Our lawyerوکیل ما

26.4 [OPEN — D3: paid plans are not available to persons located in [countries]]

Advertising: [OPEN — BRF-2026-001 D4: describe the advertising model chosen; see Section 2]

[OPEN — BRF-2026-001 D4; COUNSEL — Apple Guideline 5.4 requires that apps offering VPN services "may not sell, use, or disclose to third parties any data for any purpose, and must commit to this in their privacy policy" (EV-106, Verified). Choose one alternative. If Alternative A is chosen, Sections 1, 3.5, 5, 7, 9, 13 and 16 must be conformed with an explicit platform split, and the Apple privacy label rebuilt.]

[OPEN — depends on Section 2 and the SDK inventory (EV-206)] Where advertising is shown, the advertising provider may receive [ENGINEERING: list].

We receive information from: Apple and Google (sign-in, purchases and entitlements); our payment processor (payment status and fraud signals); [OPEN — D4: advertising and measurement providers]; [OPEN — POL-RTOS-001 §0: resellers, only the contact details needed to resolve a specific support or fraud case (POL-RPRIV-001 §2), if a reseller program is launched]; and people who report abuse, security vulnerabilities or legal issues to us.

To provide and secure the Services; to manage accounts, subscriptions and billing; to apply Free Service limits and device limits; to prevent fraud and abuse and enforce our Terms; to monitor the reliability and performance of our systems; to measure how the apps are used and how users find us, without using VPN traffic; [OPEN — D4: to show advertising as described in Sections 2 and 3.5]; to respond to requests; to send service messages and, with your agreement where required, marketing; and to meet legal obligations and defend legal claims.

We do not sell your VPN traffic, browsing destinations or DNS queries, and we do not keep records of them that could be disclosed [ENGINEERING: attestation]. [OPEN — depends on Section 2:] Under some U.S. state laws, giving advertising providers identifiers or app activity for targeted advertising may count as "selling", "sharing" or "targeted advertising" even if no money is paid.

Advertising and measurement providers [OPEN — Section 2].

You can: update your account information; unsubscribe from marketing emails; change advertising and tracking choices in the app and in your device settings, including Apple's App Tracking Transparency [OPEN — D4]; change cookie choices on our website [ENGINEERING: consent management — BRF-2026-001 P2-2]; change device permissions in your device settings; and delete your account.

Apple and Google · Sections 5, 9 · Service providers; app stores; [OPEN] · [OPEN — D4]

Apple and Google · Sections 5, 9 · Service providers; app stores; [OPEN] · [OPEN — D4]

Internet or network activity · App and website use, security records (not browsing destinations) · Your device · Operation, security, measurement · Service providers · [OPEN — D4]

Approximate location · Derived from IP address · Your device · Localization, security, tax · Service providers · [OPEN — D4]

Guest access may use automatic server selection, limit session length and apply waiting periods between sessions [ENGINEERING: current values]. [OPEN — BRF-2026-001 D4: on the platforms where advertising is shown, guest access may show advertising and offer optional rewarded advertising to shorten a waiting period; this sentence must match the Privacy Policy §2 alternative chosen]

16.1 The Services rely on third parties such as app stores, payment processors, sign-in providers and hosting providers [OPEN — D4: and, on platforms where advertising is shown, advertising networks].

interfere with or attack HidzoVPN's servers, apps, accounts or billing systems, get around plan or device limits, or modify our apps to remove or bypass advertising in the Free Service [OPEN — BRF-2026-001 D4];

Information held by Apple and Google [COUNSEL: and our payment processor, for its own purposes — POL-SUB-001 A.1] [OPEN — BRF-2026-001 D4: and advertising providers in the Free Service], acting as independent businesses, is not deleted by us.

[OPEN — BRF-2026-001 D5: choose Alternative A or Alternative B and delete the other]

First payment: you can request a full refund, including any tax charged, within [OPEN: 30] days of your first paid charge.

Renewals: you can request a full refund of a renewal charge within [OPEN: 7] days of the renewal.

Service failures (both alternatives): [OPEN: if Premium is unavailable for more than 72 consecutive hours because of a problem on our side, you can request a pro-rata refund or credit for that time].

For website purchases, our payment processor [OPEN: Stripe entity] collects your payment details; we receive [ENGINEERING: e.g. a payment token, card type and last four digits, billing country and payment status]. [OPEN — BRF-2026-001 D7: cryptocurrency purchases — wallet address, transaction hash, asset and amount]

9.5 Cryptocurrency. [OPEN: keep only if cryptocurrency payments are offered — BRF-2026-001 D7] Where we accept cryptocurrency, the purchase is a one-time prepayment for the period shown and does not renew automatically.

[OPEN — BRF-2026-001 D7: keep only if cryptocurrency payments are offered] Cryptocurrency purchases are one-time prepayments and do not renew automatically.

Refunds, where available under this policy, are paid to a wallet address you control, in [OPEN: the same asset / USDC], for [OPEN: the U.S. dollar value of your original payment / the amount of cryptocurrency received], less network fees.

Refunds, where available under this policy, are paid to a wallet address you control, in [OPEN: the same asset / USDC], for [OPEN: the U.S. dollar value of your original payment / the amount of cryptocurrency received], less network fees.

[OPEN — D7: cryptocurrency payment processor] · [ ] · [ ] · [ ] · [ ]

Cryptocurrency wallet address and transaction hash · [OPEN — BRF-2026-001 D7] · [OPEN]

Cryptocurrency wallet address and transaction hash · [OPEN — BRF-2026-001 D7] · [OPEN]

(complete and return this form only if you wish to withdraw from the contract) — To [OPEN: HidzoVPN, Inc., EU/UK business address — DEC-2026-001 §4.4; RSK-046], [OPEN: telephone], [email protected]: — I/We hereby give notice that I/We withdraw from my/our contract for the provision of the following service: HidzoVPN Premium — Ordered on — Name of consumer(s) — Address of consumer(s) — Signature of consumer(s) (only if this form is notified on paper) — Date (Optional: account email, to help us find your account.) `[COUNSEL: optional field added to the CRD Annex I(B) model form — acceptable?

