Privacy Policy

This policy explains what personal data VPN Bunny processes, why, how long we keep it and what your rights are.

1. Who is responsible

VPN Bunny is provided by Ashford Glen LLC (United States), with its registered address at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Tax number: 42-2671641. In these documents, "we", "us" and "our" mean Ashford Glen LLC.

We are the controller of your personal data. You can contact us about privacy through our contact form.

2. What we collect

• Account details: your email address or mobile number, and your name if you give it.
• Payments: the plan, amount, dates and PayPal payment references. PayPal processes the payment itself; we never receive your card details.
• Security data: the IP address, approximate location (country, region, city) and device information when you buy, sign in or contact us, to prevent fraud and protect your account.
• Consent records: which version of our terms you accepted, and your cookie choice.
• Support messages: what you write to us and our replies.
• Billing details: company name, address and tax ID, if you ask for a company invoice.
• VPN account identifiers: a random VPN username and an anonymous alias, never your name or email address.

3. Our no-logs VPN network

Our VPN network runs on dedicated, RAM-only servers operated by our infrastructure partner under a strict zero-logs policy. No browsing history, DNS queries, traffic content, source or destination IP addresses, connection or disconnection timestamps, session durations or bandwidth histories are stored, by us or by our partner. We never receive VPN activity data from our partner.

4. Separation by design

Your VPN account is created with our infrastructure partner under a random username and an anonymous alias. Your identity (email, phone, payments) is kept only by us, separately from the VPN network.

5. Why we use your data

• Contract: to create and run your VPN account, take payments, send login details and receipts, and answer support requests.
• Legal obligation: to keep accounting and tax records.
• Legitimate interests: to prevent fraud and abuse, keep the service secure and improve it.
• Consent: for optional cookies and marketing. You can withdraw consent at any time.

6. Who receives your data

We share personal data only with the service providers that help us run VPN Bunny, and only what each of them needs:

• PayPal: Payment processing (Worldwide)
• Our VPN infrastructure partner: Operating the VPN servers and your VPN account (random username and anonymous alias only) (Worldwide)
• Resend: Email delivery (United States)
• Cloudflare: Network security and content delivery (Worldwide)
• Our hosting provider: Hosting of this website and its database

We disclose data to authorities only when the law requires it.

7. International transfers

Some of these providers process data outside your country. Where the law requires it, transfers are protected by Standard Contractual Clauses or other lawful safeguards.

8. How long we keep it

• Account data: while your account exists and 30 days after you delete it.
• Payment and tax records: as long as the law requires (currently 10 years).
• Sign-in history: 12 months; precise location data (coordinates and postal code) only 90 days.
• Support messages: 24 months.
• Consent records: for the life of your account and the legal limitation period after it.

9. Your rights

You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You can delete your account in the account area. To exercise any other right, contact us through our contact form; we may ask you to confirm your identity first. You also have the right to complain to a data protection supervisory authority.

10. Other information

Security. We protect your data with encryption in transit, access controls and separation of systems, and we review these measures regularly.

Children. The service is not directed at people under 18, and we do not knowingly collect their data.

Automated decisions. We use automated checks only for fraud prevention and security, for example to ask for an extra verification code. They do not produce other legal effects for you.

Cookies. See our Cookie Policy.

Changes. We announce material changes to this policy in the same way as changes to our terms, at least 30 days in advance where the law requires notice.

Nothing in this policy limits rights you have under mandatory consumer-protection law that cannot be excluded by agreement.