 12 months after the request is closed, or until the account is deleted, unless needed for an open matter |
| Push token | `[ENGINEERING]` | Until it becomes invalid, notifications are disabled or the account is deleted, then up to 30 days |
| Records of privacy requests | `[ENGINEERING: Yes]` | Up to 5 years `[COUNSEL]` |
| Backups | `[ENGINEERING]` | Up to `[ENGINEERING: 90 days]` |

## 4. Preservation requests

On a valid preservation request from a U.S. authority, we preserve records that exist when we receive the request for 90 days, extended by a
further 90 days on a renewed request, pending receipt of legal process (18 U.S.C. §2703(f)). A preservation request does not by
itself lead to disclosure. We do not start recording activity that we do not normally record because of a preservation request.

## 5. Emergencies

If you believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without
delay, send an emergency request to `[OPEN: legalrequests@hidzovpn.com]` with the subject "EMERGENCY". Describe the specific danger and explain
why the information is needed without delay. We review emergency requests promptly and may disclose information voluntarily where the law
permits (18 U.S.C. §2702(b)(8), (c)(4)) `[COUNSEL]`.

## 6. Notice to users

Where we have contact details for the user and the law allows it, we will notify the user before disclosing their information. We may delay
notice in an emergency, where a court order prohibits it (for example under 18 U.S.C. §2705(b)), or where notice would create a risk of harm,
and we will then notify the user once that reason no longer applies `[COUNSEL]`.

## 7. Transparency

`[OPEN: include only when the first transparency report is approved; no warrant canary without counsel's advice]`

## 8. Costs

We may seek reimbursement of reasonable costs where the law permits (18 U.S.C. §2706) `[VERIFY: §2706 not re-read first-hand — EV-237]`.

## Part C — Drafting notes (internal)

### C.1 Sources
| Element | Basis | Label |
|---|---|---|
| Voluntary disclosure; emergency exception; non-content disclosure to non-governmental persons; orders under CLOUD Act agreements | 18 U.S.C. §2702(a)(3), (b)(8), (b)(9), (c)(4), (c)(6), (c)(7) | Verified (A) — uscode.house.gov, "laws in effect on September 24, 2026" (EV-244) |
| Compelled disclosure ladder; preservation | 18 U.S.C. §2703(a)–(d), (f) | Verified (A) (EV-244) |
| Delayed notice; preclusion of notice | 18 U.S.C. §2705(a)–(b) | Verified (A) (EV-244) |
| Costs | 18 U.S.C. §2706 | Reported (EV-237) |
| Definitions (governmental entity = U.S. federal or state bodies only, so the emergency exceptions do not cover foreign police `[COUNSEL: handling of foreign emergency requests]`; ECS) | 18 U.S.C. §§2711(4); 2510(15) | §2711(4) Verified (A) (EV-244); §2510(15) Reported (EV-237) |
| Data regardless of location | 18 U.S.C. §2713 | Verified (A) (EV-244) |
| Florida business served with another state's process: duty to produce; immunity; content only by court order or warrant; contempt fines $100–$1,000 per day up to 60 days | Fla. Stat. §92.605(3), (4), (9), (10) | Verified (A) — 2026 Florida Statutes (EV-247). The 20-business-day rule in §92.605(2) applies to out-of-state corporations only; timing follows the process served `[COUNSEL]` |
| CLOUD Act agreements | UK–US agreement in force 3 Oct 2022; Australia listed, entry into force `[VERIFY]`; MLAT-only is company policy, not statute | Reported (B) (EV-245, EV-246) |
| EU e-Evidence | Regulation (EU) 2023/1543; Directive (EU) 2023/1544 (reported to apply from 18 Aug 2026) | Level D `[VERIFY]` |
| CSAM preservation | 18 U.S.C. §2258A(h) | Reported (EV-236) |

### C.2 Internal procedure (restricted — folder 12, not drafted here)
Single intake; verification of the requester through independently sourced contacts; counsel review before any response; litigation hold;
request log; escalation for foreign and civil requests (sanctions and staff-safety review — RSK-031); no staff member responds individually.

### C.3 Limits of this analysis
(a) Not reviewed: pen-register, wiretap, national-security and FISA process; CALEA; UK and other foreign production regimes; OFAC for requests
from governments of sanctioned countries. (b) Not opened first-hand by Claude: all U.S. Code sections cited (read by AI reviewer); EU e-Evidence
texts. (c) Facts unknown: the §3 table (EV-201–205); server countries (RSK-030); holders of hosting contracts (RSK-036); whether mailboxes exist.
(d) Counsel required: U.S. criminal procedure and privacy; EU counsel.

### C.4 Review log
| Date | Reviewer | Verdict | Notes |
|---|---|---|---|
| 2026-09-25 | Drafted | — | v0.1 |
| 2026-09-25 | hidzo-counsel-reviewer (AI) | REVISE (2 Blockers; 9 Majors) | v0.2: §3 rebuilt to mirror the Privacy Policy with every row bracketed (Blockers L-01, L-02); "only legal process" qualified; process ladder table; §92.605(3); civil requests §2.3; foreign requests as policy and e-Evidence; notice workable for guests; verification of requesters; statutory emergency standard; requests to the company only; transparency bracketed |
| 2026-09-25 | hidzo-counsel-reviewer (AI) — cross-document final audit; research memos EV-232–235 | REVISE (set: 1 Blocker, 8 Majors) | v0.3: cross-document redlines X-01–X-31 applied where they concern this document; authority labels updated from first-hand and research-memo checks (EV-238–264) |