Privacy Policy

• Who we are: VPNFAST LTD. (“SpiderVPN”, “we”) decides how your personal data is used. Contact: [email protected].
• What we collect: your account details (name, email, password), billing records, the devices you connect, the date each device last used the VPN, crash reports from the apps, your messages to support, and anonymous statistics about how our website is used (section 6), which you can turn off.
• What we do not collect: the websites you visit, the content of your traffic, or the DNS queries you make. Our VPN servers do not record your device's IP address. Some older records hold more than this; section 4 says what they are and when they are deleted.
• What we keep about your connections: for each device, the VPN location it uses and the date (not the time) it was last used. We do not record when you connect or disconnect, how long you stay connected or how much data you use, and we do not keep a history. Details in section 4.
• AI support: our website chat and some ticket replies are answered by an AI assistant (Anthropic's Claude). The chat tells you when you are talking to AI, and a person checks anything important.
• Free trials: to give each person one trial, we keep one-way codes made from your email, device and card or PayPal account, and we email you before you are charged.
• Old accounts: we moved every login from our old billing system, including unused ones, and delete unused ones after 90 days.
• Why: to provide the service, take payment, stop fraud and abuse, keep the service secure and working, and meet our legal duties.
• Who else sees it: our service providers (payments, app stores, hosting, email, support, AI support (Anthropic), crash reporting, DNS). We do not sell your data.
• Your rights: you can ask for a copy of your data, correct it, delete it, object, and more. You can complain to us, and to the Information Commission (still known as the ICO).

SpiderVPN is a trading name of VPNFAST LTD., the controller of your personal data. VPNFAST LTD. is registered in England and Wales with company number 15716229. Registered office: Office 12675, 182-184 High Street North, London, England, E6 2JA. Email: [email protected].

We have not appointed a data protection officer. For anything about your personal data, email [email protected].

This notice tells you what personal data we collect when you use our website, our apps, our VPN service and our routers, why we use it, and your rights. It is information for you. You do not need to agree to it, and we never ask you to tick a box to accept it.

3.1 Your account

3.2 Payments and orders

3.3 Free trial checks

To make sure each person gets only one free trial, we check your account, email address, device and payment method against earlier trials. For a card, we use a code from Stripe that is the same every time the same card number is used (the card “fingerprint”). For PayPal, we use your PayPal account ID. We store all of these only as keyed one-way codes (HMAC hashes). We cannot easily turn them back into the original data, but they are still personal data, because we use them to match new trial requests. We also keep a record of each trial: your email, account and device identifiers, the plan, its status and its dates. To start a trial on our website, you add a card or PayPal account; we take no money until the trial ends.

Trial emails: when your trial starts, we email you its end date, the price and how to cancel. We email you again 7 days before we charge you and, for annual and 2-year plans, 2 days before. These emails are part of your contract with us.

We do not refund renewal payments. Before every renewal we email you the invoice about 7 days before it is due, and a reminder with the renewal date, the price and a link to cancel about 3 days before, so you can cancel in time (see our Refund Policy).

3.4 Your devices

You can see and remove your devices in the app.

3.5 Accounts from our old billing system

When we moved to our new billing system, on the date this notice took effect, we also moved every login from the old system, including logins with no active subscription. We did this so those people can still sign in, and so we can spot and block fake or abusive sign-ups (for example, many accounts made from one network or with throwaway email addresses). We moved only the account's name, email address, password in scrambled (hashed) form, whether and when the email was verified, when the account was made and last changed, its number in the old system and, for a login that belonged to another customer's account, which account that was. If your old password could not be moved safely, you will need to reset it. If you sign in, the account works like any other account. If one of these accounts is never used, a daily automated job deletes it 90 days after the move. You can ask us to delete it sooner. We never use these accounts for marketing.

If you asked us to delete your account in the old system, we did not move it, and we will not add it back.

What we never collect

We do not collect or store:

• the websites or services you visit;
• the content of your traffic;
• your DNS queries (but see “DNS” below);
• your device's public IP address against your VPN connections on our VPN servers;
• when you connect or disconnect, how long you stay connected, or how much data you use.

Our VPN servers need your device's current public IP address, the time of its latest contact and how much data has passed, in memory while you are connected, to send traffic back to you. They do not pass any of these on, and our monitoring receives only totals for each server that are not linked to any device or account. All our VPN locations work this way. Until 12 October 2026 our monitoring also received each device's connection times and data totals. Our monitoring deletes data after 15 days, so those older records are gone by 31 October 2026.

