Privacy Policy

Version: 2.2 [OPEN] · Effective: [OPEN] · Last updated: [OPEN]

[COUNSEL]

Summary

• Who we are: HidzoVPN, Inc., a Florida corporation, is responsible for your personal information when you use HidzoVPN.
• Your VPN traffic: while the VPN is on, your internet traffic passes through our servers so that it can reach its destination. We do not record the websites you visit, the content of your traffic or your DNS queries [ENGINEERING].
• What we do keep: limited account, subscription, device and connection information needed to run the service, apply plan limits, prevent abuse and meet legal duties, for the periods in Section 11 [ENGINEERING].
• Advertising: [OPEN]
• Your choices and rights: Sections 13 to 16.

This Privacy Policy explains how HidzoVPN, Inc. ("HidzoVPN", "we", "us" or "our") collects, uses, shares and protects personal information when you use our apps, websites, VPN service, accounts, billing and support (the "Services").

1. Who is responsible for your information

HidzoVPN, Inc., a Florida profit corporation (Florida Department of State document number P25000060442), is the controller of the personal information described in this Policy. Mailing address: 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States. Contact details for each purpose are on our Legal Information page [OPEN]. Privacy requests: [OPEN].

Apple and Google (for app-store purchases and distribution) [COUNSEL] process some information under their own privacy notices, as independent businesses.

2. Our commitment for the VPN service

[OPEN]

Alternative A — no third-party data disclosure in the iOS app: In our iOS app, we do not sell data to third parties, and we do not disclose data to third parties or allow third parties to use it for their own purposes. We disclose data only to service providers that process it on our instructions to provide the Services, and where the law requires us to do so. [COUNSEL]

Alternative B — iOS as in Alternative A; advertising in the Free Service on Android and the website: [COUNSEL and ENGINEERING]

3. Information we process

3.1 Account information

If you create an account: your email address, an internal account identifier, your plan and subscription status, the devices linked to your account and your sign-in method [ENGINEERING]. If you sign in with Apple or Google, we receive an identifier and the email address the provider shares (Apple may share a private relay address) [ENGINEERING]. We do not receive your Apple or Google password. One-time sign-in codes expire after [ENGINEERING] and are stored only in protected form [ENGINEERING].

3.2 Device and app information

When you use the app, with or without an account: an installation or device identifier, device model, operating system and app version, language, time zone and the IP address used to contact our servers [ENGINEERING]. In the Free Service, the installation identifier is used to apply session limits and waiting periods and to prevent abuse [ENGINEERING].

3.3 VPN connection information

To connect you, our systems process: your IP address at the time of connection, a session identifier, your account or installation identifier, the server and protocol selected, the internal tunnel address, connection status and errors, the number of simultaneous connections, connection start and end times and the amount of data transferred [ENGINEERING]. We use this information to establish and end connections, enforce device and plan limits, keep the network reliable and prevent abuse. Section 11 states how long it is kept.

We do not record the content of your VPN traffic, the websites or destinations you visit, or your DNS queries, and we do not keep a history that links those destinations to you. We do not use VPN traffic for advertising, analytics or profiling. [ENGINEERING]

The IP address from which you connect is visible to our systems while the connection is set up. The providers that host our servers and the networks that carry traffic may process network information under their own legal obligations.

3.4 Purchase information

For trials and subscriptions: plan, purchase channel, transaction identifiers, dates, price, currency, billing country, subscription and refund status and fraud signals. Apple and Google process payments for store purchases and send us confirmation of your entitlement. For website purchases, our payment processor [OPEN] collects your payment details; we receive [ENGINEERING]. [OPEN]

3.5 Advertising and measurement information

[OPEN] Where advertising is shown, the advertising provider may receive [ENGINEERING]. Measurement and analytics tools may receive app events such as installation, account creation, trial start and purchase [ENGINEERING]. We do not send VPN traffic, DNS queries, destinations, sign-in codes or payment details to these providers [ENGINEERING].

3.6 Diagnostics and security information

Crash reports, app performance data, API request records, sign-in attempts, rate-limit events and abuse reports, used to keep the Services working and secure [ENGINEERING].

3.7 Support and communications

Messages and attachments you send us, and records of our replies. If you agree to receive marketing emails, your email address and your preference.

3.8 Website information

IP address, browser and device type, pages viewed and cookie identifiers. See our Cookie Notice [OPEN].