Business address · [OPEN: address where the business is established — DEC-2026-001 §4.4; RSK-046]

We receive information from: Apple and Google (sign-in, purchases and entitlements); our payment processor (payment status and fraud signals); [OPEN — D4: advertising and measurement providers]; [OPEN — POL-RTOS-001 §0: resellers, only the contact details needed to resolve a specific support or fraud case (POL-RPRIV-001 §2), if a reseller program is launched]; and people who report abuse, security vulnerabilities or legal issues to us.

Resellers [OPEN — POL-RTOS-001 §0]: the contact details of a person who bought an Activation Code from that reseller, only where needed to resolve a specific support or fraud case; we do not tell resellers whether or by which account a code was activated `[POL-RPRIV-001 §§2, 9;

9.7 Activation Codes. [OPEN — POL-RTOS-001 §0: keep only if a reseller program is launched] Premium may also be obtained with an Activation Code bought from an authorized reseller.

[OPEN — POL-RTOS-001 §0: keep only if a reseller program is launched] An Activation Code gives Premium for a fixed period and does not renew, so there is nothing to cancel.

[OPEN — Part D Q4: choose Model A or Model B. Sections 3 and 4 are drafted for Model A; Model B requires a commission clause, HidzoVPN as seller of record, and HidzoVPN's consumer checkout and withdrawal process. Until chosen, this Agreement may not be signed.]

4.3 The Reseller shall honor any refund or withdrawal right that the law gives End Users against the seller of the code, and shall handle refunds for codes it has sold [OPEN: under Model A].

An Activation Code gives Premium for the fixed period stated with it, does not renew automatically and can be redeemed only at [OPEN: hidzovpn.com/redeem].

Unredeemed codes expire [OPEN].

Either party · The other · End User contact details needed to resolve a specific support or fraud case, where the End User has asked for help or fraud is suspected · Resolving that case only; deleted within [OPEN: 30] days after the case is closed

Security and breaches. Each party shall protect shared data with appropriate technical and organizational measures and shall notify the other without undue delay, and in any case within [OPEN: 72] hours, after becoming aware of a breach affecting shared data.

We keep this information for the duration of the relationship and for [OPEN: 7] years after it ends, and sanctions-screening records for 10 years [31 C.F.R. §501.601 — Reported].

Contact [OPEN: [email protected]].

"Territory" means the countries listed in the Order Form, excluding each Restricted Country and each country listed in Schedule 2 [OPEN: countries where resale or use of VPN services is restricted — COUNSEL and 07-Jurisdictions].

The Reseller shall pay within [OPEN: 15] days of invoice.

Late amounts bear interest at [OPEN].

3.6 HidzoVPN may change prices for future orders on [OPEN: 30] days' written notice.

4.4 Redemption. Activation Codes may be redeemed only at [OPEN: hidzovpn.com/redeem].

The Reseller shall not state or imply that codes can be redeemed inside the iOS or Android apps and shall not use HidzoVPN's app-store listings to sell codes. [ENGINEERING: no in-app code-entry field in store builds; Premium also offered as an Apple in-app purchase — Apple Guidelines 3.1.1, 3.1.3(b), Verified (EV-262); VERIFY: Google Play rule on access to subscriptions bought outside Play; do not use Apple or Google offer or promotional codes as resale inventory]

4.5 Unredeemed Activation Codes expire [OPEN] [COUNSEL: gift-card, gift-certificate and unclaimed-property laws per Territory; 12 C.F.R. §1005.20 applies to devices "in a specified amount" — application to fixed-period codes open].

The Reseller shall tell HidzoVPN within [OPEN: 5] business days of any change of control or of becoming aware that it or any owner is listed.

5.6 Records and audit. The Reseller shall keep complete records of each sale of Activation Codes, including the buyer's identity and country, for at least 10 years [31 C.F.R. §501.601 — Reported] and shall make them available to HidzoVPN on [OPEN: 10] business days' notice.

The Reseller shall remove any material HidzoVPN objects to within [OPEN: 48] hours of notice.

Each party shall keep the other's non-public information confidential and use it only for this Agreement, during the term and for [OPEN: 3] years after it ends.

10.1 This Agreement lasts [OPEN: 1] year from the Effective Date and renews for further [OPEN: 1]-year periods unless either party gives [OPEN: 60] days' written notice.

10.1 This Agreement lasts [OPEN: 1] year from the Effective Date and renews for further [OPEN: 1]-year periods unless either party gives [OPEN: 60] days' written notice.

10.1 This Agreement lasts [OPEN: 1] year from the Effective Date and renews for further [OPEN: 1]-year periods unless either party gives [OPEN: 60] days' written notice.

Either party may terminate for convenience on [OPEN: 90] days' notice.

10.3 On termination, the Reseller shall stop using the Marks and stop selling Activation Codes, and shall return or destroy unsold codes, which HidzoVPN shall cancel [OPEN: credit for unsold codes].

Disputes with a Reseller organized outside the United States shall be finally resolved by arbitration under the [COUNSEL: ICDR / ICC] Rules, seated in [OPEN: Tampa / Miami], Florida, in English.

11.3 Notices. Notices shall be in writing and sent to the addresses in the Order Form and, for HidzoVPN, to [OPEN: [email protected]] with a copy by courier to 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States.

