Privacy Policy

VPNzo ("Service") is operated by Taprise Ltd., a company registered in the United Kingdom. This Privacy Policy explains what personal data we collect, the legal basis on which we process it, how long we retain it, where it is transferred, and your rights as a data subject.

The list of partners you may find at Annex A

This Policy should be read together with our Terms of Use, which govern the legal relationship between you and Taprise Ltd., including the applicable governing law and jurisdiction.

By installing or using VPNzo, you acknowledge that you have read and understood this Policy.

UK Controller: Taprise Ltd. acts as data controller for UK residents under the UK GDPR and the Data Protection Act 2018.

We collect only the minimum data necessary to operate the Service. For each category we specify what is collected, why, the legal basis under GDPR Art. 6, and how long we keep it. A record of our legitimate interest assessments for processing under Art. 6(1)(f) is available on request.

What: Email address (if email registration); name or display identifier from Google or Apple Sign-In; authentication token (we never receive your password).

Why: Creating and maintaining your account; authenticating your identity on return.

Lawful basis: Performance of a contract — Art. 6(1)(b). This data is necessary to provide the Service.

Retention: Duration of active account + 30 days after account deletion request (for dispute resolution), then permanently deleted.

What: Subscription status, plan, and billing period; purchase date and renewal date; payment method type (e.g. "card ending 4242") — we do not store full card numbers.

Why: Delivering the paid Service; managing the subscription lifecycle; resolving billing disputes.

Lawful basis: Performance of a contract — Art. 6(1)(b).

Retention: 7 years from transaction date, in accordance with UK and EU statutory accounting and tax record-keeping obligations.

What: Email address; content of support messages and attachments; communication history with our support team.

Why: Responding to support requests; resolving technical issues; maintaining service quality.

Lawful basis: Legitimate interests — Art. 6(1)(f). We have a legitimate interest in providing customer support. This interest does not override your rights given the limited nature of the data and the reasonable expectation that support interactions are retained.

Retention: 2 years from the date of the last interaction, then deleted.

What: Device type and model; operating system and application version; language and regional settings; crash reports and diagnostic logs (anonymised where possible).

Why: Diagnosing technical issues; improving application stability; detecting abuse or fraud.

Lawful basis: Legitimate interests — Art. 6(1)(f). This data is technical in nature and does not identify you personally.

Retention: 90 days from collection, then deleted or fully anonymised.

What: Session start and end timestamps; server region selected; connection status and performance indicators (e.g. latency).

Why: Operating the VPN tunnel; diagnosing connection failures; capacity planning.

Lawful basis: Performance of a contract — Art. 6(1)(b). These signals are necessary to deliver the VPN connection you requested.

Retention: 30 days from session end, then deleted.

What: Subscription conversion events (trial started, subscription activated, cancelled); revenue metrics at cohort level; churn and retention signals.

Why: Understanding subscription performance; optimising pricing and trial mechanics; financial planning.

Lawful basis: Legitimate interests — Art. 6(1)(f). Analytics data is processed at an aggregated or pseudonymous level.

Retention: Aggregated analytics: 3 years. Individual-level pseudonymous events: 12 months.

Copies of applicable SCCs, the UK IDTA, and the UK Addendum are available on request: support@vpnzo.app.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We share data only in the following circumstances:

Solely for the purposes described, under binding data processing agreements compliant with Art. 28 GDPR.

When required by applicable law, court order, or a lawful request from a competent authority. We will notify you of such requests where legally permitted.

When necessary to prevent fraud, enforce our Terms of Use, or protect the safety of users or the public.

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring entity. We will provide at least 30 days' advance notice before your data becomes subject to a materially different privacy policy.

Note: certain rights, such as erasure, may be limited where we are required to retain data to comply with a legal obligation — for example, the statutory accounting and tax retention period described in Section 2.2.

Automated decision-making: we do not carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.

To exercise any right, contact us at support@vpnzo.app. We will respond within 30 days. For complex requests, we may extend this by a further 60 days with written notice.

You have the right to know what personal information we collect, to request deletion, to opt out of the sale or sharing of your personal information (we do not sell or share personal information, including for cross-context behavioural advertising), and to non-discrimination for exercising these rights. Similar rights may be available to you under other applicable US state privacy laws. Submit requests to support@vpnzo.app.

No internet-based system is completely secure. In the event of a personal data breach posing a high risk to your rights and freedoms, we will notify you without undue delay as required by applicable law. Where required, we will also notify the competent supervisory authority within 72 hours of becoming aware of a qualifying breach, in accordance with Article 33 GDPR.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a person under 18 has submitted data through the Service, contact us at support@vpnzo.app and we will delete it promptly.

The VPNzo mobile application does not use cookies. Our website (vpnzo.app) may use essential cookies required for site functionality only. We do not use advertising or behavioural tracking cookies. If this changes, we will update this Policy and obtain consent where required by applicable law.

We may update this Policy from time to time. Material changes will be communicated at least 14 days before taking effect via in-app notification, website notice, or email where we hold your address. The "Effective date" at the top reflects the most recent revision.

Continued use of the Service after an updated Policy takes effect constitutes acceptance, to the extent permitted by applicable law.

We respond to all privacy inquiries within 30 days.