Privacy Policy

A VPN is a trust product. This policy says exactly what we collect, what we never collect, and what happens to your data. It is written to be read, not skimmed past.

The short version

• We do not log what you do online. Not your browsing, not your DNS queries, not your traffic.
• We keep the minimum needed to run your account: your email and your subscription state.
• Your WireGuard private key is generated on your device and never leaves it. We only ever see the public key.
• We do not sell or rent your data. The companies that touch it are the processors listed below, acting on our instructions to deliver the service, and Google Ads: when a purchase on our website came from one of our Google ads, we report that purchase to Google, with your email only as a one-way hash, so we can measure the ad.

Who we are

SecuremeVPN is operated by VISATECH S.R.L. ("we", "us"), a company incorporated in Italy, which is the data controller for the personal data described here.

VISATECH S.R.L.
Registered office: Via del Lauro 9, 20121 Milan (MI), Italy
Company Registration No. (Milan Companies Register): MI-2631753
VAT No.: IT 11929140967
support@securemevpn.com

What we collect

Account data

• Email address. Used to sign you in with one-time codes, deliver any redeem codes we issue you, and send service emails such as trial and renewal notices.
• Sign in with Apple or Google identifiers. If you use social sign-in we store the provider's stable account identifier so we can recognize you next time. Apple may give us a private relay email instead of your real one; that is fine with us.
• Subscription state. Which plan you are on, whether it is active, when it renews or expires, and who billed it. This comes from Apple, Google, or, for purchases made on our website, from our payment service provider.
• Device records. A name, platform, and app version for each signed-in device, so you can see and remove your devices and so we can enforce the 5 device limit.
• Push notification token. If you allow notifications, the app stores a push token with your device record so we can tell you when your subscription starts, renews, or ends. The token is removed when you sign out or remove the device.

Operational data

• Live session records. While a tunnel is connected, our API holds the session needed to keep it running: the device's WireGuard public key, the private tunnel address it was assigned, the server it is on, when the session started, and the time of the last handshake (used only to expire dead sessions). When you disconnect, or the session goes stale, the record is deleted within one hour. We do not keep a history of your connections.
• Aggregate bandwidth counters per server. Each VPN server reports totals so we can plan capacity and keep servers fast. These are counters per server node, never per user.
• WireGuard public keys. When a device connects, it registers its public key so the server will accept the tunnel. The matching private key is created on your device and never transmitted anywhere.
• Sign-in security records. When you request a sign-in code or sign in (by email code, Apple, or Google), we record the event with your IP address and browser or device type. We use this only to spot abuse such as code-guessing and account attacks, and each record is deleted after 90 days.
• Support messages. If you contact us, we keep the message and our reply so we can actually help you.
• Ad click records. When you tap one of our ads or campaign links, our link service records the click so we can tell which of our own ads led to an install or a purchase: the time, the campaign and ad identifiers carried in the link (such as UTM parameters and the ad network's click identifier), the landing page and referring page, your IP address, browser or device type, operating system version, language, and approximate country. On iPhone, a short redirect page also reads your screen size, time zone, and display settings before sending you to the App Store, so the click can be matched to the app install. On our website, this record is only created if you accept marketing cookies. Click records are used only to measure our own advertising and are deleted after 120 days. Your Cookie settings control this record and the cookies listed below; they do not stop the Google Ads purchase report described under Third parties, which is sent for every purchase on our website that came from a Google ad.
• Technical access logs. Like every web service, our servers keep short-lived technical logs (time, endpoint, response code) for security, rate limiting, and abuse prevention. Our API application logs do not record your IP address; web-server logs that include it are rotated within 30 days. These are the servers you sign in and manage your account through, not the VPN servers.

What we never collect

• Browsing history or the content of your traffic.
• DNS queries.
• A history of your connections. Live sessions exist only while you are connected and are deleted afterwards.
• Your source IP address on VPN servers. VPN servers do not write connection or activity logs.
• Bandwidth usage tied to an individual user.

Our VPN servers are configured without user-level activity logging, and their system logs are held in memory only and never written to disk. If a server is seized or compromised, there is no history of who connected where, because that history is never written.