The Reseller appoints [OPEN: process agent] to receive service of process in the United States, or consents to service by courier and email.

> **To be completed at the request of, and returned only to, [OPEN: OFAC counsel].

Version: 2.2 [OPEN: renumber on publication] · Effective: [OPEN: date] · Last updated: [OPEN: date]

Version: 2.2 [OPEN: renumber on publication] · Effective: [OPEN: date] · Last updated: [OPEN: date]

Version: 2.2 [OPEN: renumber on publication] · Effective: [OPEN: date] · Last updated: [OPEN: date]

Version: 2.2 [OPEN: renumber on publication] · Effective: [OPEN: date]

Version: 2.2 [OPEN: renumber on publication] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Last updated: [OPEN: date]

Version: [OPEN: 1.0] · Effective: [OPEN: publication date]

Version: [OPEN: 1.0] · Effective: [OPEN: publication date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Last updated: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

The table below describes the records we keep in the ordinary course of business as of [OPEN: date], and how long we keep them (see Section 11 of our Privacy Policy). [ENGINEERING and COUNSEL: every row must match the logging attestation (EV-201–205) and the Privacy Policy exactly] [COUNSEL: wording on orders that require future collection]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Version: 1.0 [OPEN] · Effective: [OPEN: date]

Privacy requests: [OPEN: [email protected]].

To make a request, email [OPEN: [email protected]] from your account email and tell us which right you want to use.

HidzoVPN, Inc., 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States · Privacy: [OPEN: [email protected]] · Legal Information page: [OPEN: link].

Questions, complaints or claims about the app may be sent to HidzoVPN, Inc., 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States; [OPEN: telephone — QN-01-015]; [OPEN: [email protected]].

28.1 Talk to us first. Before starting a claim, please send a written description of the dispute, your account email and the outcome you want to [OPEN: [email protected]].

You may opt out within 30 days after first accepting these Terms by emailing [OPEN]. CLASS AND REPRESENTATIVE ACTIONS ARE NOT PERMITTED IN ARBITRATION UNDER THIS SECTION. [COUNSEL: full clause; mass- arbitration protocol; public-injunction carve-out for California; carve-outs; severability; state-law review]

HidzoVPN, Inc. · Legal Information page: [OPEN: https://hidzovpn.com/legal] · Support: [email protected] · Legal notices: [OPEN: [email protected]]

To report abuse of our Services, email [OPEN: [email protected] — mailbox to be created] with the IP address, date, time and time zone, and a description.

[OPEN: [email protected]] · See also our Privacy Policy.

Privacy questions and requests about your personal information · [OPEN: [email protected] — mailbox to be created].

Reporting a security vulnerability · [OPEN: [email protected] — mailbox to be created].

Reporting abuse of our service (spam, attacks or other misuse coming from our servers) · [OPEN: [email protected] — mailbox to be created].

Legal notices · [OPEN: [email protected] — mailbox to be created], with a copy by post to the mailing address above

Requests from courts, government or law-enforcement authorities · [OPEN: [email protected] — restricted mailbox to be created].

Point of contact for authorities of EU Member States, the European Commission and the European Board for Digital Services (Digital Services Act, Article 11) · [OPEN: dedicated email address].

By email · Email [OPEN: [email protected]] from your account email with the subject "Delete Account"

Email [OPEN: [email protected]] and tell us what you want deleted. [ENGINEERING: confirm which categories can be deleted separately]

You can also ask us to delete it by emailing [OPEN: [email protected]] with the installation identifier shown in [ENGINEERING: Settings → About].

Email [OPEN: [email protected]].

Send requests by email to [OPEN: [email protected]].

If you believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay, send an emergency request to [OPEN: [email protected]] with the subject "EMERGENCY".

Email [OPEN: [email protected]] [OPEN: with our PGP key at https://hidzovpn.com/.well-known/pgp-key.txt].

Questions: [OPEN: [email protected]].

Questions, complaints or claims about the app may be sent to HidzoVPN, Inc., 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States; [OPEN: telephone — QN-01-015]; [OPEN: [email protected]].

RSK-046], [OPEN: telephone], [email protected]: — I/We hereby give notice that I/We withdraw from my/our contract for the provision of the following service: HidzoVPN Premium — Ordered on — Name of consumer(s) — Address of consumer(s) — Signature of consumer(s) (only if this form is notified on paper) — Date (Optional: account email, to help us find your account.) [COUNSEL: optional field added to the CRD Annex I(B) model form — acceptable?

Telephone · [OPEN: company-owned number that is answered — QN-01-015]

VAT or other tax identification number · [OPEN: only if registered — BRF-2026-001 P2-6]

Legal representative in the European Union (Digital Services Act, Article 13) · [OPEN: name, postal address, email address and telephone number of the representative, once designated]

EU representative (GDPR Article 27): [OPEN: name and address. Assessment: the Art. 27(2)(a) exemption is unlikely to apply to continuous processing]

UK representative (UK GDPR Article 27): [OPEN]

Languages: [OPEN: English and an official language of the Member State where our Article 13 representative is established — DSA Art. 11(3)]

Point of contact for users of our service (Digital Services Act, Article 12) · [OPEN: at least two means, e.g. email and a web form, not relying solely on automated tools — DSA Art. 12(1)]

To appeal, email the same address with the subject "Privacy Appeal" within [OPEN: 60] days of our decision.

We will review your appeal and reply [OPEN: within X business days].

Approved refunds are returned to the original payment method [OPEN: within X business days of approval].

