Legal

Privacy Policy

What we collect, why, and what we do not collect.

Version 2026-10-21 · In force from 21 October 2026 · Cookie section updated 22 October 2026

The short version

We collect only what we need to run your account, take payment and keep the service safe.
We do not record the websites you visit, the content of your traffic, your DNS lookups, or when you connect.
We never see your card number. Stripe handles payments.
We do not sell your data and use no advertising trackers. Website statistics (Google Analytics) run only if you accept them.
You can ask us for a copy of your data or ask us to delete it at any time.

1. Who is responsible

The controller of your personal data is [[LEGAL_NAME]], a sole trader (individuali veikla) in Lithuania, registration or certificate number [[REG_NO]], address [[ADDRESS]]. Contact: support@personalvm.com. This policy covers personalvm.com (website and blog) and portal.personalvm.com (your account).

2. What we collect, why, and for how long

Data	Why we use it	Legal basis	How long
Account: email address, password (stored only as a salted hash, never in plain text), the date you joined, and a record that you accepted the Terms (document version, time, IP address)	To create and run your account, send your verification code, and prove what you agreed to	Contract; legitimate interest (record of agreement)	While your account exists. After you ask us to close it, we delete it, except what we must keep (see payments)
Login sessions and codes: session token, one-time email verification code (stored hashed)	To keep you logged in and verify your email	Contract; legitimate interest (security)	Sessions last up to 7 days. Codes expire after 15 minutes
Orders and payments: what you bought, term, amount, date, Stripe payment reference. Your card details are handled by Stripe only	To deliver and renew the service, give receipts and invoices, handle refunds	Contract; legal obligation (accounting and tax)	As long as accounting and tax law requires
Your VPN: location, the IP address assigned to your server and the dates it was yours, the WireGuard public keys, and your device configuration files (encrypted in our database so you can download them again)	To create, run, renew and delete your VPN, and to answer abuse reports about the address	Contract; legitimate interest (abuse handling); legal obligation	While your service is active. A record of which address belonged to which account is kept afterwards only as long as needed for abuse reports, legal claims and accounting
Technical data from our sites: your IP address and browser details when you sign up, log in or send a message, plus normal web-server logs	To stop abuse and fake sign-ups (rate limits), keep the service secure and fix faults	Legitimate interest (security)	Rate-limit records about 3 days. Server logs only for a limited time
Visitor statistics (only if you accept): pages visited, approximate location, device and browser type, and how you reached us, collected through Google Analytics cookies	To understand how the website is used and improve it	Your consent, which you can withdraw at any time	Cookies last up to 2 years; Google Analytics keeps reports for no longer than 14 months
Messages to us: what you write in the contact form or in emails, with your email address and IP address	To answer you and keep a record of support	Legitimate interest; contract	As long as needed to deal with your request and a reasonable time afterwards

3. What we do not collect

We do not record or store which websites you visit, what is in your traffic, your DNS lookups, or logs of when you connect and disconnect. We have no tools in place to monitor these things. The WireGuard software on your server necessarily keeps the latest connection address and handshake time of each device in the server’s memory while it runs. We do not save or collect that information, and it is lost when the server restarts.

For fair usage (see the Terms) we may look at total traffic volume figures for a server. Our hosting provider may keep technical network records for its own purposes, under its own policy.

Because we do not keep these records, we cannot give them to anyone, including authorities. If we receive a valid legal request, what we could provide is limited to the data listed in section 2, such as which account an IP address belonged to.

4. Cookies and similar technology

Strictly necessary: a cookie called pvm_consent remembers whether you accepted or declined analytics (180 days). Our website and blog set no other cookies for visitors. Fonts are hosted on our own server.
Analytics, only with your consent: if you click Accept, Google Analytics (Google Ireland Limited) sets the cookies _ga and _ga_… and receives usage data such as the pages you view, your device type and approximate location. We switch off Google’s advertising features and ad personalisation, and Google Analytics does not log or store IP addresses. If you decline, nothing is loaded and nothing is sent to Google. You can change your choice at any time with Cookie settings in the footer of our pages.
We do not run Google Analytics inside your logged-in account pages.
Your account page keeps a login token and a few display choices (for example whether the “How to connect” guide is hidden) in your browser’s local storage. These are needed for the service to work. We do not use them for tracking.
The contact form and sign-up use Cloudflare Turnstile, a bot check, which runs a small script from Cloudflare when the form is shown.
Some blog articles may contain affiliate links. If you click one, the other website has its own policy.

We do not sell your data. We use these service providers (processors) only to run the service:

Cherry Servers (data-centre and server hosting, Lithuania): our servers and your VPN servers run there.
Stripe (Stripe Payments Europe, Ltd.): takes your payment, sends receipts, and prevents card fraud. Stripe is also an independent controller for its own legal and fraud-prevention duties.
Hostinger: runs our email, including the verification emails we send you and the messages you send us.
Cloudflare: bot check (Turnstile) on forms.
Google (Google Ireland Limited, which may involve Google LLC in the USA): website statistics through Google Analytics, only if you accept analytics cookies.
Encrypted backups of our systems are stored on a separate server of ours.

We may also share data where the law requires it, with authorities, or with a hosting provider handling an abuse report (see section 10 of the Terms), and with our accountant or advisers where needed. Some providers (such as Stripe, Cloudflare and Google) may process data outside the EU/EEA. They rely on safeguards approved by the EU, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How we protect it

All connections to our websites use HTTPS.
Passwords are stored only as salted hashes. Device configuration files are encrypted in our database.
Sign-up, login and contact forms are rate-limited and checked for abuse.
Backups are encrypted and kept on a separate server. Data you ask us to delete disappears from backups as they rotate.
Access to our systems is limited to what is necessary.

No system is perfectly secure. If a breach seriously affects your data, we will tell you and the authorities as the law requires.

7. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; send it to you in a usable format; or stop using it where we rely on legitimate interest. Write to support@personalvm.com from the email address on your account. We answer within one month.

If you close your account, we delete your account data, except what we must keep by law (such as payment records) or need to handle a legal claim or abuse report. Closing your account does not entitle you to a refund (see the Terms).

You also have the right to complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the data protection authority in your own country. We would appreciate the chance to put things right first.

8. Other points

Age: the service is for people aged 18 and over.
No automated decisions: we do not make decisions about you that have legal effect by automated means, other than the technical rate limits and abuse checks described above.
Changes: we publish updates here with their date, and tell account holders by email if a change is important.

Questions: support@personalvm.com.