Privacy Policy

1. Who we are

Pangea VPN ("we", "us", "our") is an independent service operated from the United Kingdom. The operator is the data controller responsible for the personal data processed in connection with the Service.

If you have questions about this policy or wish to exercise your data-protection rights, contact us at privacy@pangeavpn.org.

2. Data we collect

We collect only the personal data necessary to provide and improve our service:

• Account data — name, email address, and authentication identifiers provided when you register via Auth0, and, only if you choose to answer it at checkout, how you heard about Pangea.
• Billing data — payment card details (processed and stored solely by Stripe; we hold only a Stripe customer ID and subscription status), transaction history, and invoices.
• Service data — device identifiers and encrypted VPN configuration files required to deliver the VPN service. We do not record when you connect to or disconnect from the VPN, and we keep no logs of provisioning activity.
• Communications — name, email address, subject, and message content submitted through our contact form.
• Waiting list and download links — the email address you enter on our phone notice or download page. If you ask to hear when a phone app is out, it joins a waiting list for that platform, held with Resend. If you ask us to email you the download link for your computer, we use it to send that one email through Resend and do not add it to any list or store it in our database.
• Technical data — your IP address is processed transiently to serve requests, apply rate limits, and prevent abuse, but is not written to our request logs or stored. Browser and device type appear only in the website analytics described in section 9, which is never linked to your account. Umami uses the IP address, without storing it, to work out an approximate location and the visit identifier described in section 9.

We do not log your VPN traffic, browsing activity, or DNS queries.

3. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Performance of a contract (Article 6(1)(b)) — to create your account, process payments, provision VPN access, and provide customer support.
• Legitimate interests (Article 6(1)(f)) — to maintain security, prevent fraud and abuse, and improve our service, including the website analytics described in section 9, which you can switch off there. We balance these interests against your rights and do not use this basis where the impact on you would override our interests. We also rely on this basis to stop the free trial being claimed more than once (see section 7).
• Legal obligation (Article 6(1)(c)) — to comply with tax, accounting, and regulatory requirements.
• Consent (Article 6(1)(a)) — where you voluntarily submit a contact form, join a waiting list, ask us to email you a download link, answer the optional "how did you hear about Pangea?" question, or opt in to marketing communications. You may withdraw consent at any time.

4. How we use your data

• To register and authenticate your account.
• To process subscription payments and manage billing.
• To provision, maintain, and deprovision your VPN connection.
• To respond to support and contact enquiries.
• To send you a download link or an app announcement you asked for.
• To detect and prevent fraud, abuse, and unauthorised access.
• To comply with legal obligations, including tax records and law enforcement requests where legally required.

5. Third-party processors

We share personal data with the processors below, which are necessary to operate the service. Each of them is bound by a data-processing agreement; the one recipient that is not, Telegram, is described after the list:

• Auth0 (Okta, Inc.) — authentication and identity management. Data is processed in the United States.
• Stripe Payments Europe, Ltd. — payment processing and subscription management. Headquartered in Ireland, with processing also taking place in the United States. Stripe acts as an independent controller for payment data under its own privacy policy.
• Supabase, Inc. — database hosting (PostgreSQL). Data is hosted in London, United Kingdom (AWS eu-west-2 region).
• Resend — transactional email delivery. Data is processed in the United States.
• Cloudflare, Inc. — serves and protects our website (content delivery, encryption in transit and attack protection) and provides the Cloudflare Web Analytics described in section 9. Every request to the site passes through Cloudflare's network, which processes your IP address to deliver it. Data is processed on Cloudflare's global network, including in the United States.

We also use Telegram (Telegram Messenger Inc.) to send internal notifications to our staff about account events — sign-ups, checkouts, saved cards, trials, payments, renewals and cancellations — identified only by an internal account ID, never your name, email address or card number (a saved-card notice names only the card's brand). Telegram is not bound by a data-processing agreement with us, which is why these messages carry nothing more than that ID, and it may process them outside the United Kingdom.

We do not sell, rent, or trade your personal data to any third party.

6. International transfers

Some of our processors operate outside the United Kingdom, including the United States and the European Economic Area (EEA). Where personal data is transferred to a country without a UK adequacy regulation, we rely on one or more of the following safeguards approved by the UK Information Commissioner's Office (ICO):

• The International Data Transfer Agreement (IDTA);
• The UK Addendum to the EU Standard Contractual Clauses; or
• The UK Extension to the EU-US Data Privacy Framework, where the receiving organisation is certified.

The Telegram notifications described in section 5 are the exception: no such safeguard covers them, which is why they carry only an internal account ID.

You can request a copy of the safeguards in place for any specific transfer by emailing privacy@pangeavpn.org.

7. Data retention

• Account data — retained while your account is active, then deleted within 30 days of account closure unless retention is required by law.
• Billing records — retained for 7 years to comply with HMRC tax obligations.
• Contact messages — retained for 24 months, then deleted.
• Website analytics — recordings are deleted after 30 days and click and scroll positions after 90 days. Other analytics records have no set deletion date (see section 9).
• Staff notifications (Telegram) — kept in our staff chat until we delete them; each holds only the internal account ID and the event.
• Free-trial fingerprints — when an account that has had a free trial is deleted, a one-way keyed fingerprint of its email address is kept for 12 months; a one-way fingerprint of the card used to start a trial is kept for 12 months from the trial's start. They are used only to stop the same person or card getting a second free trial, cannot be turned back into the address or card, and do not stop you creating an account or subscribing.
• Waiting-list addresses — kept on that platform's list until you unsubscribe or ask us to remove you. An address entered only to receive a download link is not kept by us; Resend keeps its own record of the email it delivered.

8. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data where there is no compelling reason for continued processing.
• Restriction — ask us to suspend processing of your data in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@pangeavpn.org. We will respond within one month, as required by law.

9. Cookies and analytics

We use only essential cookies required for authentication and session management. We do not use advertising or analytics tracking cookies. Because these cookies are strictly necessary to provide the service you have requested, they are exempt from consent requirements under the Privacy and Electronic Communications Regulations 2003 (PECR).

We measure how our website is used with a self-hosted instance of Umami. It runs on our public pages and on the sign-in, email-verification and checkout pages. It never runs on your account dashboard or on our admin pages, apart from the single signup event described below. It sets no cookies and does not store your IP address.

For each visit it records the pages you view; the site you came from, without any search terms or query it carried, and any campaign tag in the link you followed; your approximate location (country, region and city); your browser, operating system and device type; your screen size and browser language; how long pages took to load and respond, and whether they shifted while loading; which links and buttons you click; how far down a page you scroll and which parts of it come into view; page elements you rest your mouse on for more than a moment; which form fields you use, but never what you type in them; your answers to the optional pricing introduction; and how far you get through checkout, including the plan and payment method you chose and whether the card worked. Card results include incomplete card details and failed bank checks as well as refusals, each with the reason code the card processor gives (for example "generic_decline"). Your card details never reach us: they go straight from your browser to Stripe. It also records the outcome of steps on the sign-in, verification and contact pages (for example whether an account number was accepted, whether an email was confirmed, or which contact-form fields need correcting, never what you typed), whether our sign-in page could be reached from your network, language switches, interactions with promotion banners and, if you are using an app's built-in browser, which app.

We also keep short recordings of visits to those pages, showing how the mouse moved, where you clicked and scrolled, and what the page looked like. Anything typed into a form is hidden in the recording, the card form is never captured because Stripe serves it, and account numbers, email addresses and saved-card details shown on the page are blocked out. Recordings are deleted after 30 days, and the click and scroll positions behind our heatmaps after 90 days. The other analytics records are not linked to your account and have no set deletion date.

Umami groups these records into a visit using an identifier it works out from your IP address and browser. That identifier changes every calendar month, and whenever your network or browser changes. We never link it to your account, name or email address, and we never send Umami your account number or any other account identifier. Because the signup event records the plan and the amount paid, a visit could in principle be matched to a purchase made at the same moment, so we treat these records as personal data and protect them accordingly; we never make that match. The Umami data is held on our own server and in our database at Supabase (see section 5), and is not shared with anyone else.

When you finish signing up, by card or by crypto, we record a "signup completed" event with the plan type and the amount paid, so we can see which campaign link led to it. To make that link, the campaign tag from the URL you arrived on (a ref, via, pay, promo or utm code, never anything personal) is kept in your browser's session storage and discarded when you close the tab. Our servers also record anonymous totals, such as how many checkouts were started and completed. An internal automated marketing tool reads aggregate statistics from these analytics, such as visit, click and signup totals per campaign, and never sees data about individual visitors or accounts.

We collect this on the basis of our legitimate interest in understanding and improving our website (see section 3). You can object at any time: the switch below turns our analytics off in this browser, recordings included, and remembers your choice in local storage.

The switch does not affect Cloudflare Web Analytics or the anonymous totals our servers keep.

Separately, Cloudflare, which serves our website, adds Cloudflare Web Analytics to the pages it delivers: cookie-free page analytics provided by Cloudflare. A small script loaded from Cloudflare reports which page was viewed, the referring page, how long the page took to load, and your browser and device type, and Cloudflare derives an approximate location (country) from your connection. It sets no cookies and uses no browser storage, and Cloudflare states that it does not use this data to fingerprint or track individual visitors. Unlike Umami, it runs on every page of the site, including account pages. Cloudflare processes this data on our behalf as listed in section 5, and we see it only as aggregate totals.

The first time you open our pricing page we may show a short introduction that asks roughly how long network blocks cost you and how often they happen, so it can work out an estimate of the time you lose. Answering is optional and you can skip it at any point. Umami records which of the fixed answers you picked, which step of the introduction you reached, and the hours estimate it showed. Your browser's local storage remembers that the introduction has been shown, so it does not appear again.

At checkout we may ask, once, how you heard about Pangea. Answering is optional and never holds up your purchase; if you answer, your choice is stored on your account and also recorded as an analytics event, and used only in aggregate, as a count of answers per option, including in the statistics the marketing tool above reads.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption at rest and in transit, access controls, and regular security reviews. VPN configuration files are AES-encrypted at rest.

11. Children

Our service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email or a prominent notice on our website. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Lawful disclosure to authorities

We will only disclose your personal data to law enforcement, regulators, or other public authorities where we are legally required to do so — for example, in response to a valid court order, production order, or a notice issued under the Investigatory Powers Act 2016, the Police and Criminal Evidence Act 1984, or equivalent UK legislation.

We do not log VPN traffic content, browsing activity, or DNS queries. We keep no provisioning logs, no connection or disconnection timestamps, and no audit trail of account activity — we cannot disclose what we do not hold. We do hold limited account and billing records as set out in section 7, and we may be compelled to disclose this data. Where we are not legally prohibited from doing so, we will inform affected users.

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

We would appreciate the chance to address your concerns before you approach the ICO, so please contact us first at privacy@pangeavpn.org.