Third parties

We do not sell, use, or disclose any of your data to third parties for any purpose other than delivering the service to you and measuring our own advertising with Google Ads, as described below. We never share VPN usage data with anyone, because we do not have it. The only companies that receive personal data from us are:

• Apple, Google, and our payment service provider for payments, as described below.
• Adapty, which manages App Store and Google Play subscriptions for us. It receives an anonymous account identifier, your purchase state, and subscription events such as a paywall being viewed or a plan being bought, which we use to understand our own sales; it does not receive your email or any VPN data, and we have disabled its collection of advertising identifiers (IDFA and Google Advertising ID) and of your IP address.
• Amazon Web Services, which delivers our service emails.
• PostHog, which measures how visitors move through our purchase pages on get.securemevpn.com: the pages viewed, steps such as starting checkout or confirming an email address, and whether the purchase completed, so that we can find and fix the places where checkout fails. It receives your IP address and your browser and device type, as any website does, and an identifier for the page visit. It runs without cookies or local storage: that identifier lives only in the open page and is gone when you close or reload it. After you pay, PostHog also receives your email address: in readable form as part of the address of the page where you confirm it, and as a one-way SHA-256 hash with the purchase record, which we use for the Google Ads purchase reports described below. PostHog does not receive your card details or any VPN data. It processes this data in the United States.
• Google Ads, which measures our own advertising on Google. When you buy a subscription on get.securemevpn.com after clicking one of our Google ads, we send Google Ads a report of that purchase: the ad click identifier carried in the link you arrived through (gclid, gbraid, or wbraid), the time, the amount and currency of the first charge, an order number, your IP address and browser or device type, and your email address as a one-way SHA-256 hash, never in readable form. Google uses it to match the purchase to the ad click so we can see which of our ads work. The report is sent for every purchase that came from a Google ad, whatever you chose in Cookie settings. Purchases that did not come from a Google ad are not reported, and nothing about your VPN use is ever sent. Google processes these reports under its Google Ads terms and its own privacy policy, and may do so outside the EEA and the UK.
• Google Firebase Cloud Messaging and Apple Push Notification service, which relay push notifications to your device. They receive the device's push token and the notification itself, a short subscription status message, and nothing else.
• Hosting providers that run our API and VPN servers. They provide the machines; they do not have access to your account data or traffic.

We do not use advertising SDKs, cross-app tracking, or the advertising identifier, and we never sell your data or use it to advertise other companies' products. Three things come close enough that we want to spell them out: the subscription events Adapty records for us, described above; Apple Search Ads attribution when we advertise on the App Store, where Apple tells us (through Adapty, using Apple's own AdServices framework rather than the advertising identifier) which of our own ads led to a download so we can measure them; and the Google Ads purchase reports described above. None of them involves your browsing, traffic, or VPN use. Adapty's events and Apple's attribution are not shared with anyone else; the Google Ads purchase reports go to Google and no one else.

Legal requests

If we receive a lawful request for user data, we can only provide what we hold: the account data listed above. We have no connection logs, browsing data, or traffic to hand over, and we will contest overbroad requests where the law allows.

Payment processors

We never see or store your full card number. Payments are handled by:

• Apple App Store for purchases made on iPhone, iPad, and Mac App Store builds.
• Google Play for purchases made on Android.
• PayPoye, our payment service provider, for purchases made on our website. You enter your card details on the provider's secure checkout, which is certified to the PCI DSS standard. We receive the outcome of the payment, the plan, the amount, the email you gave at checkout, and a masked card reference (the last four digits and card type) so we can find the payment if you ask about it.

Each processor has its own privacy policy that applies to the payment itself. Billing records for website purchases are kept for as long as Italian tax and accounting law requires, which is ten years.

Cookies and similar technologies

Our website uses very few cookies, and none of them relate to your VPN traffic. When you first visit we show a banner where you can accept or reject the non-essential ones; rejecting is one click and has no effect on the service. You can change your mind at any time from the Cookie settings link in the footer of every page.

Name	Type	Purpose	Duration
smv_consent	Strictly necessary (first party)	Remembers whether you accepted or rejected non-essential cookies, so we do not ask again.	180 days
smv_params, smv_click_id (plus a localStorage mirror)	Marketing and attribution (first party), only with your consent	Records the campaign parameters and click identifier of the advertisement that brought you to the site, so that if you later install the app we can tell which of our own ads worked. We do not share this with anyone.	90 days
_fbp, _fbc	Marketing (Meta), only with your consent and only on pages where the pixel is enabled	Meta Pixel identifiers used to measure our advertising on Facebook and Instagram. Governed by Meta's privacy policy.	90 days
smv_session (local storage, not a cookie)	Strictly necessary (first party), only after you sign in on the manage page	Keeps you signed in to the manage page so you do not need a new email code on every visit. Removed when you sign out.	30 days after your last visit
_ttp	Marketing (TikTok), only with your consent and only on pages where the pixel is enabled	TikTok Pixel identifier used to measure our advertising on TikTok. Governed by TikTok's privacy policy.	13 months

When you sign in on the manage page, your sign-in session is saved in your browser's local storage (not a cookie) so you stay signed in. This is strictly necessary for the feature you asked for, so it needs no consent; it ends when you sign out or after 30 days without a visit, and it is never used for tracking. We do not use analytics cookies, and there is no advertising SDK or tracking inside the apps. Our purchase pages on get.securemevpn.com measure checkout with PostHog without setting any cookie or using local storage, as described under Third parties.

