HidzoVPN – Privacy Policy
Effective Date: September 1, 2025
This document (“Privacy Policy”) explains the privacy rules applicable to personal data and other information collected or submitted when you access, install, or use HidzoVPN Services and Websites regardless of the device (computer, mobile phone, tablet, etc.) you use.
The data controller of your personal data, as described in this Privacy Policy, is HidzoVPN
address: Via Espana, Edificio Delta Bank, Piso 6 Suite 604D Panama
email: [email protected]
“Hidzo”, “we”, “us”, or “our”
The capitalized words used in this Privacy Policy as definitions are defined here or in our General Terms.
By visiting our Websites, by submitting your personal data to us, and by accessing, installing and/or using our Services, you confirm that you have read this Privacy Policy and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy or any provisions hereof, please do not use our Services and Websites.
PLEASE NOTE : To help you understand this Privacy Policy, we've included a short summary at the beginning of each section. While these summaries are not legally binding, they highlight the key points of the text using clear everyday language. Be sure to read the full Privacy Policy for all the details.
1. PROCESSING OF YOUR PERSONAL DATA
SUMMARY : We do not track or store your online activity. However, we need basic data like your email address to create your account and deliver our Services. All data collected is minimal and purpose-limited.
Hidzo processes personal data only to the extent necessary to provide its VPN Services and mobile applications.
We may process the following categories of data:
Information for creating your Account
- Email address. Required for all login methods, including Email + OTP and Google/Apple Sign-In. We do not require any password creation. In the case of Apple login, a private relay email may be generated and used.
Authentication-related Data
- We store a session token for the duration of your use. Tokens are invalidated upon logout.
- OTP verification codes are stored encrypted and expire within minutes.
- No passwords or sensitive identifiers are collected or stored.
App Usage Context
- We do not log your browsing history, connection destination, DNS requests, or IP addresses used during VPN sessions.
- We only register internal usage events (e.g., tap on 'Connect', select server) anonymously and only to improve app flow.
Communication and Support
- Email communications. If you contact us via email ([email protected]), we will retain your message and contact details to respond.
- Feedback module. Any responses you submit in the in-app survey are processed anonymously and stored solely for internal analysis.
Device and Application Data
- We may collect non-identifiable technical data like OS version, app version, language, or platform (iOS/Android) to improve performance and stability. This data is never linked to browsing activity.
Cookies and Website Interactions
- When visiting our Website, we may use essential cookies to ensure site functionality. We do not use cookies for advertising or third-party tracking.
2. GROUNDS FOR PROCESSING OF PERSONAL DATA
SUMMARY: Your data is only processed when necessary to operate the service, when required by law, or when you give us explicit consent.
Your personal data is processed based on the following legal grounds:
- Contractual necessity: To create and manage your account and allow VPN use.
- Your consent: For feedback submissions or if you opt in to receive communications.
- Legitimate interest: To maintain app security, improve product usability, and resolve technical issues.
- Legal obligation: To comply with applicable laws or respond to valid legal requests, where necessary.
We do not process your data for profiling, advertising, or behavioral tracking.
3. SHARING YOUR PERSONAL DATA
SUMMARY: We do not sell or rent your data. Limited and essential data may be shared only with trusted infrastructure or analytics partners to operate the service.
HidzoVPN does not share your personal data except in the limited cases outlined below:
Service Providers
We may share basic infrastructure-related data with:
- Cloud providers (e.g., for hosting backend services)
- OTP and email delivery services (to send verification codes or announcements)
- Analytics tools (used only to understand app performance and crash diagnostics, never browsing behavior)
All such providers are bound by strict confidentiality and data protection agreements.
Legal Requests
We may share personal data if legally required (e.g., court orders). However:
- We operate under a strict no-logs policy.
- We do not store IP addresses, DNS queries, session timestamps, or online traffic.
- Therefore, even if required by law, we typically cannot identify what users accessed or when.
4. CHOICES RELATED TO YOUR PERSONAL DATA
SUMMARY: You have rights to access, update, or delete your data. You can exercise these rights directly in the app or by contacting our support team.
Depending on your country and applicable laws, you may have the following rights regarding your data:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of any inaccurate or outdated data (e.g., email).
- Deletion : Delete your account and all associated data.
- Objection: Object to data processing based on legitimate interest (e.g., feedback analytics).
- Restriction: Ask us to restrict processing under certain legal circumstances.
- Withdraw consent: Revoke consent where our processing relies on it.
- Portability: Request your data in a structured and readable format (only where applicable).
- Complaint: File a complaint with a data protection authority if you believe your rights are violated.
How to Exercise Your Rights
- In-app account deletion:
- You can delete your account directly from within the app.
- Go to Settings > Account > Delete Account, then follow the on-screen steps to verify and confirm your request.
- Once deleted, your data and session are removed from our systems.
Upon successful deletion:
- All session tokens are invalidated.
- Your email and profile data are removed from our systems.
- Feedback previously submitted remains anonymous and non-linked.