3.9 Information from other sources

We receive information from: Apple and Google (sign-in, purchases and entitlements); our payment processor (payment status and fraud signals); [OPEN]; [OPEN]; and people who report abuse, security vulnerabilities or legal issues to us.

3.10 What you must provide

You must give us an email address or sign-in identifier to create an account, and payment information to buy on our website. Without them we cannot provide those parts of the Services. Using the Free Service without an account does not require them, but the app cannot connect without the device and connection information in Sections 3.2 and 3.3 [ENGINEERING].

4. Features that use information on your device

5. Why we use information

To provide and secure the Services; to manage accounts, subscriptions and billing; to apply Free Service limits and device limits; to prevent fraud and abuse and enforce our Terms; to monitor the reliability and performance of our systems; to measure how the apps are used and how users find us, without using VPN traffic; [OPEN]; to respond to requests; to send service messages and, with your agreement where required, marketing; and to meet legal obligations and defend legal claims.

6. Legal bases (European Economic Area, United Kingdom, Switzerland)

You may withdraw consent at any time; this does not affect processing that took place before.

7. Sale, sharing and targeted advertising

We do not sell personal information for money. We do not sell your VPN traffic, browsing destinations or DNS queries, and we do not keep records of them that could be disclosed [ENGINEERING]. [OPEN] Under some U.S. state laws, giving advertising providers identifiers or app activity for targeted advertising may count as "selling", "sharing" or "targeted advertising" even if no money is paid. Where those laws apply to us, you can opt out as described in Section 16. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account [ENGINEERING] [COUNSEL].

8. Cookies and similar technologies

See our Cookie Notice [OPEN] for our website. In our apps, [ENGINEERING].

9. Who we share information with

• Service providers that host our servers and systems, deliver email and notifications, provide customer support, process payments, measure app performance and help prevent fraud. We require them to protect the information to the same standard as this Policy and to use it only to provide their services to us [VERIFY]. The current list is in our List of Service Providers [OPEN].
• Apple and Google, for app-store purchases and distribution, and our payment processor for website purchases [COUNSEL].
• Advertising and measurement providers [OPEN].
• Authorities, courts and parties to legal proceedings, when we are legally required to do so, or in an emergency involving danger of death or serious physical injury, as described in our Law Enforcement Guidelines [OPEN] [COUNSEL]. We can only provide information we actually hold.
• Resellers [OPEN]: the contact details of a person who bought an Activation Code from that reseller, only where needed to resolve a specific support or fraud case; we do not tell resellers whether or by which account a code was activated [POL].
• A buyer or successor of our business, subject to this Policy.
• Anyone else, with your permission [COUNSEL].

10. International transfers

We are based in the United States. Your information is processed in the United States and in the countries where our service providers and VPN servers are located [OPEN]. The European Commission has adopted an adequacy decision for the United States only for organizations certified under the EU-U.S. Data Privacy Framework; HidzoVPN [OPEN] certified [VERIFY]. For transfers from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or other lawful safeguards [COUNSEL]. You can ask us for a copy of the relevant safeguards.

11. How long we keep information

[ENGINEERING and FINANCE]

"De-identified" means information that can no longer reasonably be linked to you; we do not try to re-identify it.

12. Deleting your account

You can delete your account in the app or as described in our Account and Data Deletion Policy [OPEN] [ENGINEERING]. Deleting your account cancels the renewal of a subscription bought on our website, but not of a subscription billed by Apple or Google [ENGINEERING]. After deletion, we keep some information for the periods in Section 11, for example tax records, fraud and security records, and information covered by a legal hold.

13. Your choices

You can: update your account information; unsubscribe from marketing emails; change advertising and tracking choices in the app and in your device settings, including Apple's App Tracking Transparency [OPEN]; change cookie choices on our website [ENGINEERING]; change device permissions in your device settings; and delete your account.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, to opt out of the sale or sharing of personal information or targeted advertising, and not to be treated differently for exercising these rights.

To make a request, email [OPEN] from your account email and tell us which right you want to use. If you use the app without an account, include the installation identifier shown in [ENGINEERING]. We will verify your request in a way that is proportionate and will reply within the time the law requires. If we refuse your request, we will explain why. To appeal, email the same address with the subject "Privacy Appeal" within [OPEN] days of our decision. Please do not send identity documents, passwords, sign-in codes or payment card numbers.

You can also complain to the data-protection authority where you live or work.

15. Additional information for the European Economic Area, the United Kingdom and Switzerland

Right to object. You can object at any time to our use of your information based on legitimate interests, and to direct marketing. If you object to direct marketing, we will stop.