HidzoVPN, Inc. · [email protected] · Legal Information page: [OPEN: https://hidzovpn.com/legal] [OPEN: state a response time only if support can meet it] [OPEN: link to a complaints procedure — Payments Rulebook §5.6]

HidzoVPN, Inc. · [email protected] · Legal Information page: [OPEN: https://hidzovpn.com/legal] [OPEN: state a response time only if support can meet it] [OPEN: link to a complaints procedure — Payments Rulebook §5.6]

[OPEN: state an acknowledgement time for each channel only if operations can meet it]

Changes to this list. We update this list when we add or replace a service provider [OPEN: advance notice period, if any].

For website purchases, our payment processor [OPEN: Stripe entity] collects your payment details; we receive [ENGINEERING: e.g. a payment token, card type and last four digits, billing country and payment status]. [OPEN — BRF-2026-001 D7: cryptocurrency purchases — wallet address, transaction hash, asset and amount]

9.1 Premium can be bought through the Apple App Store, Google Play or our website [OPEN: other channels], or obtained with an Activation Code (Section 9.7).

For website purchases, HidzoVPN is the seller and our payment processor [OPEN: Stripe entity] processes the payment.

10.1 A free trial, where offered, lasts for the period shown when you sign up [OPEN: one trial length on every channel — CLM-031].

11.1 EXCEPT FOR CRYPTOCURRENCY PREPAYMENTS (SECTION 9.5) AND ACTIVATION CODES (SECTION 9.7), YOUR SUBSCRIPTION RENEWS AUTOMATICALLY AT THE END OF EACH BILLING PERIOD, AND YOU WILL BE CHARGED THE THEN-CURRENT PRICE FOR THE SAME BILLING PERIOD, UNTIL YOU CANCEL. You can cancel at any time (Section 12). [OPEN: if plans of one year or longer are offered, COUNSEL on German and French renewal rules]

18.2 If we permanently stop providing a paid subscription that you bought on our website before the end of its paid period, and not because you broke these Terms, we will refund the unused part of the period or offer you an equivalent service [OPEN: confirm].

If you cancel a website trial, you keep Premium until the trial ends [ENGINEERING]. [OPEN: an additional reminder before the trial ends — timing; card-network rules require the reminder content for trials of 7 days or less to be in the sign-up confirmation — EV-406]

Contact details for each purpose are on our Legal Information page [OPEN: link].

See our Cookie Notice [OPEN: link — POL-COOK-001].

See our Cookie Notice [OPEN: link] for our website.

The current list is in our List of Service Providers [OPEN: link — POL-SUB-001].

Authorities, courts and parties to legal proceedings, when we are legally required to do so, or in an emergency involving danger of death or serious physical injury, as described in our Law Enforcement Guidelines [OPEN: link — POL-LE-001] [COUNSEL: whether to include voluntary emergency disclosure — Section 2].

You can delete your account in the app or as described in our Account and Data Deletion Policy [OPEN: link — POL-DEL-001] [ENGINEERING: in-app and web deletion]. Deleting your account cancels the renewal of a subscription bought on our website, but not of a subscription billed by Apple or Google [ENGINEERING: automatic cancellation of the Stripe subscription].

HidzoVPN, Inc., 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States · Privacy: [OPEN: [email protected]] · Legal Information page: [OPEN: link].

Our business address, telephone number and contact addresses for each purpose are listed on our Legal Information page at [OPEN: https://hidzovpn.com/legal].

We respond to requests from courts, governments and law-enforcement authorities as described in our Law Enforcement Guidelines [OPEN: link — POL-LE-001].

HidzoVPN, Inc. · Legal Information page: [OPEN: https://hidzovpn.com/legal] · Support: [email protected] · Legal notices: [OPEN: [email protected]]

If you find a security vulnerability in our Services, please follow our Vulnerability Disclosure Policy [OPEN: link — POL-VDP-001].

HidzoVPN, Inc. · [email protected] · Legal Information page: [OPEN: https://hidzovpn.com/legal] [OPEN: state a response time only if support can meet it] [OPEN: link to a complaints procedure — Payments Rulebook §5.6]

Your Privacy Choices: [OPEN: link] — applies where U.S. state law gives you a right to opt out of the sale or sharing of personal information or of targeted advertising [COUNSEL: which state laws apply].

See our Law Enforcement Guidelines [OPEN: link — POL-LE-001]

Terms of Service · [OPEN: link on publication]

Privacy Policy · [OPEN]

Refund and Cancellation Policy · [OPEN]

Acceptable Use Policy · [OPEN]

Cookie Notice · [OPEN]

Account and Data Deletion Policy · [OPEN]

List of Service Providers · [OPEN]

Law Enforcement Guidelines · [OPEN]

Vulnerability Disclosure Policy · [OPEN]

We process your contact details as described in our Privacy Policy [OPEN: link; confirm the Privacy Policy covers researcher data].

The Services are for people aged 18 and over [OPEN: align store age ratings — BRF-2026-001 P2-4].

3.1 You must be at least 18 years old and able to enter into a binding contract. [OPEN: align app-store age ratings with this rule — BRF-2026-001 P2-4]

Earlier versions are available on request [OPEN: or archive].

We will publish the new version with its effective date and keep earlier versions available [OPEN: archive].

Earlier versions of these documents are available on request at the legal-notices address. [OPEN: or publish a version archive]

We do not record the websites you visit, the content of your traffic or your DNS queries [ENGINEERING: logging attestation, EV-201–EV-205; claims register entry required].

We do not use VPN traffic for advertising, analytics or profiling. [ENGINEERING: attestation required for both sentences; claims register entry required]

We do not sell your VPN traffic, browsing destinations or DNS queries, and we do not keep records of them that could be disclosed [ENGINEERING: attestation]. [OPEN — depends on Section 2:] Under some U.S. state laws, giving advertising providers identifiers or app activity for targeted advertising may count as "selling", "sharing" or "targeted advertising" even if no money is paid.

