Privacy Policy

Effective date: October 12, 2026

Summary: we do not use VPN traffic to create a record of the websites you visit, the content you transmit or the DNS requests you make through the VPN connection. We collect only what is needed to run your account, process your payment and provide support.

1. Who is responsible for personal data

DefShield VPN, the operator of defshieldvpn.app ("we", "us"), is the data controller for personal data collected through:

the defshieldvpn.app website;
customer accounts and the customer dashboard;
subscription purchases, billing and refunds;
the VPN connection itself, to the limited extent described in section 2;
customer-support correspondence.

You can contact us about privacy at [email protected].

2. VPN traffic data

When establishing a VPN connection, technical information such as your source IP address and the public key of your configuration must be processed in memory so that the connection can function and the device limit can be enforced. This information is not written to persistent logs tied to your identity.

We do not use VPN traffic to create persistent records of:

websites visited through the VPN;
content transmitted through the VPN;
DNS requests made through the VPN;
browsing history associated with an identifiable customer;
your real IP address after the session ends.

For capacity planning we keep aggregated, anonymous statistics such as total bandwidth per server location. These cannot be linked to an individual customer.

3. Website, account and billing data

We may collect:

e-mail address;
account identifier and the public keys / identifiers of the configuration files issued to you (never the private keys of your devices beyond initial generation and delivery);
selected subscription plan and subscription status;
transaction identifier, payment status, amount and currency;
billing country and limited billing information;
cancellation and refund history;
fraud and risk signals provided by our payment processor;
support correspondence.

Full card numbers are processed by our payment processor and are never stored by us.

The website may use strictly necessary cookies for essential functionality and privacy-friendly aggregated statistics. You can block cookies in your browser; the website will still work.

4. Purposes and legal bases

Personal data may be processed to:

provide and administer the Service;
create and maintain customer accounts and issue configuration files;
process payments, refunds and cancellations;
enforce the simultaneous-connection limit;
prevent fraud and abuse;
provide customer support;
comply with tax, accounting and legal obligations.

Depending on the circumstances, processing is based on performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c)), our legitimate interests in security and fraud prevention (Art. 6(1)(f)) or your consent (Art. 6(1)(a)).

5. Advertising and tracking

We do not sell personal data, do not use payment information to build advertising profiles and do not embed third-party advertising or tracking technologies on the website.

6. Service providers

Personal data may be shared with service providers necessary to operate the Service, including:

payment and fraud-prevention providers;
hosting and cloud-infrastructure providers for the website and VPN servers;
e-mail delivery and customer-support providers;
tax, accounting and professional advisers.

Service providers may process data only for the purposes for which they have been engaged, subject to data-processing agreements and legal requirements.

7. International transfers

Our VPN servers are located in many countries; connecting to a server means your traffic is routed through that country, which is the purpose of the Service. Account and billing data are stored within the European Economic Area. Where a service provider processes data outside the EEA, appropriate safeguards are used, such as adequacy decisions or the European Commission's standard contractual clauses.

8. Data retention

Account data is kept while your subscription is active. If you delete your account or it remains inactive after your subscription ends, personal data is deleted within 12 months, except payment records that must be kept for tax purposes under applicable law. You can request deletion at any time.

9. Your rights

If you are in the EU/EEA or another jurisdiction with similar laws (GDPR, UK GDPR, CCPA), you have the right to:

access a copy of the personal data held about you;
correct inaccurate data;
request deletion of your data;
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time where processing is based on consent;
lodge a complaint with your local supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).

To exercise any of these rights, email [email protected]. We respond within 30 days.

10. Children

The Service is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is always published on this page. We will notify you by e-mail before material changes take effect.

12. Contact

DefShield VPN
Website: defshieldvpn.app
Email: [email protected]