[COUNSEL]

• EU representative (GDPR Article 27): [OPEN]
• UK representative (UK GDPR Article 27): [OPEN]
• Swiss representative: [COUNSEL]
• Data Protection Officer: [COUNSEL]

16. Additional information for U.S. residents

[COUNSEL]

We do not use or disclose sensitive personal information for purposes other than those the law permits [COUNSEL]. We do not knowingly sell or share the personal information of consumers under 16. To opt out of the sale or sharing of personal information or targeted advertising, use [OPEN] or send a Global Privacy Control signal (Section 7). You may use an authorized agent to make a request; we may ask the agent for proof of authority and ask you to confirm the request. We will not discriminate against you for exercising your rights.

17. Security

We use administrative, technical and physical measures to protect personal information [ENGINEERING]. No method of transmitting or storing information is free of risk. If a security breach affects your personal information, we will notify you and the authorities where the law requires.

18. Automated decisions

We use automated rules to authenticate sessions, apply plan and device limits, and detect suspicious sign-ins, payments and abuse [ENGINEERING]. These rules may temporarily block a request or account. You can ask for a person to review a decision by contacting us.

19. Children

The Services are for people aged 18 and over [OPEN]. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

20. Changes to this Policy

We will publish any update with its effective date. If a change is material, we will tell you in advance by email or in the app and, where the law requires, ask for your consent. Earlier versions are available on request [OPEN].

21. Contact

HidzoVPN, Inc., 7901 4th Street North, Suite 9375, Saint Petersburg, FL 33702, United States · Privacy: [OPEN] · Legal Information page: [OPEN]. This Policy is written in English; if a translation differs, the English version prevails unless the law of your place of residence requires otherwise.

Cookie Notice

Supplements the Privacy Policy

Last updated: [OPEN]

This notice explains how HidzoVPN, Inc. uses cookies and similar technologies on hidzovpn.com and its subdomains [OPEN]. Our apps are covered by our Privacy Policy.

1. What cookies are

Cookies are small files that a website stores in your browser. Similar technologies, such as local storage and pixels, work in a similar way. We call them all "cookies" in this notice.

2. The cookies we use

[ENGINEERING and MARKETING]

Some cookies are set by other companies, which may use the information under their own privacy notices. For more about who receives information and international transfers, see Sections 9 and 10 of our Privacy Policy.

3. Your choices

• Cookie settings: you can accept or reject non-essential cookies, and change your choice at any time, using [ENGINEERING]. [ENGINEERING]
• Your Privacy Choices: [OPEN] — applies where U.S. state law gives you a right to opt out of the sale or sharing of personal information or of targeted advertising [COUNSEL].
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account, and we show on the website that your signal has been honored [ENGINEERING] [COUNSEL].
• Browser settings: you can also block or delete cookies in your browser. If you block strictly necessary cookies, parts of the website, such as checkout, may not work.

4. Changes

We update this notice when we add or change a category of cookies. The "Last updated" date at the top shows the latest change. If we add cookies that need consent, we will ask for your consent again.

5. Contact

[OPEN] · See also our Privacy Policy. This notice is written in English; if a translation differs, the English version prevails unless the law of your place of residence requires otherwise.

Account and Data Deletion

Supplements the Privacy Policy

Version: 1.0 [OPEN] · Effective: [OPEN]

This notice explains how to delete your account in the HidzoVPN app and your personal information. It is issued by HidzoVPN, Inc., a Florida corporation, and supplements our Privacy Policy. [OPEN]

1. Your subscription

• If you bought Premium on our website, deleting your account also cancels its renewal, and you will not be charged again [ENGINEERING]. Deletion does not by itself give a refund for the current period; see our Refund and Cancellation Policy.
• If you pay through Apple or Google, deleting your account does not cancel your subscription. Cancel it first in your Apple or Google account, as explained in our Refund and Cancellation Policy; otherwise Apple or Google will continue to charge you. [ENGINEERING]

2. How to delete your account

We may ask you to confirm the request from your account email, or while signed in to the app, before we delete anything. We will email you when the deletion is complete. [ENGINEERING]

3. Deleting data without deleting your account

You can ask us to delete particular information, such as support conversations or diagnostic reports, without closing your account. Email [OPEN] and tell us what you want deleted. [ENGINEERING]

4. If you use HidzoVPN without an account

Information linked to your installation is removed from our active systems [ENGINEERING]. You can also ask us to delete it by emailing [OPEN] with the installation identifier shown in [ENGINEERING]. We may ask you to confirm the request from the app on that device [ENGINEERING].

