Privacy Policy

1. Who we are and scope

The Service is operated by Proxya, the business trading under that name and providing the Service through the website proxya.co. Proxya contracts with you directly and in its own name.

Proxya is the controller of the personal data described in this Policy — account, billing, technical and support data — and decides why and how it is processed. Where we instead process personal data on your behalf as part of your use of the proxies, we act as a processor and our Data Processing Agreement applies in addition to this Policy.

Data-protection questions, requests and complaints go to [email protected], which reaches the people who can act on them.

2. Information we collect

We collect the following categories of data:

• Account data you provide: name or username, email address and password (stored only as a secure hash).
• Billing data: plan, transactions and invoices. Card and crypto payment details are handled by our payment processors and are not stored on our servers.
• Technical data collected automatically: IP address, device and browser type, and basic log data used for security and fraud prevention.
• Usage metrics: aggregate proxy statistics such as bandwidth used and request counts — never the content of your traffic.
• Support data: the contents of messages you send to our support and any information you choose to share with us.

3. How we use your information

• To provide, operate, maintain and improve the Service.
• To process orders, payments, invoices and account balances.
• To send transactional messages such as order confirmations, security alerts and email verification.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To respond to your support requests and communicate with you about the Service.
• To comply with legal obligations and enforce our Terms and policies.

4. Legal bases for processing

Where data protection law (such as the GDPR) applies, we rely on the following legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service and prevent abuse); your consent (for non-essential cookies and optional communications, which you may withdraw at any time); and compliance with legal obligations.

5. Proxy traffic

We do not monitor, log, inspect or store the content of the traffic you route through our proxies. For billing and abuse-prevention purposes we process only aggregate metadata such as the volume of bandwidth transferred and the number of connections. Your browsing activity through the proxies is not associated with the content of the sites you visit.

6. Cookies

We use cookies and similar technologies for authentication, session management and anonymized analytics. We do not use advertising cookies. For full details and your choices, see our Cookie Policy.

7. How we share information

We do not sell your personal data. We share data only in the following circumstances:

• With service providers acting on our behalf, such as payment processors, email delivery providers and infrastructure and network partners, under appropriate confidentiality and data-protection terms.
• When required by applicable law, regulation, legal process or an enforceable governmental request.
• To protect the rights, property and safety of Proxya, our users or the public, including to enforce our Terms and prevent fraud or abuse.
• In connection with a merger, acquisition or transfer of assets, in which case we will require the recipient to honor this Policy.

8. International data transfers

We and our service providers may process data in countries other than your own, including outside the European Economic Area and the United Kingdom. Where personal data is transferred to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent mechanism — together with any additional technical and organizational measures the transfer requires.

You may ask which safeguard applies to a particular transfer by writing to [email protected].

9. Data retention

We retain account data for as long as your account is active. After account closure we delete or anonymize personal data within a reasonable period, except where we must retain certain records to comply with legal, tax or accounting obligations, or to resolve disputes and enforce our agreements. Security and billing logs are kept only as long as necessary for those purposes.

10. Data security

We apply industry-standard technical and organizational measures, including TLS encryption in transit, hashing of passwords, short-lived authentication tokens, access controls and ongoing monitoring. No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where required by law.

11. Your rights

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to certain processing, to receive it in a portable format, and to withdraw any consent you have given — withdrawal does not affect processing carried out before it.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity first. We respond within one month of receiving a valid request and will tell you if a request is complex enough to need up to two further months, as data protection law allows. Exercising your rights is free unless a request is manifestly unfounded or excessive.

We use automated checks to detect fraud, abuse and payment risk, and those checks can delay or block an order or an account. If an automated check has affected you, you can ask for a person to review it by writing to [email protected] or [email protected].

If you are in the European Economic Area or the United Kingdom and are not satisfied with how we have handled your data, you may lodge a complaint with your national supervisory authority — in the United Kingdom, the Information Commissioner's Office. We would appreciate the chance to resolve the matter first.

12. Children's privacy

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Third-party links

The Service may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will notify you by email or through a notice on the Service before they take effect. The date at the top of this Policy shows when it was last updated.

15. Contact

For privacy questions or to exercise your rights, contact our privacy team at [email protected]. We aim to acknowledge within 72 hours and to complete rights requests within one month, as described in section 11.