We do not monitor the content of your traffic or the websites you visit [ENGINEERING: attestation required; must match Privacy Policy §3.3].

We do not record the websites you visit, the content of your traffic or your DNS queries [ENGINEERING: attestation EV-201, EV-202; claims register entry required — CLM-034].

We keep connection information only as described in Sections 3.3 and 11 of our Privacy Policy. [ENGINEERING: complete — "We therefore cannot link a VPN server IP address and time to a particular user" / "We can link a VPN server IP address and time to a user only within X minutes of the connection" — must match the Law Enforcement Guidelines §3; register as a claim in the Claims Register]

DigitalOcean — VERIFY entity] · Hosting of servers and systems [VERIFY] · Network traffic passing through servers they host, including IP addresses [ENGINEERING: whether any connection records are stored on provider systems] · [COUNSEL: country only, or city — law-enforcement exposure (RSK-030)] · [EU (no transfer) / Data Privacy Framework / Standard Contractual Clauses / UK Addendum / Swiss FADP]`

[DNS resolution — ENGINEERING: own resolver or third party (EV-202)] · Resolving domain names · [ENGINEERING: DNS queries — must be consistent with Privacy Policy §3.3] · [ ] · [ ]

The table below describes the records we keep in the ordinary course of business as of [OPEN: date], and how long we keep them (see Section 11 of our Privacy Policy). [ENGINEERING and COUNSEL: every row must match the logging attestation (EV-201–205) and the Privacy Policy exactly] [COUNSEL: wording on orders that require future collection]

Content of a user's internet traffic · [ENGINEERING: No — attestation EV-201; claims register approval] · —

Websites or destinations visited, and DNS queries, through the VPN · [ENGINEERING: No — EV-201, EV-202] · —

What we do keep: limited account, subscription, device and connection information needed to run the service, apply plan limits, prevent abuse and meet legal duties, for the periods in Section 11 [ENGINEERING].

One-time sign-in codes expire after [ENGINEERING: 10 minutes] and are stored only in protected form [ENGINEERING].

One-time sign-in codes expire after [ENGINEERING: 10 minutes] and are stored only in protected form [ENGINEERING].

[ENGINEERING and FINANCE: each period must be implemented before publication — POL-RET-000]

Account information · While your account exists; deleted within 30 days after we receive a deletion request, or after you confirm it if we ask you to [ENGINEERING]

Sign-in codes · Until they expire ([ENGINEERING: 10 minutes])

Sign-in sessions and tokens · Until you sign out or they expire, and no longer than [ENGINEERING: 30 days]

Free Service limit state (installation identifier and timing) · [ENGINEERING]

Linked devices · While your account exists [ENGINEERING]

Live VPN session information · While the connection is active and up to [ENGINEERING: 15 minutes] after it ends

Usage statistics linked to an account or device · [ENGINEERING: 24 hours], then deleted or de-identified

API, security and abuse records · Up to [ENGINEERING: 30 days]; up to 24 months where needed for a specific incident, dispute or legal obligation

Blocked device and payment identifiers (fraud and abuse) · Up to [ENGINEERING and COUNSEL: 24 months], or longer only for a documented incident or legal claim

Crash and diagnostic reports · Up to [ENGINEERING: 90 days]

Analytics and advertising measurement · Up to [ENGINEERING: 13 months]

Backups · Deleted information is removed from backups within [ENGINEERING: 90 days]

Depending on how serious the problem is, whether it has happened before and the law, we may: warn you; limit or block certain functions or ports; block a device or payment method [ENGINEERING and COUNSEL: retention of blocked identifiers — Privacy Policy §11]; suspend your access; or close your account.

Account information (email, account identifier, linked devices, settings) · Deleted from our active systems within 30 days after we receive your request, or after you confirm it if we ask you to [ENGINEERING]

Connection information · Deleted on the schedule in Section 11 of our Privacy Policy; any that still exists when you delete your account is deleted within [ENGINEERING]

Analytics and advertising measurement linked to your account or device · Deleted or de-identified in our systems; we send deletion requests to our service providers [ENGINEERING: list]

Records needed to prevent fraud or abuse, including device and payment identifiers blocked under our Acceptable Use Policy · Kept for up to 24 months, or longer only for a documented incident or legal claim [ENGINEERING and COUNSEL]

Backups · Deleted information is removed when backups expire, within [ENGINEERING: 90 days]

IP address from which a user connects to a VPN server; server, tunnel address, start and end times, data volume (live session information) · [ENGINEERING] · Up to [ENGINEERING: 15 minutes] after the connection ends

IP address from which a user connects to a VPN server; server, tunnel address, start and end times, data volume (live session information) · [ENGINEERING] · Up to [ENGINEERING: 15 minutes] after the connection ends

Usage statistics linked to an account or device · [ENGINEERING] · [ENGINEERING: 24 hours]

Usage statistics linked to an account or device · [ENGINEERING] · [ENGINEERING: 24 hours]

Sign-in sessions and tokens · [ENGINEERING] · No longer than [ENGINEERING: 30 days]

Sign-in sessions and tokens · [ENGINEERING] · No longer than [ENGINEERING: 30 days]

Free Service limit state (installation identifier and timing) · [ENGINEERING] · [ENGINEERING]

Free Service limit state (installation identifier and timing) · [ENGINEERING] · [ENGINEERING]

Marketing preferences · [ENGINEERING] · Until the user unsubscribes; a minimal suppression record is kept

IP address used to reach our apps, website and account systems (API, security and abuse records) · [ENGINEERING] · Up to [ENGINEERING: 30 days]; up to 24 months where needed for a specific incident, dispute or legal obligation