Email

Service emails, such as sign-in codes and receipts, are delivered through Amazon Simple Email Service. We send transactional email only. We do not send marketing email unless you have explicitly opted in, and every non-essential email includes a working way out. We keep delivery status records for these emails (sent, delivered, bounced, complained) for 90 days to diagnose delivery problems, then delete them.

Data retention

• Account data is kept while your account exists.
• If you delete your account, in the app under Settings, your account is deactivated immediately: all devices and sessions are removed and, if you signed in with Apple, we revoke the Sign in with Apple token. Signing in again within 30 days restores the account; after 30 days your email, sign-in identifiers, and device records are permanently erased and any remaining billing records are anonymized.
• Live VPN session records are deleted within one hour of the session ending.
• Sign-in security records are deleted after 90 days.
• Ad click records are deleted after 120 days.
• Purchase reports sent to Google Ads are kept by Google under its own retention rules; we cannot delete them from Google once sent.
• One-time sign-in codes expire within 10 minutes and are stored only as hashes.
• Email delivery status records (sent, delivered, bounced, complained) are deleted after 90 days.
• Technical access logs for the API and website are rotated within 30 days.
• Database backups exist only so we can restore the service after a failure. They are kept for 7 days and then deleted, so data you delete from your account disappears from backups within that window too.
• Aggregate server counters contain no personal data and may be kept for capacity planning.

Why we are allowed to process this data

If you are in the EEA or the UK, the GDPR requires us to name a legal basis for each purpose. Ours are:

• Performance of a contract. Your email, sign-in identifiers, subscription state, device records, live session records, and WireGuard public keys. Without these we cannot give you an account or a working tunnel.
• Legitimate interests. Sign-in security records, ad click records used to measure our own advertising, purchase reports to Google Ads for purchases that came from our Google ads, short-lived API and website access logs, short-lived database backups, aggregate per-server bandwidth counters, cookieless measurement of our purchase pages, and acting on credible abuse reports. Our interest is keeping the service secure, available, and fast, and knowing which of our own ads lead to purchases; we have balanced it against your privacy by keeping these records minimal, aggregated where possible, and short-lived.
• Consent. Marketing email, which we send only if you opt in and which you can withdraw at any time. Withdrawing consent does not affect processing that already happened.
• Legal obligation. Retaining billing and tax records, and responding to lawful requests, where the law requires it of us.

Where your data is processed

We are based in Italy, in the European Union. Our processors and VPN servers are located in several countries, so some of your personal data is transferred internationally. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), or on an adequacy decision where one covers the destination, and we require each processor to apply security measures appropriate to the data. You can ask us for details of the safeguards used for a specific transfer.

Your rights

Wherever you live, we extend the same rights to you: access, correction, export, and deletion of your personal data, and objection to processing. If you are in the EEA or UK these are your GDPR rights, which also include the right to restrict processing and the right to data portability; in California, your CCPA rights, including the right not to be discriminated against for exercising them; in India, your rights under the Digital Personal Data Protection Act, 2023. To exercise any of them, use the contact page or email support@securemevpn.com from your account email. We respond within 30 days, and we do not charge for this.

We would rather hear from you first, but you always have the right to complain to a regulator. In the EEA that is the data protection supervisory authority of the country you live or work in; our lead authority in Italy is the Garante per la protezione dei dati personali (garanteprivacy.it); in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India.

Children

SecuremeVPN is not directed at children under 16 and we do not knowingly collect data from them.

Changes to this policy

If we change this policy in a way that matters, we will notify you by email or in the app before the change takes effect. The effective date below always reflects the current version.

Contact

Privacy questions go to support@securemevpn.com or the contact page.

Data controller: VISATECH S.R.L.
Registered office: Via del Lauro 9, 20121 Milan (MI), Italy
Company Registration No. (Milan Companies Register): MI-2631753
VAT No.: IT 11929140967
support@securemevpn.com