5. What we delete and what we keep

Information held by Apple and Google [COUNSEL] [OPEN], acting as independent businesses, is not deleted by us. You can contact them directly.

6. After deletion

Deletion cannot be undone. You will lose your linked devices and settings. If you still have an Apple or Google subscription, it continues until you cancel it with them [ENGINEERING]. You can create a new account later, unless we closed your account under our Acceptable Use Policy.

7. Questions

Email [OPEN]. See our Privacy Policy for your other rights.

Our Service Providers

Supplements the Privacy Policy

Last updated: [OPEN]

The service providers below process personal data on behalf of HidzoVPN, Inc. to provide the Services [VERIFY]. Some of them, such as hosting providers, also process limited information for their own legal and security obligations. For how we protect international transfers, see Section 10 of our Privacy Policy.

[PROCUREMENT and CTO]

Changes to this list. We update this list when we add or replace a service provider [OPEN].

Law Enforcement Guidelines

For courts, authorities and parties to legal proceedings

Version: 1.0 [OPEN] · Effective: [OPEN]

These guidelines are for courts, government agencies, law-enforcement authorities and parties to legal proceedings who want to request information from HidzoVPN, Inc., a Florida corporation. They are not legal advice and do not create rights for any person. Users can read our Privacy Policy for how we handle their information.

1. How to send a request

Send requests by email to [OPEN]. Formal service of legal process on HidzoVPN, Inc. in Florida may be made on our registered agent, Northwest Registered Agent LLC, 7901 4th Street North, Suite 300, Saint Petersburg, FL 33702, United States [COUNSEL]. Requests must be addressed to HidzoVPN, Inc.; we do not process requests sent to individual employees, officers or contractors. Requests sent to customer support or through social media are not handled as legal requests and will be delayed.

Each request must state: the requesting authority or party and the person making the request, with official contact details; the legal basis for the request; the account email, installation identifier or other identifier concerned; the information sought; the relevant time period; and any deadline.

We verify every request, including by contacting the requesting agency through its publicly listed contact details, and may refuse a request we cannot verify.

2. Legal process we require

2.1 United States authorities. Except in the emergencies described in Section 5, or where the law requires us to report, we disclose user information to U.S. authorities only in response to valid legal process [COUNSEL]:

As a Florida business, we produce records in response to a subpoena, court order or warrant issued by another U.S. state as if a Florida court had issued it, as Florida law requires (Fla. Stat. §92.605(3)) [COUNSEL].

2.2 Authorities outside the United States. As a matter of company policy, we respond to authorities outside the United States only through a mutual legal assistance request or another procedure that U.S. law recognizes [COUNSEL].

2.3 Civil and private requests. We do not disclose the content of communications to private parties. We disclose other user information to private parties only in response to a subpoena or court order that is valid under applicable law, after notifying the user where we can and allowing [OPEN] days to object [COUNSEL].

2.4 We review every request for its legal validity and scope. We may reject, narrow or challenge a request that is invalid, overbroad or lacks jurisdiction.

3. Records we keep in the ordinary course of business

We can only provide records that exist when we receive a valid request. The table below describes the records we keep in the ordinary course of business as of [OPEN], and how long we keep them (see Section 11 of our Privacy Policy). [ENGINEERING and COUNSEL] [COUNSEL]

4. Preservation requests

On a valid preservation request from a U.S. authority, we preserve records that exist when we receive the request for 90 days, extended by a further 90 days on a renewed request, pending receipt of legal process (18 U.S.C. §2703(f)). A preservation request does not by itself lead to disclosure. We do not start recording activity that we do not normally record because of a preservation request.

5. Emergencies

If you believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay, send an emergency request to [OPEN] with the subject "EMERGENCY". Describe the specific danger and explain why the information is needed without delay. We review emergency requests promptly and may disclose information voluntarily where the law permits (18 U.S.C. §2702(b)(8), (c)(4)) [COUNSEL].

6. Notice to users

Where we have contact details for the user and the law allows it, we will notify the user before disclosing their information. We may delay notice in an emergency, where a court order prohibits it (for example under 18 U.S.C. §2705(b)), or where notice would create a risk of harm, and we will then notify the user once that reason no longer applies [COUNSEL].

7. Transparency

[OPEN]

8. Costs

We may seek reimbursement of reasonable costs where the law permits (18 U.S.C. §2706) [VERIFY].