Privacy
policy

The data involved depends on how the user interacts with the service.

Account data

When registering or using an account, the following may be processed:

• email address;
• name or display name;
• account identifier;
• password in a protected form;
• plan and subscription term information;
• history of support requests.

Payment data

When making a payment, the following may be processed:

• order number;
• payment amount and currency;
• transaction date and status;
• selected plan;
• technical payment identifier.

Full bank card details, including the CVC/CVV code, are normally processed by a third-party payment operator and are not shared with us unless explicitly stated otherwise at payment.

Technical data

SpireVPN does not keep or store technical logs. To operate the service, technical data may be processed at the time of a request or connection without being recorded in logs:

• IP address;
• device type;
• operating system;
• application version;
• device language and region;
• browser information;
• current connection parameters;
• information about the operation of the application and VPN connection.

Real-time processing to operate the service does not mean that request, connection or error histories are stored. No such logs are created.

Support request data

If a user contacts support, we may process:

• name;
• email address;
• request contents;
• device information;
• plan and order information;
• attachments and screenshots sent by the user.

Do not send passwords, verification codes or full bank card details to support.

To establish and maintain a VPN connection, the infrastructure processes current connection parameters without storing them in logs.

This data may include:

• account identifier;
• selected server;
• current parameters required for data transmission.

We keep no logs: we do not store browsing history, traffic contents, DNS requests, IP addresses, VPN session history, transferred traffic volumes or technical error logs. There are no exceptions for temporary diagnostics. Account data, payment data and messages voluntarily sent to support are processed separately as described in this Policy.

We may use data for the following purposes:

• registering and maintaining accounts;
• providing access to the VPN service;
• processing payments and managing subscriptions;
• sending service notifications;
• responding to user requests;
• restoring account access;
• protecting infrastructure security;
• detecting fraud and abuse;
• investigating technical problems using information voluntarily sent to support by the user;
• improving the website, application and service;
• fulfilling legal obligations;
• protecting the rights and legitimate interests of the user and service owner.

We do not use data for purposes unrelated to service operation without an appropriate basis or notice to the user.

The website may use cookies and similar technologies.

They may be used for:

• saving user preferences;
• authentication;
• enabling the user account area to function;
• improving the interface;
• protecting against suspicious activity.

The website may use the following categories of cookies:

• necessary — required for the website and account to function;
• functional — save selected settings;
• analytics — help assess website performance;
• marketing — used only where the relevant tools and grounds are present.

The user can restrict cookies through browser settings. Disabling certain cookies may affect website operation.

We may share necessary data with the following categories of recipients:

• payment operators;
• server and cloud infrastructure providers;
• email delivery services;
• technical support providers;
• providers of fraud and attack prevention tools;
• analytics services, if used;
• government authorities — only in the cases and manner prescribed by applicable law;
• professional advisers, where necessary to protect rights and legitimate interests.

Third parties receive only the amount of data necessary to perform the relevant function.

We do not sell users' personal data to third parties unless expressly stated otherwise in this Policy.

Third-party payment systems may be used to process payments

Payment data processing is governed by the relevant operator's privacy policy. The user should read those rules before making a payment.

We retain data only for the period necessary for the purposes set out in this Policy or for the period prescribed by applicable law.

Retention periods may depend on the data category:

• account data — until the account is deleted or retention is no longer needed;
• payment data — for the period needed to confirm the transaction and fulfill obligations;
• support requests — 365 days;
• data relating to legal requirements — for the prescribed period.

After the retention period expires, data is deleted, anonymized or archived if further retention is required by law.

We use reasonable organizational and technical measures to protect data against:

• unauthorized access;
• loss;
• alteration;
• disclosure;
• destruction;
• unlawful use.

These measures may include encryption, access controls, backups, employee permissions allocated according to their duties and security monitoring.

However, no method of transmitting or storing data can guarantee absolute security.

Depending on the infrastructure used, data may be processed or stored on servers located in different countries.

Where operating the service requires data to be transferred outside the user's country, the transfer is made with regard to applicable legal requirements and necessary safeguards.

Depending on applicable law, the user may have the right to:

• request information about the data being processed;
• request correction of inaccurate data;
• request deletion of data;
• restrict processing;
• withdraw previously given consent;
• object to certain types of processing;
• receive a copy of the data;
• lodge a complaint with a competent authority.

To exercise a right, send a request to support@spre.pro. In certain cases, we may ask for proof of identity or account ownership before fulfilling the request.

The request must include:

• the user's name;
• the account email address;
• a description of the request;
• a preferred way to receive a response.

The service is not intended for persons who are prohibited from using it under applicable law.

If we become aware that a minor's data has been provided without the necessary consent, we will take reasonable steps to delete it.

The website or application may contain links to third-party websites and services.

We do not control the content or data processing rules of those resources. Before sharing information with third-party services, we recommend reading their privacy policies.

We may update this Policy as a result of changes to the service, infrastructure, data processing methods or applicable requirements.

A new version is published on this page with the update date.

If changes materially affect the user's rights, we may also notify them by email or through the service interface.