Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") regulates the collection, processing, storage, and protection of personal data of users of the XNEOVPN service (hereinafter referred to as the "Service", "we", "us").

By using the Service, you agree to the terms of this Policy. If you do not agree with any of its provisions, please refrain from using the Service.

This Policy applies to all platforms and components of XNEOVPN: the website, Telegram bot, VPN client, and related services.

We collect the minimum amount of data necessary to provide the Service. Depending on your type of interaction with us, we may collect the following categories of data:

2.1. Data provided by the user:

• Email address — Used to identify your account, deliver access keys, and send essential notifications
• Telegram ID / username — If you interact with us through the Telegram bot
• Support inquiry data — The content of correspondence with our customer support team

2.2. Automatically collected data:

• IP address — Temporarily recorded in server system logs upon connecting to the dashboard and API (not to be confused with VPN tunnel traffic)
• Timestamps — Date and time of account creation, payment completions, and last web login
• Technical device data — Browser type, operating system, client version (strictly for troubleshooting)
• Order history — Records of purchased subscription plans and issued access credentials

We process your data exclusively for the following lawful purposes:

• Service Provision — Creating and managing accounts, issuing VPN keys, activating subscriptions
• Payment Processing — Transaction verification, invoicing, and processing refunds
• Technical Support — Responding to user requests and diagnosing connectivity issues
• Security & Anti-Fraud Protection — Detecting abuse, preventing unauthorized access, protecting other users
• Service Improvement — Analyzing aggregated (anonymous) capacity data to enhance infrastructure stability
• Legal Compliance — Fulfilling mandatory legal obligations where an applicable lawful basis exists

We do not process personal data for purposes outside those listed above without your explicit consent.

Specifically, we do not collect or store:

• The history of websites and apps you visit through the VPN
• The content of your internet traffic
• DNS queries made through the VPN tunnel
• IP addresses of resources you accessed
• Timestamps of your VPN sessions
• Traffic volume consumed on a per-session basis
• The outgoing public IP address assigned to you on the VPN server

Technical logs of server infrastructure (unrelated to VPN traffic activity) are retained for no more than 7 days strictly for troubleshooting failures and maintaining system stability, after which they are automatically destroyed.

We do not sell, rent, or trade your personal data with third parties for commercial purposes.

Limited data disclosure is possible only in the following necessary cases:

• Payment Providers — RollyPay, CryptoBot, and Telegram payment platform receive only the data strictly necessary to process transactions (see Section 6)
• Infrastructure Providers — Hosting and server providers powering the Service, subject to strict data protection standards
• Legal Obligations — In the event of receiving a binding lawful request from a competent government body; we disclose only the minimum required data and notify you where legally permissible
• Protection of Rights — Where necessary to protect the rights, property, or safety of XNEOVPN, our users, or third parties

XNEOVPN uses third-party payment providers for secure transaction processing. Depending on your chosen payment method:

• Telegram Stars — Payment with internal Telegram currency. The payment is processed entirely by Telegram; we receive only confirmation of successful payment.
• RollyPay — Bank cards and alternative payment methods. Card details are entered on the provider's secure page and never touch our servers; we receive only payment confirmation and the transaction amount.
• CryptoBot — Cryptocurrency payments (USDT, TON, Bitcoin, Ethereum, etc.). We receive only the transaction identifier and payment status.

On XNEOVPN servers, we store exclusively: transaction ID, payment amount, date, status, and associated user account ID. Card numbers or crypto wallet private keys are never stored on our servers.

We store your data only for as long as necessary to achieve the purposes specified in this Policy:

• Email address and account credentials — Until account deletion is requested by the user
• Payment and order history — Until account deletion (may be kept longer if required by financial reporting laws)
• Support inquiry logs — 12 months from the date the inquiry is closed
• Technical server logs — No more than 7 days
• VPN activity data — Not stored at all (see Section 4)

After expiration of retention periods, data is irreversibly destroyed or anonymized.

Regarding your personal data, you possess the following rights:

• Right to Access — Obtain information about what data is stored about you
• Right to Rectification — Request correction of inaccurate or outdated information
• Right to Erasure ("Right to be Forgotten") — Request the complete deletion of your account and all associated data
• Right to Data Portability — Receive your data in a structured, machine-readable format
• Right to Restrict Processing — In cases provided by applicable legislation
• Right to Object — Object to the processing of your data for specific purposes

Please note that account deletion is irreversible. After deletion, restoring subscription history or obtaining a refund will not be possible.

XNEOVPN uses local client storage technologies to the minimal extent required for Service operations:

• localStorage (Session Token) — Stored in the browser to maintain your authenticated login session. Contains no personal data — only an encrypted session identifier. Deleted upon logout or browser cache purge.
• Functional Cookies — Used where strictly necessary for the proper functioning of forms and protection against CSRF attacks.

We do not use analytical, advertising, or tracking cookies. Third-party analytics services (Google Analytics, etc.) are not connected on our site.

We apply technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encryption of data in transit (TLS/HTTPS)
• Password storage in hashed form using modern cryptographic algorithms
• Restricted database access based on the principle of least privilege
• Regular security audits of infrastructure
• Monitoring of suspicious activity

Despite these measures, no internet transmission system can be guaranteed 100% secure. In the event of a security incident affecting your data, we will notify you within 72 hours of discovery.

XNEOVPN server infrastructure is distributed across multiple geographical locations. Consequently, your data (listed in Section 2) may be processed and stored on servers located outside your country of residence.

During cross-border data transfers, we ensure:

• Encryption of data in transit between servers (TLS 1.3)
• Server hosting exclusively with verified providers complying with data protection standards
• Minimization of transferred data — user personal data is not stored on VPN servers (see Section 4)
• Infrastructure access control under the principle of least privilege

By using the Service, you consent to the processing of your data on servers located across various jurisdictions, subject to the security measures described in this Policy.

The XNEOVPN Service is intended exclusively for individuals aged 18 and older (or the age of majority in the user's jurisdiction if higher than 18).

We do not knowingly collect or process personal data of individuals under 18. If we become aware that we have inadvertently received data from a minor, we will promptly take steps to delete it.

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Cyprus.

In the event of receiving a data disclosure request from a government authority, we will:

• Thoroughly verify the legality and legal grounds of the request
• Disclose only the minimum amount of data required by law
• Notify the user of the request, unless prohibited by law or court order

We reserve the right to update this Policy. Upon making material revisions, we will inform users via one or more of the following methods:

• Publishing an announcement in the official XNEOVPN Telegram channel
• Displaying a notification banner on the website upon next login
• Updating the revision date at the top and bottom of this document

Continued use of the Service after changes enter into force signifies your acceptance of the updated Policy. If you do not agree with the revisions, you have the right to delete your account and discontinue using the Service.

For all questions regarding this Privacy Policy, personal data processing, or exercising your rights, please contact:

This Privacy Policy entered into force on April 1, 2026.

Edition of April 1, 2026.