When the app talks to our API (for example to sign in, fetch servers or set up a device), our web servers keep a short technical record of the request: the page address, the response code and size, and how long it took. These records do not include your IP address. Our API's own logs identify you by an internal number only, never by your email or IP address, and are deleted after 7 days. If a request fails, the web server's error log records the IP address it came from. Our web servers keep their access and error logs for 7 days, and we have deleted the older logs that included IP addresses.

What we keep

For each device you set up, we keep:

Every few minutes, our account system asks each VPN server which devices have been used today. The server works this out in memory and passes on only the list of devices used today. It never passes on your IP address, the time of day or how much data a device used. We do not keep a history of these dates, so we cannot see when you were connected, only the latest day a device was used.

Deletion: if a device has not been used for 7 days, we deactivate it (a device that never connects is deactivated after 1 day). We delete a deactivated device's record, with all the data above, once it has not been used for 30 days. This happens in a weekly job, so the data is gone at the latest about 37 days after the device was last used. If you remove a device in the app, we deactivate it at once and delete it on the same schedule.

We have kept only the date since 12 October 2026. When this notice took effect, we deleted the older connection times and data totals from every device record.

What this means: we do know which account is set up on which VPN location and the date each device was last used. We do not know which websites you visit, what you do online, or when during the day you were connected.

DNS

When you are connected, your device's DNS queries go to Control D, a DNS provider we use for all VPN locations. It also helps some streaming services work in the location you choose. Control D handles these queries for us as our service provider. Control D is a Canadian company, and its DNS servers run worldwide. We have turned off Control D's analytics for our profile, so your queries are not logged in our Control D account. We have asked Control D for its data processing agreement.

Routers

A SpiderVPN router keeps a secure management connection to our servers. Our support team can use it to reach the router's settings to help you, install updates and fix problems. We do not use it to monitor your internet traffic. The router's identifier is based on its network (MAC) address. Every 2 hours the router checks our update server for new firmware.

The management connection cannot be turned off from the router dashboard; contact support if you want it off. Each time our support team uses it, we log who connected, to which router and when, and keep that log for 2 years.

When the router checks for updates, our update server records the time, the file it asked for and the details its request sends. It does not record the router's IP address.

The apps send crash reports and some performance data to Sentry and to Google Firebase Crashlytics. These reports contain technical details: the app version, the device model and operating system, what happened in the app before the crash, and an installation identifier. We set Sentry not to send personal information such as your IP address or user details, and not to take screenshots. Sentry collects performance data from about 1 in 5 app sessions.

Crashlytics keeps crash reports for 90 days. Sentry keeps them for up to 90 days.

You can ask us to stop by emailing [email protected].

We do not use advertising or analytics tools in the apps.

• Server logs: our web servers record requests (the page address, the response code and size, and how long it took, but not your IP address) to protect the website from attacks and fix faults. We keep them for 7 days. When a request fails, the error log records the IP address it came from, also for 7 days.
• “What is my IP” tool: if you use it, we send your IP address to ipinfo.io to look up its approximate location, and keep the result in a short-term cache for up to 24 hours.
• Security checks: before a website chat starts, Cloudflare Turnstile checks that a person, not an automated program, is using it. To stop password guessing, we keep one-way codes made from your email and IP address for a short time, and we limit how many requests one IP address can make. Our servers' security logs, which record the IP addresses of attempts to log in to the servers themselves, are kept for 7 days.
• Website chat: if you open the chat, we store a chat identifier in your browser so the conversation continues across pages (see section 7.2).
• Website statistics: we count how the website is used, anonymously and without cookies (see “Website statistics” below).

Website statistics

We count how our website is used so that we can improve it and plan our marketing: which pages are visited and which of our links are clicked, how long pages are viewed, the country a visit comes from, the site or campaign that linked to us, and the type of device and browser (including screen size and language). We do not use these statistics for advertising, and we do not sell or share them.

How it works: our statistics run on our own servers and use no cookies. We do not store your IP address, and we keep only the country a visit comes from, not your region or town. Before anything is sent, your browser removes personal details from the page address, such as order or invoice numbers.

We keep the statistics for 25 months and then delete them. Backup copies of the statistics are kept for up to 6 months.

You do not have to accept anything. If your browser sends Do Not Track or Global Privacy Control, it sends us no statistics. You can also turn statistics off for this browser here; your choice is kept in this browser's storage:

Cookies and similar storage

Our website uses only the cookies and browser storage it needs to work. We do not use advertising or analytics cookies (our website statistics use none), so we do not ask you to accept cookies.

