Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains what personal data the vpn.how service ("vpn.how", "we", "us") processes when you visit our website or use our VPN servers, why we process it, and the rights you have. By creating an account or using the Service you confirm that you have read this Policy. If you do not agree with it, please do not use the Service.

1. Our privacy principles

  • We collect only the data we genuinely need to run the Service and to bill it.
  • We never sell, rent, or trade your personal data.

2. VPN server and technical data

Your traffic passes through the VPN server you rent. Technical data are used to configure, operate and secure the server. The data processed and the purposes of processing are described in section 3.

3. What data we collect, why, and on what basis

Account data. Your email address and a hashed password, so we can create and protect your account and contact you about the Service. Basis: performance of our contract with you.

Public Offer acceptance record. We store the internal account ID, version ID, the checksum of the complete edition and of the translation shown, language, confirmation method (registration or dashboard), and the first acceptance time in UTC. These data document the agreed commercial terms and help resolve disputes. Basis: entering into and performing the contract, and our legitimate interest in documenting its terms. This record does not add your email address, IP address, browser information or VPN traffic. It is separate from marketing consent. A repeat confirmation does not overwrite the first event; payment alone does not create a record, and acceptance is not backdated for existing customers.

VPN server data. The authentication credentials, keys, configuration, and chosen location of the personal server you order, so we can set it up and operate it for you. Basis: performance of our contract.

Billing data. Your account balance and a record of orders, top-ups, and charges, so we can manage payments and meet accounting obligations. Basis: contract and legal obligation.

Payment data. Payments are handled by external payment providers. We do not receive or store your full card number. We receive only payment metadata such as amount, currency, date, method, and status. Basis: contract.

Technical data. When you use the website we process your IP address, browser, and device information for security and to deliver the site. Basis: our legitimate interest in a secure, working service.

Referral source. On your first visit we store in a cookie where you came from: the referring site’s domain (without the page address), campaign tags (utm), the landing page and your country; when you register, this information is saved to your account. Your IP address and browser details are not used for this. Purpose: to understand which channels bring us customers and to develop them. Basis: our legitimate interest.

Website analytics. With your consent we use Google Analytics on our website to understand how it is used and to improve it. Basis: consent.

Support data. If you contact us by email or Telegram, we keep that correspondence so we can answer you and improve our support. Basis: legitimate interest.

Communications. We send service emails needed to run your account and servers: confirmation codes, expiry and payment notices, reminders about your trial or an unpaid order. We send news and special offers if you have agreed to them (with the checkbox at sign-up, the button in an email or in your account settings), and customers who have bought from us may receive messages about similar services. You can unsubscribe at any time via the link in any email or in your settings. We keep a record of consent and withdrawal: the date, source and IP address. Legal basis: consent; for customers, our legitimate interest.

4. Cookies and similar technologies

We use essential cookies that are required to sign you in and keep your session secure. With your consent we also use analytics cookies (Google Analytics). You can accept or decline non-essential cookies in the consent banner, and you can manage or delete cookies in your browser settings.

We also set the vsrc cookie for 90 days with your referral source (see section 3). It is not used for advertising and is not shared with third parties; you can delete it in your browser settings. If you click a button in an article, we set the vcta cookie for 30 days with the article number and the button position, so we can see which articles bring customers.

5. How long we keep data

  • Account and VPN server data: while your account is active, and for a short period afterwards to handle deletion and possible disputes.
  • Server credentials and configuration: while the rented server is active and for a short period after it expires.
  • Billing and payment records: for as long as accounting and tax rules require.
  • Support correspondence: for a limited period after your request is resolved.
  • Analytics data: according to the settings and policies of the analytics providers.
  • Offer acceptance records and linked versions: to document agreed terms and resolve disputes. No fixed automatic deletion period is currently configured for this log. Questions about retention or erasure of account-linked personal data can be submitted through the support form and are reviewed in light of the contract, possible disputes and applicable obligations. Published versions are not rewritten by later changes.

6. Who we share data with

We share personal data only with service providers who help us run the Service, and only to the extent they need it:

  • Payment providers — to process your payments.
  • Hosting and server providers — who operate the physical infrastructure on which your VPN server runs.
  • Analytics providers — Google Analytics, for website statistics.
  • Cloudflare — as a content delivery and security layer for our website.
  • Telegram — if you choose to contact us or use our channel; Telegram acts under its own privacy policy.

Service providers process the data needed to perform their tasks. We may also disclose data where the law requires us to.

7. International data transfers

Our providers may be located in different countries, so your data may be processed outside your country of residence. Where this happens, we rely on appropriate safeguards to protect your data.

8. Your rights

Subject to applicable law, you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw your consent at any time. You also have the right to lodge a complaint with your data protection supervisory authority.

To exercise any of these rights, contact us via the support form. We may need to verify your identity before we act on your request.

9. Data security

We protect your data with encryption in transit (HTTPS for the website and encryption for VPN connections), hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to keep what we collect to a minimum.

10. Children

The Service is not intended for children. We do not knowingly collect personal data from children. If you believe that a child has provided us with data, please contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will take reasonable steps to inform you.

12. Contact us

If you have any questions about this Policy or about your data, contact us via the support form.