IP address used to reach our apps, website and account systems (API, security and abuse records) · [ENGINEERING] · Up to [ENGINEERING: 30 days]; up to 24 months where needed for a specific incident, dispute or legal obligation

Account email, sign-in method, Apple or Google identifier, linked devices · Yes, for users with an account [ENGINEERING] · While the account exists

Installation or device identifier, device model and operating system · [ENGINEERING] · [ENGINEERING]

Installation or device identifier, device model and operating system · [ENGINEERING] · [ENGINEERING]

Blocked device and payment identifiers (fraud and abuse) · [ENGINEERING] · Up to [ENGINEERING and COUNSEL: 24 months], or longer only for a documented incident or legal claim

Blocked device and payment identifiers (fraud and abuse) · [ENGINEERING] · Up to [ENGINEERING and COUNSEL: 24 months], or longer only for a documented incident or legal claim

Subscription and payment records (plan, dates, amounts, payment token and last four digits of a card) · [ENGINEERING: Yes, for website purchases; limited records for Apple and Google purchases — PP §3.4] · For the period tax and accounting law requires [VERIFY and tax counsel]

Crash and diagnostic reports · [ENGINEERING] · Up to [ENGINEERING: 90 days]

Crash and diagnostic reports · [ENGINEERING] · Up to [ENGINEERING: 90 days]

Analytics and measurement data · [ENGINEERING] · Up to [ENGINEERING: 13 months]

Analytics and measurement data · [ENGINEERING] · Up to [ENGINEERING: 13 months]

Support messages · [ENGINEERING: Yes] · Up to 12 months after the request is closed, or until the account is deleted, unless needed for an open matter

Push token · [ENGINEERING] · Until it becomes invalid, notifications are disabled or the account is deleted, then up to 30 days

Records of privacy requests · [ENGINEERING: Yes] · Up to 5 years [COUNSEL]

Backups · [ENGINEERING] · Up to [ENGINEERING: 90 days]

Backups · [ENGINEERING] · Up to [ENGINEERING: 90 days]

If you create an account: your email address, an internal account identifier, your plan and subscription status, the devices linked to your account and your sign-in method [ENGINEERING: fields].

If you sign in with Apple or Google, we receive an identifier and the email address the provider shares (Apple may share a private relay address) [ENGINEERING: sign-in methods offered].

When you use the app, with or without an account: an installation or device identifier, device model, operating system and app version, language, time zone and the IP address used to contact our servers [ENGINEERING: fields].

In the Free Service, the installation identifier is used to apply session limits and waiting periods and to prevent abuse [ENGINEERING: EV-205].

To connect you, our systems process: your IP address at the time of connection, a session identifier, your account or installation identifier, the server and protocol selected, the internal tunnel address, connection status and errors, the number of simultaneous connections, connection start and end times and the amount of data transferred [ENGINEERING: confirm each field, where it is stored and for how long — EV-201, EV-205].

For website purchases, our payment processor [OPEN: Stripe entity] collects your payment details; we receive [ENGINEERING: e.g. a payment token, card type and last four digits, billing country and payment status]. [OPEN — BRF-2026-001 D7: cryptocurrency purchases — wallet address, transaction hash, asset and amount]

Crash reports, app performance data, API request records, sign-in attempts, rate-limit events and abuse reports, used to keep the Services working and secure [ENGINEERING: whether these records contain IP addresses — CLM-024].

Using the Free Service without an account does not require them, but the app cannot connect without the device and connection information in Sections 3.2 and 3.3 [ENGINEERING: confirm].

Identifiers · Email, account ID, installation ID, IP address [ENGINEERING] · You; your device;

We use automated rules to authenticate sessions, apply plan and device limits, and detect suspicious sign-ins, payments and abuse [ENGINEERING: confirm].

Sign-in methods are those shown in the app [ENGINEERING: e.g. email with a one-time code, Sign in with Apple, Google Sign-In].

Split tunneling · The list of apps installed on your device, to let you choose which apps use the VPN [ENGINEERING: platforms] · On your device [ENGINEERING: confirm]

Split tunneling · The list of apps installed on your device, to let you choose which apps use the VPN [ENGINEERING: platforms] · On your device [ENGINEERING: confirm]

Trusted networks / auto-connect · Wi-Fi network names · On your device [ENGINEERING: confirm]

Location / local network permission · [ENGINEERING: whether requested, and why] · [ENGINEERING]

Location / local network permission · [ENGINEERING: whether requested, and why] · [ENGINEERING]

QR code scanning · Camera, only when you choose to scan [ENGINEERING] · The image is not stored or uploaded [ENGINEERING: confirm]

QR code scanning · Camera, only when you choose to scan [ENGINEERING] · The image is not stored or uploaded [ENGINEERING: confirm]

Paste / import · Clipboard, only when you tap Paste or Import [ENGINEERING] · On your device [ENGINEERING: confirm]

Paste / import · Clipboard, only when you tap Paste or Import [ENGINEERING] · On your device [ENGINEERING: confirm]

Custom configurations (BYOC) · Configuration files, keys and credentials you import · On your device, encrypted [ENGINEERING: confirm]

Notifications · A push token · Sent to Apple or Google to deliver notifications; [ENGINEERING: whether stored on our servers]

Weekly statistics · Your usage statistics · [ENGINEERING: on device or on our servers — if on servers, reconcile with Section 11]

[OPEN — depends on Section 2 and the SDK inventory (EV-206)] Where advertising is shown, the advertising provider may receive [ENGINEERING: list].

Measurement and analytics tools may receive app events such as installation, account creation, trial start and purchase [ENGINEERING: named tools and events].

We do not send VPN traffic, DNS queries, destinations, sign-in codes or payment details to these providers [ENGINEERING: EV-206].

