1. General
This policy describes what data the antipirat service (the “Service”) processes, what for, and how long it is kept. By using the Service you agree to what is set out below.
The data controller is the owner of the Service. You can reach them by the means listed in the “Support” section of the site.
2. What data we process
- Email address. Needed to log in to the dashboard and to recover a password. Reminders that a subscription is about to end are sent to it too — you can opt out of those in account settings; address-confirmation and password-reset emails are always sent.
- Password hash. The password itself is not stored and cannot be recovered — only replaced.
- Subscription status: end date, chosen plan, history of orders and payments.
- IP addresses of connections and connection times. Processed solely to enforce the limit on the number of devices connected at the same time under the plan. Without this data the limit cannot technically be enforced.
- Amount of data transferred in bytes — to show statistics in the dashboard.
- Connection keys: the configuration identifier, the subscription link and the keys of AmneziaWG devices together with their addresses inside the tunnel. Without them a connection is technically impossible.
- Telegram — only if you linked the account yourself. The numeric identifier, the username at the time of linking and the date of linking. The identifier confirms the account is yours; the username is needed so that you can be named as the person who invited someone. We do not keep your conversation with the bot.
- Invitations: who invited whom and the rewards given for it — otherwise the invitation programme could not be run.
- Site visit log. When a page is opened we save the address, the time, the page address, the response code, the browser and the link you came from. This is recorded for people who have not logged in or have no account at all, too: without such a record a fault on the site cannot be investigated and a real visitor cannot be told from automated probing. The content of pages and your actions inside the service are not included.
- Login details: the registration date and the time of the last login.
- Activity log: what was done with your account — renewal, blocking, key changes, payment confirmation — and who did it. Needed to resolve disputes.
- Administrator's note — free text that the owner may leave about your request. It is usually empty.
- Internal messenger — administrators and testers only. The friends list, group membership, the text of conversations and the files sent in them. This does not concern customers of the service: they have no messenger. The content of calls does not pass through the server in the clear and is not recorded.
- Information about an IP address's origin: country, city and carrier, obtained from external services when an administrator checks a connection. Kept as a temporary cache, see sections 4 and 5.
3. What data we do not process
The Service keeps no log of the resources you visit, does not store the content of transmitted data and does not analyse it. We do not ask for or keep passport details, phone numbers, payment details or any other information not listed in section 2.
Payments are handled by a payment partner. Your card or account details are not passed to the Service and are not stored by us.
4. Retention periods
- Account data — for as long as the account exists.
- Connection records — no more than 30 days after the last connection of the device concerned; after that the record is deleted automatically.
- Site visit log — no more than 30 days.
- Information about an IP address's origin — no more than 30 days.
- Conversations in the internal messenger — no more than 30 days; files sent in them — no more than 7 days.
- Telegram link — until it is unlinked or the account is deleted.
- Order history — for the period required by law for payment records.
- The account activity log is kept for as long as the Service operates: it is needed so that a disputed payment or block can be looked into later on.
- Unconfirmed accounts with no payments are deleted automatically.
5. Sharing with third parties
We do not sell or disclose your data to third parties. We pass on only what the service cannot work without, and only to those listed below:
- Payment partner — the amount, the purpose and the order number. Card details are entered on their side and never reach us.
- Email delivery service — the recipient's address and the text of a service email (address confirmation, password reset, reminder that a subscription is ending).
- Telegram — if you linked the account: the messages the bot sends you pass through Telegram's servers.
- IP geolocation services — only the address itself, not tied to an account, and only when an administrator opens an address check manually.
In addition, data may be disclosed in cases expressly provided for by the laws of the Russian Federation.
6. Data protection
Access to the data is limited to the owner of the Service. The connection to the site is protected by a TLS certificate. Passwords are stored as an irreversible hash.
7. Your rights
You may ask what data we hold about you and demand that it be corrected or deleted. Deleting an account deletes all data linked to it, except payment records that must be kept by law. The request is sent through support.
Withdrawing consent to data processing means the service stops being provided, because without an email address and connection records the service cannot be delivered.
8. Changes to this policy
The current version is always available at https://antixvpn.store/privacy. If there are material changes, we will notify you by email.