Privacy Policy

1. Who we are

ProxyNova LLC., 800 N. French Street, Wilmington, DE 19801, United States, is the data controller for the personal data described in this policy. We are registered in Delaware. You can reach us about anything in this document at support@proxy-nova.online.

We do not operate a separate Data Protection Officer because our processing does not meet the threshold for mandatory appointment, but the address above is monitored by the person responsible for data protection.

2. What we collect

We collect the following categories of data:

• Account data. Email address, hashed password, display name, optional company name and country, referral code, account status and role.
• Order and billing data. The plans you purchase, quantities, rental terms, order totals, coupon usage, invoice references and the history of your balance adjustments.
• Payment metadata. The payment token issued by Paymento, Paymento’s payment identifier, the order status returned by Paymento, and public on-chain data such as transaction hashes and confirmations. We never receive your private keys or the contents of your wallet.
• Service configuration data. The proxy credentials we issue to you (host, port, username, password), endpoints’ expiry dates, auto-renew settings and connection-test results.
• Support data. The content of tickets you raise, including any attachments, and the messages you send through the contact form.
• Technical and security data. Session records (a hashed session token, IP address, user agent, creation and expiry timestamps), audit-log entries for administrative actions, and rate-limiting counters.
• Content you publish. Reviews you submit, including the display name, optional company and country you attach to them.

We do not collect: your real name or address, identity documents, payment card numbers, the destinations you request through a proxy, the contents of that traffic, or any biometric data.

3. Why we process it, and our legal bases

• To perform our contract with you — creating and securing your account, processing orders, provisioning and renewing proxies, delivering support and keeping an accurate billing record.
• Our legitimate interests — preventing fraud and abuse, protecting the network and other customers, keeping audit trails of administrative actions, and understanding aggregate usage so we can plan capacity. We balance these interests against your rights and do not use them as a justification for profiling or advertising.
• Legal obligation — retaining order and tax records where the law requires it, and responding to valid legal process.
• Consent — subscribing to our status and product emails. You can withdraw at any time using the unsubscribe link in any such email.

4. What we do not log

Our proxies do not record the destinations you request, the requests themselves, or the data returned. We do not retain payload contents, headers or query strings.

We do keep connection-level metadata — for example the number of concurrent sessions per endpoint — because it is needed for capacity planning and to detect abuse. This metadata is aggregated or discarded within 30 days and is never sold or shared for marketing purposes.

Where an abuse report identifies a specific endpoint and time window, we may retain the minimum metadata needed to investigate that report until it is closed, and then delete it.

5. Who we share data with

We share data only with the following categories of recipient:

• Paymento (payment processing). Paymento receives your email address (if you supply one), the order reference and amount, and processes the crypto payment. Paymento is a separate controller for its own compliance obligations; its privacy notice is published at paymento.io.
• Infrastructure suppliers (proxy provisioning). We share the provisioning parameters required to allocate endpoints — country, city, quantity, term and protocol. We do not send them your identity or contact details.
• Hosting and database providers that run the servers this platform is deployed on, under contract and only as processors.
• Professional advisers and authorities where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.

We do not sell personal data, we do not share it with advertising networks, and we do not use third-party analytics that build cross-site profiles of you.

6. How long we keep it

• Account data — for as long as your account exists, then deleted or anonymised within 30 days of a verified deletion request, except where retention is legally required.
• Order and billing records — kept for six years after the end of the relevant financial year to satisfy tax and accounting obligations.
• Sessions — deleted on sign-out, expiry, or when you use “sign out everywhere”; expired rows are purged automatically.
• Connection metadata — maximum 30 days, as described above.
• Support tickets — kept for two years after the ticket is closed so that repeat issues can be traced.
• Audit logs — kept for 12 months.

7. Your rights

Depending on where you live, you may have some or all of the following rights: access to your data, correction of inaccurate data, erasure, restriction of processing, objection to processing based on legitimate interests, and data portability. If you are in California, you additionally have the right to know what categories we collect, to request deletion, and to be free from discrimination for exercising those rights.

To exercise any right, email support@proxy-nova.online from the address on your account. We will respond within 30 days. We may need to verify your identity — normally by asking you to confirm control of the account email, which is the only identifier we hold.

You also have the right to complain to your local supervisory authority. We would appreciate the chance to resolve the issue first.

8. How we protect it

• Passwords are stored only as bcrypt hashes with a per-user salt and high work factor.
• Session tokens are random, stored server-side as hashes, and delivered in httpOnly cookies.
• API keys are stored as SHA-256 hashes and can be scoped and revoked individually.
• Payment callbacks are authenticated with HMAC-SHA256 and independently re-verified server-side before any order is fulfilled.
• Access to production data is limited to staff who need it, and administrative actions are audit-logged.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and any relevant regulator without undue delay and describe what happened and what we are doing about it.

9. International transfers

Our infrastructure and suppliers may be located outside your country. Where personal data is transferred internationally we rely on appropriate safeguards — standard contractual clauses or an equivalent mechanism — and we keep the amount of data transferred to a minimum. Because we do not collect your name, address or identity documents, the data at issue is limited to account identifiers and order metadata.

10. Children

The service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

When we make a material change we will update the date at the top of this page and, for significant changes, notify registered customers by email or in the dashboard. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.

12. Contact

Questions, requests and complaints about privacy should go to support@proxy-nova.online, or by post to 800 N. French Street, Wilmington, DE 19801, United States.