We may retain some information if legally required (e.g., for fraud prevention or abuse reports).
Opt-out
If you subscribed to optional emails (e.g., announcements), you can:
- Click the “unsubscribe” link in the footer of each email.
- Or contact us directly to request removal from mailing lists.
5. DATA SECURITY
SUMMARY: We use modern technical and organizational safeguards to protect your personal data from unauthorized access, loss, or misuse.
HidzoVPN implements strict security controls designed for a zero-knowledge and no-logs architecture.
Technical Measures
- End-to-end encryption of communication and authentication flows.
- Session token hashing and short-term validity (auto-expire).
- Encrypted data storage for feedback and email records.
- Cloud security best practices enforced at infrastructure level (firewalls, rate-limiting, access tokens).
Organizational Measures
- Only authorized team members can access user support requests.
- Internal policies restrict all access to a need-to-know basis.
- We continuously review and improve our data handling procedures.
Note: VPN traffic itself is routed through no-log, RAM-only servers that do not store any personal activity data. No user activity is recorded, linked, or monitored.
If you believe your account has been compromised, please notify us at [email protected] immediately.
6. DATA RETENTION AND DELETION
SUMMARY: We only keep your data as long as it’s necessary for service delivery or legal compliance. You can delete your account at any time.
We follow a minimal retention principle. Here's how we handle your data:
- Email address: Stored only while your account is active.
- OTP codes: Temporary and auto-expire within 5–10 minutes.
- Feedback responses: Stored anonymously and unlinked.
- Support emails: Retained for a maximum of 12 months, unless longer retention is required for abuse mitigation.
- Crash logs / App diagnostics: Collected anonymously and purged periodically.
Account Deletion Process
Once a deletion request is received and verified:
- All personal identifiers are erased.
- Access tokens and session information are invalidated.
- If you signed in using Google or Apple, we retain no access to your profile or credentials.
Please note that:
- Some data may be kept temporarily to comply with legal obligations (e.g., fraud investigations).
- Anonymous aggregated data used for product improvement will not be deleted as it cannot be traced back to you.
7. COUNTRY-SPECIFIC PROVISIONS
SUMMARY: Depending on your location, you may have specific rights or protections under local privacy laws.
HidzoVPN recognizes the importance of complying with regional privacy frameworks. Accordingly:
For Users in the European Economic Area (EEA):
- Your data is handled in accordance with the General Data Protection Regulation (GDPR).
- You may request access, correction, or deletion of your data at any time.
- If you believe your rights under GDPR are violated, you have the right to lodge a complaint with your local Data Protection Authority.
For Users in California (USA):
- We comply with the California Consumer Privacy Act (CCPA).
- HidzoVPN does not sell or share your personal data with third parties for marketing purposes.
- You may request access or deletion of your data by emailing us at [email protected].
For Users in the Republic of Korea:
- Your data may be transferred internationally (e.g., cloud providers).
- Transfers are protected by technical safeguards and contractual obligations to ensure compliance with the Personal Information Protection Act (PIPA).
If you require more details regarding region-specific rights or procedures, contact us at [email protected].
8. CONTACT US
SUMMARY: You can contact us anytime about your data or this policy using the details below.
If you have any questions, feedback, requests, or complaints regarding this Privacy Policy or your personal data, you may contact us at:
- Email (Privacy): [email protected]
- Email (Support): [email protected]
- Legal Entity: NebulaVPN Inc.
- Address: Via Espana, Edificio Delta Bank, Piso 6 Suite 604D Panama
We currently do not have regional representatives or a dedicated DPO due to the limited scope of MVP. This may change as the product expands.
9. CHILDREN’S DATA
SUMMARY: Our service is not intended for anyone under 18. We do not knowingly collect their data.
HidzoVPN is a service intended for users who are 18 years of age or older.
We do not knowingly collect, maintain, or process personal data from children. If you are under the age of 18, please do not attempt to use our Services or submit any personal information.
If we learn that personal data from a user under 18 has been collected inadvertently, we will take immediate steps to delete such data.
10. OTHER TERMS
SUMMARY: While we protect your data, you are responsible for safe and lawful usage. We may update this policy, and we’ll inform you of significant changes.
Limitation of Liability
While Hidzo uses strong safeguards to protect your personal data, we cannot guarantee absolute security. You are responsible for:
- Maintaining security on your device
- Using the app within legal boundaries
- Not sharing your login credentials with others
HidzoVPN is not liable for unauthorized access due to user negligence or third-party malicious activity beyond our control.
Links to Other Sites
Our website or app may link to third-party content (e.g., social media). We are not responsible for their privacy practices. Please consult their respective privacy policies.
Changes to this Policy
We may revise this Privacy Policy to reflect changes in law, services, or technology. When changes are material, we will:
- Notify you via app or email (if applicable)
- Post the updated policy with the “ Effective Date ” clearly marked
Continued use of the Services after changes are published will constitute your acceptance of the revised Privacy Policy.
