Privacy notice

Who we are

ZaRVPN is run by BobzaR Network Ltd, a company registered in England and Wales (number 16198185). We are the controller of the personal data described here, which means we decide how it is used. You can reach a person through our support page.

What we keep

• Your account: your email address and a scrambled (hashed) version of your password. If you turn on two-step sign-in, we keep the key for it in encrypted form.
• Your plan and payments: your plan, whether it is active and your payment records. Your card details go straight to our payment provider. They never reach our servers.
• Your devices: the name you gave each device, its public key and which location it uses.
• How much data an account moves: a running total per account, so we can spot abuse and plan server capacity. We never use it to slow anyone down.
• Messages you send us: what you write on the support or abuse forms, and your email so we can reply.
• Staff actions: when one of our team changes something on an account, we record who did it and why. This protects you as much as us.

What we never keep

• The websites you visit.
• The lookups your device makes to find those websites.
• The internet addresses you connect from.
• Your private key. Your device makes it, keeps it and never sends it to us. We only receive the public half, so the keys we hold cannot be used to read your traffic.

Our filter that blocks scam and malware sites counts how many lookups it blocked, per category, and keeps those counts for each device as numbers. It never records which site was looked up or blocked.

Why we use it

The law asks us to give a reason for each use of personal data. Ours are:

• to provide the service you pay for (it is our contract with you);
• to keep accounts and servers secure and to stop abuse (our legitimate interest in running a safe service);
• to keep records the law requires, such as payment records (a legal obligation).

We do not sell personal data, and we do not use it for advertising.

Who else sees it

We use a small number of companies to run the service, and each only gets what its job needs:

• a payment provider, who takes your payment and holds your card details;
• ZaRHost, a service of BobzaR Network Ltd, which hosts our servers in the UK, along with the infrastructure companies ZaRHost itself relies on;
• an email service, which delivers the messages we send about your account.

If we ever add another one, we will update this page first.

How long we keep it

When you close your account, we delete your account data. We keep payment records for as long as tax and accounting law says we must. Messages to support and abuse reports are kept only as long as we need them to deal with the matter and to show we dealt with it properly.

The leak check

Our leak check asks your browser to contact our servers, using a made-up name and a connection test, to see which address and lookups it really uses. The answer is shown to you on the page and is not stored.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it in a particular way. Write to us through the support page and say what you would like. If you are not happy with how we handled it, you can complain to the Information Commissioner’s Office at ico.org.uk.

Requests from authorities

We answer lawful requests that are valid under UK law, and we check each one. Because we do not keep browsing records or the addresses people connect from, there is nothing of that kind to hand over. We can only share what is in the “What we keep” list above.