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account [ENGINEERING: confirm] [COUNSEL: which state laws apply — EV-233].

In our apps, [ENGINEERING: describe the storage of or access to information on your device that is not strictly necessary, the consent tool used (for example Google UMP or App Tracking Transparency), and how to change your choice].

You can: update your account information; unsubscribe from marketing emails; change advertising and tracking choices in the app and in your device settings, including Apple's App Tracking Transparency [OPEN — D4]; change cookie choices on our website [ENGINEERING: consent management — BRF-2026-001 P2-2]; change device permissions in your device settings; and delete your account.

Guest access may use automatic server selection, limit session length and apply waiting periods between sessions [ENGINEERING: current values]. [OPEN — BRF-2026-001 D4: on the platforms where advertising is shown, guest access may show advertising and offer optional rewarded advertising to shorten a waiting period; this sentence must match the Privacy Policy §2 alternative chosen]

4.4 Devices and sharing. Unless your plan says otherwise, a Premium account may be used on up to five supported devices that you own or control, with up to five simultaneous connections [ENGINEERING: confirm backend limits — CLM-019].

5.1 Free Service. The Free Service includes VPN connectivity with the limits shown in the app [ENGINEERING: current values].

5.2 Premium. Premium features are those described in the offer, store listing or checkout screen when you buy [ENGINEERING: e.g. manual server and protocol selection, no in-app advertising, no session time limit, kill switch].

5.3 Platforms. The Services are available only on the platforms for which we offer an official download [ENGINEERING: current list, e.g. iOS and Android].

6.3 Open-source components are licensed under their own licenses, which prevail for those components. [ENGINEERING: publish the list of open-source licenses in the app — roadmap #29]

7.1 When the connection is active and working, the VPN encrypts traffic between your device and the VPN server you connect to [ENGINEERING: protocol and cipher matrix — CLM-008].

A server location shown in the app may be a virtual location that differs from the physical location of the server [ENGINEERING: confirm whether virtual locations are used].

You can delete your account in the app or as described in our Account and Data Deletion Policy [OPEN: link — POL-DEL-001] [ENGINEERING: in-app and web deletion]. Deleting your account cancels the renewal of a subscription bought on our website, but not of a subscription billed by Apple or Google [ENGINEERING: automatic cancellation of the Stripe subscription].

You accept these Terms when you tick the box or tap the button that says you agree to them, which we show before you create an account, start a trial or make a purchase [ENGINEERING: clickwrap at each of these points, and at first launch for guest use].

For trials on our website, the deadline is shown at sign-up and in your confirmation [ENGINEERING: confirmation email].

EV-232]` [ENGINEERING: reminder channel for users without an email address].

You keep Premium until the end of the period you have paid for, unless you receive a refund [ENGINEERING: QN-08-020].

12.2 Apple: cancel in your Apple Account subscription settings. Google Play: cancel in Google Play subscriptions. Website purchases: cancel online in your HidzoVPN account at [ENGINEERING: self-service cancellation page]; you can also email [email protected] with the subject "Cancel Subscription" from your account email, or include that address in your message.

Online cancellation is available without any further step that delays or obstructs it [ENGINEERING: if a retention offer is shown, a clearly labeled "click to cancel" option must be shown with it — Cal. Bus. & Prof. Code §17602(d), (e)(2); EV-226].

Deleting your account cancels the renewal of a subscription bought on our website [ENGINEERING: automatic cancellation of the Stripe subscription — POL-DEL-001 §1], but not of a subscription billed by Apple or Google; cancel those with the store first.

To withdraw, use the "Withdraw from contract here" function in your account [ENGINEERING: withdrawal function live — RSK-051] or contact us.

Deleting your account cancels the renewal of a subscription bought on our website [ENGINEERING: POL-DEL-001 §1], but does not cancel a subscription billed by Apple or Google.

It applies to everyone who uses HidzoVPN, with or without an account [ENGINEERING: first-launch acceptance screen that covers guest users].

Except for cryptocurrency prepayments (Section 6) and Activation Codes (Section 5A), your subscription renews automatically until you cancel [ENGINEERING: confirm the renewal configuration in Stripe, Apple and Google — CLM-025].

You keep Premium until the end of the period you have already paid for, unless you receive a refund [ENGINEERING: QN-08-020].

Our website (including purchases made in the Android app downloaded from our website [ENGINEERING: confirm billing path]) · Online in your account: [ENGINEERING: Account → Subscription → Cancel subscription].

Our website (including purchases made in the Android app downloaded from our website [ENGINEERING: confirm billing path]) · Online in your account: [ENGINEERING: Account → Subscription → Cancel subscription].

Germany · Use the "Verträge hier kündigen" button at [ENGINEERING: URL] [COUNSEL: §312k BGB; whether it may sit behind sign-in]

France · Use the cancellation function at [ENGINEERING: URL] [COUNSEL: Code de la consommation L.215-1-1]

Deleting your account cancels the renewal of a website subscription [ENGINEERING: POL-DEL-001 §1], but not of an Apple or Google subscription.

Times for website purchases are shown in [ENGINEERING: time zone].

When you start a trial on our website, we send you a confirmation that states the date the trial ends, the price that will be charged after it and a link to cancel online [ENGINEERING].

If you cancel a website trial, you keep Premium until the trial ends [ENGINEERING]. [OPEN: an additional reminder before the trial ends — timing; card-network rules require the reminder content for trials of 7 days or less to be in the sign-up confirmation — EV-406]

4.2 To withdraw, use the "Withdraw from contract here" function in your account, then confirm with "Confirm withdrawal"; we send you an acknowledgement by email straight away [ENGINEERING: withdrawal function, available throughout the withdrawal period — RSK-051].

