Privacy Policy
Last updated: 29 June 2026 · Version 2026-06
This Privacy Policy explains how JaguarVPN Ltd. (“JaguarVPN”, “we”, “us”) collects, uses, shares, and protects your personal data when you use our VPN applications, websites, and related services (the “Service”). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are (Data Controller)
The data controller responsible for your personal data is JaguarVPN Ltd., a company registered in England & Wales (company number 00000000), registered office: London, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZA000000.
For any privacy questions or to exercise your rights, contact our Data Protection contact at privacy@jaguarvpn.com.
2. Our no-logs commitment
As a privacy service, we operate a strict no-logs policy for VPN traffic. We do not monitor, record, store, or log:
- your browsing history, the websites or apps you visit, or DNS queries;
- the content of your traffic;
- the IP addresses you connect to, or pairings of your source IP with any destination;
- bandwidth usage tied to your identity beyond what is needed to enforce plan limits.
We cannot share what we do not hold. The data described below is the limited account, billing, and (optional) diagnostic data needed to operate the Service.
3. Personal data we collect
- Account data: email address, name (optional), username (optional), hashed password, email-verification status.
- Subscription & billing data: plan, subscription status, transaction and invoice records, wallet balance/ledger. Card details are processed by our payment providers — we do not store full card numbers.
- Device data: a device identifier, device name/model, OS version, app version, and push-notification token (for security alerts and account notices).
- Connection metadata (minimal): current session state and aggregate counts needed to enforce device/connection limits — not browsing activity.
- Diagnostics & crash reports (optional, consent-based): if you opt in, anonymised crash stack traces, device/OS info, and app performance data via Firebase Crashlytics. No browsing or personal content is included.
- Consent records: the consents you grant or withdraw, with timestamp, version, IP address, and user-agent, kept as a compliance audit trail.
- Support data: messages you send us.
4. Why we process your data & our legal basis
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Create and operate your account; provide the VPN Service | Performance of a contract — Art. 6(1)(b) |
| Process payments, subscriptions, invoices and refunds | Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) |
| Security, fraud prevention, enforcing usage/device limits | Legitimate interests — Art. 6(1)(f) |
| Crash reports & diagnostics to improve the app | Consent — Art. 6(1)(a) (opt-in) |
| Marketing emails (if applicable) | Consent — Art. 6(1)(a) (opt-in) |
| Comply with legal/regulatory obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on consent, you may withdraw it at any time (see section 8) without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights.
5. Crash reports & diagnostics
Crash and diagnostic collection is strictly opt-in and disabled by default. Nothing is collected until you actively consent at sign-up or in the app. You can turn it off at any time in Settings → Privacy → Share Diagnostics, which immediately stops collection. We use Google Firebase Crashlytics as our processor for this purpose.
6. Who we share data with (processors)
We do not sell your personal data. We share limited data with vetted processors who act on our instructions under data-processing agreements:
- Google Ireland/LLC (Firebase) — crash diagnostics (Crashlytics) and push notifications (FCM).
- Stripe, PayPal, NowPayments — payment processing (only when you choose that method).
- Our hosting and email providers — to run the Service and send transactional emails.
- Authorities — only where strictly required by law; note our no-logs policy in section 2.
7. International transfers
Some processors (e.g. Google, Stripe) may process data outside the UK, including in the United States. Where they do, transfers are protected by appropriate safeguards — UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) / Addendum to the EU Standard Contractual Clauses, or equivalent. You may request details of these safeguards via privacy@jaguarvpn.com.
8. Your rights
Under UK GDPR you have the right to:
- Access a copy of your personal data;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict or object to processing;
- Data portability — receive your data in a machine-readable format;
- Withdraw consent at any time;
- Not be subject to solely automated decisions with legal effects (we make none).
You can exercise most rights directly in the app: Settings → Privacy (Export My Data, Share Diagnostics) and Settings → Account Actions → Delete Account. Alternatively, email privacy@jaguarvpn.com. We respond within one month.
9. Data retention
- Account data: for as long as your account is active. On deletion, removed within 30 days (subject to a short grace/cancellation period).
- Billing/invoice records: retained up to 6–7 years to meet UK tax and accounting obligations.
- Consent records: retained for the period required to evidence compliance.
- Diagnostics: retained by Crashlytics per Google’s retention (typically up to 90 days).
10. Cookies (website)
Our website uses strictly necessary cookies to operate (e.g. sign-in/session). We only set non-essential/analytics cookies with your consent. You can manage preferences in your browser.
11. Security
We use encryption in transit (TLS), hashed passwords, signed API requests, and access controls. No method of transmission is 100% secure, but we maintain appropriate technical and organisational measures to protect your data and will notify you and the ICO of any breach as required by law.
12. Children
The Service is not directed at children under 16, and we do not knowingly collect their data.
13. Changes to this policy
We may update this policy. Material changes update the version above and, where required, we will ask you to re-confirm consent in the app. Continued use after changes constitutes acceptance of the updated policy where consent is not required.
14. Complaints
If you have concerns, contact us first at privacy@jaguarvpn.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk · helpline 0303 123 1113.