• Your language choice: a cookie, so pages open in the language you picked.
• Checkout: cookies that keep your order and your sign-in together while you buy. They expire after a short time.
• Account area: a sign-in session cookie and a security cookie that protects forms.
• Light or dark theme: kept in your browser's storage until you change it.
• Website statistics: if you turn them off, your browser keeps a note of that in its storage.
• Website chat: the chat identifier described above.
• Cloudflare, which delivers and protects our website, may set a cookie to tell people from automated programs, and Turnstile does a similar check before a chat starts.

You can delete cookies and browser storage in your browser settings at any time. The website will then forget your choices, and you may need to sign in again.

7.1 Support tickets

If you contact us, we keep your messages, our replies, your email address and anything you choose to send us (such as screenshots or logs). We use the support ticket system in our account area, which runs on our own servers, for this. Tickets from our old billing system were moved into it.

7.2 AI support assistant

Our website chat, and some replies to support tickets, are written by an AI assistant. The chat tells you at the start that you are talking to AI, and you can ask for a person at any time. The assistant uses Claude AI models from Anthropic, PBC (United States), which processes your messages for us as our service provider. If you are signed in, the assistant can see your account, subscriptions, invoices and devices, and the status of our VPN locations, so that it can answer you. It can check a payment with Stripe or PayPal, resend emails, and extend your service by up to 3 days at a time after an outage or a payment delay. It cannot change your email, password or two-step sign-in, or delete your account. A person checks any refund, plan change or cancellation it suggests before it happens. We keep chat transcripts for 30 days. Anthropic deletes chat content it receives within 30 days. If its automated safety systems flag a conversation as breaking its usage policy, it may keep that content for up to 2 years. Anthropic does not use these conversations to train its models. Please do not put passwords, full card numbers or health information in the chat.

You must give us your email and a password (or sign in with Google or Apple) to have an account, and payment details to buy. Without them we cannot provide the service.

Marketing: we do not send marketing emails today. If we start, we will send them only to people who opt in, and every message will have a one-click way to stop. We never send marketing to accounts brought over from our old billing system unless their owners opt in.

We do not sell your personal data. We share it only with:

PayPal, Apple, Google and Amazon are responsible for their own use of your data in their services; see their privacy notices.

Some of our providers process data outside the UK. When they do, we use one of these safeguards:

• the country is covered by UK adequacy regulations, for example all EU and EEA countries (our main servers are in Germany);
• for the United States, the provider is certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”): Stripe, Sentry, Google and Cloudflare;
• otherwise, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses (for example Anthropic).

PayPal, Apple, Google and Amazon also use your data for their own services as independent organisations, under their own privacy notices, and make their own transfer arrangements. You can ask us for a copy of our safeguards at [email protected].

Security. We protect your data with encryption in transit, access controls and limited staff access.

A daily automated job deletes data when its period above ends. We keep an account that still has an active service, an unpaid invoice, an open support ticket or a credit balance.

You have the right to:

• get a copy of your personal data;
• correct data that is wrong;
• delete your data (we may need to keep some of it, for example invoices);
• restrict how we use your data;
• object to our use of your data where we rely on legitimate interests;
• move data you gave us to another provider (data portability);
• withdraw consent where we rely on it, at any time;
• automated decisions: where we make a significant decision about you using only automated means, you can ask us about it, tell us your view, ask a person to review it, and challenge it.

Our free-trial eligibility checks are automated. If we refuse you a trial, we tell you, and you can reply to tell us why you think we are wrong; a person will review the decision.

To use any of your rights, email [email protected] or contact us through support. You don't need a special form, and it's free. We reply within one month; if your request is complex we may need up to two more months and will tell you why within the first month. We may ask you to confirm your identity first, usually from your account email address.

Complaints: if you are unhappy with how we handle your personal data, tell us at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the ICO (see section 13).

Deleting your account: email [email protected] from your account email and ask us to delete your account. Cancel any app store subscription in the store first; deleting your account does not cancel it.

If you are unhappy with how we use your personal data, you have the right to complain to us. Email [email protected] with “Data protection complaint” in the subject. We will confirm we have received your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay. Section 18 of our Terms of Service explains how we deal with other complaints.

You can also complain to the UK regulator, the Information Commission (still known as the ICO): ico.org.uk, telephone 0303 123 1113. If you live in the EU, you can also complain to the data protection authority in your country.

SpiderVPN is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

When we change this notice, we update the version number and date at the top. If the change is important, we tell you by email or in the app before it applies.