If you cancel within the 14-day period, we will ask whether you also want to withdraw and receive a refund under this Section [ENGINEERING: prompt in the cancellation flow].

You can delete your account in the app or as described in our Account and Data Deletion Policy [OPEN: link — POL-DEL-001] [ENGINEERING: in-app and web deletion]. Deleting your account cancels the renewal of a subscription bought on our website, but not of a subscription billed by Apple or Google [ENGINEERING: automatic cancellation of the Stripe subscription].

If you use the app without an account, include the installation identifier shown in [ENGINEERING: Settings → About].

It is issued by HidzoVPN, Inc., a Florida corporation, and supplements our Privacy Policy. [OPEN: the app and developer name shown here must match the Google Play listing — Google Play Help 13327111]

If you bought Premium on our website, deleting your account also cancels its renewal, and you will not be charged again [ENGINEERING: automatic cancellation of the Stripe subscription when the account is deleted].

Cancel it first in your Apple or Google account, as explained in our Refund and Cancellation Policy; otherwise Apple or Google will continue to charge you. [ENGINEERING: the in-app deletion flow shows this warning and a link to the store's subscription page]

In the app · [ENGINEERING: Settings → Account → Delete account]

On the web (you do not need the app) · [ENGINEERING: https://hidzovpn.com/delete-account] — sign in with a one-time code sent to your account email and confirm

We will email you when the deletion is complete. [ENGINEERING: revoke Sign in with Apple tokens and disconnect Google sign-in on deletion]

Email [OPEN: [email protected]] and tell us what you want deleted. [ENGINEERING: confirm which categories can be deleted separately]

Information linked to your installation is removed from our active systems [ENGINEERING: when — e.g. after X days of inactivity or when you delete the app and the installation identifier expires].

You can also ask us to delete it by emailing [OPEN: [email protected]] with the installation identifier shown in [ENGINEERING: Settings → About].

We may ask you to confirm the request from the app on that device [ENGINEERING].

If you still have an Apple or Google subscription, it continues until you cancel it with them [ENGINEERING: whether it can be restored to a new account].

We use administrative, technical and physical measures to protect personal information [ENGINEERING: list only measures in place, e.g. encryption in transit, access controls, monitoring of our systems].

[ENGINEERING: state the method. If P2P is limited by blocking ports: "We may block ports commonly used for peer-to-peer file sharing on some servers. We do not inspect the content of your traffic to do so." If limiting P2P requires classifying or inspecting traffic, this section and Section 3 must be rewritten to describe it — RSK-028.] Where peer-to-peer file sharing is available, you may use it only for content you have the right to share.

automated protections that do not inspect the content of your traffic, such as limits on connection rates, blocked outbound ports (for example, ports commonly used to send spam) and limits on simultaneous connections [ENGINEERING: list the controls actually in place]; and

See our Vulnerability Disclosure Policy and https://hidzovpn.com/.well-known/security.txt [ENGINEERING]

We also offer an Android app for download from our website at [ENGINEERING: official download URL]; we publish the SHA-256 checksum of the current release and the fingerprint of our signing certificate at [ENGINEERING: URL].

We also offer an Android app for download from our website at [ENGINEERING: official download URL]; we publish the SHA-256 checksum of the current release and the fingerprint of our signing certificate at [ENGINEERING: URL].

Email [OPEN: [email protected]] [OPEN: with our PGP key at https://hidzovpn.com/.well-known/pgp-key.txt].

Our contact details are also published in https://hidzovpn.com/.well-known/security.txt [ENGINEERING: file live — RFC 9116].

We will acknowledge your report within [OPEN: 3] business days [ENGINEERING: owner named; rota in place].

We will acknowledge your report within [OPEN: 3] business days [ENGINEERING: owner named; rota in place].

We will tell you at least every [OPEN] days whether the issue is still open [ENGINEERING].

We will tell you at least every [OPEN] days whether the issue is still open [ENGINEERING].

We will tell you when the vulnerability has been fixed [ENGINEERING].

In scope: the HidzoVPN iOS app from the App Store; the HidzoVPN Android app from Google Play or our website; the domains listed here [OPEN: list]; and our VPN servers when you connect to them as an ordinary user of your own account.

keep the details confidential until the earlier of [OPEN: 30] days after we release a fix and [OPEN: 90] days after your report, unless we agree another date in writing.

keep the details confidential until the earlier of [OPEN: 30] days after we release a fix and [OPEN: 90] days after your report, unless we agree another date in writing.

To opt out of the sale or sharing of personal information or targeted advertising, use [OPEN: "Your Privacy Choices" link] or send a Global Privacy Control signal (Section 7).

This notice explains how HidzoVPN, Inc. uses cookies and similar technologies on hidzovpn.com and its subdomains [OPEN: list other domains, e.g. help center].

[ENGINEERING and MARKETING: complete from the GTM export and a production cookie scan (EV-212). One row per cookie. Remove any category that is not used. Cookie lifetimes must not exceed the periods in Privacy Policy §11.]

Strictly necessary · Security, checkout, remembering your cookie choices [ENGINEERING: and sign-in, if the website has sign-in] · [ ] · HidzoVPN / [ ] · [ ] · No consent needed · No consent needed

Cookie settings: you can accept or reject non-essential cookies, and change your choice at any time, using [ENGINEERING: "Cookie settings" link in the website footer]. [ENGINEERING: the first layer offers Accept and Reject with equal prominence]

Cookie settings: you can accept or reject non-essential cookies, and change your choice at any time, using [ENGINEERING: "Cookie settings" link in the website footer]. [ENGINEERING: the first layer offers Accept and Reject with equal prominence]

Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account, and we show on the website that your signal has been honored [ENGINEERING: confirm; status display] [COUNSEL: which state laws apply — EV-233].