SanazNet Privacy Policy

1. Controller and contact

WIUNIX LTD (Company No. 17338992), 82a James Carter Road, Mildenhall, Bury St. Edmunds, United Kingdom, IP28 7DE, is the controller of SanazNet data. Privacy request.

2. Data we process

• Account data: name, username, email, phone, language, country of residence and verification status.
• Device and connection data: technical identifiers, platform, app and OS versions, public and tunnel IPs, approximate country derived locally from the public IP, time, node, usage and security events.
• KYC: national ID, date of birth, phone, residence, document images, consent, decision and review note. The national ID is encrypted and fingerprinted; operators see only the last four digits.
• Tickets, support messages, abuse reports, notifications and administrative audit events.
• Subscription data: order reference, provider, product, amount, currency, status, dates, cancellation and refund; not full card numbers.

For troubleshooting and reliability, our internal diagnostics record connection stage and outcome, bounded error codes, correlation IDs, API processing time and app version. Request evidence is retained for 14 days, client stage reports for 30 days and node health samples for 90 days, with periodic deletion. These diagnostics exclude passwords, tokens, request bodies, browsing destinations and VPN traffic contents, and are not sent to advertising networks.

3. Purposes and lawful bases

We process data to perform the contract, provide connectivity, secure the service, prevent fraud, verify email and identity, provide support, administer payment, comply with sanctions and legal duties, and pursue proportionate legitimate interests. We seek consent for advertising, optional technology or KYC where required.

4. Advertising and free access

Free Android access and the native iOS app may use Google AdMob rewarded ads. Google and partners may process advertising or device identifiers, IP, technical data, interactions and fraud signals according to your consent choices. Name, email and phone are not sent as the advertising identifier. The iPhone/iPad Home Screen web app may display a WIUNIX Ads sponsor message for Free access, with reward completion verified by the SanazNet server. VPN connection data is not used for advertising or advertising profiles.

Google Privacy Policy

5. Payments, sign-in and notifications

Web purchases, including purchases made from the iPhone/iPad Home Screen web app, are processed by PayPal, which may present Apple Pay as an eligible funding option. Purchases inside the native Android app are processed by Google Play and purchases inside the native iOS app and Mac App Store edition by the App Store. Google Pay or Apple Pay may be offered by the relevant provider depending on account, device and country; SanazNet does not control that choice. Each provider processes payment, tax, risk, fraud, sanctions, subscription and refund data under its own policy. Direct-download macOS and Linux editions use website checkout and PayPal.

Google, Apple or Microsoft sign-in, where enabled for a channel, is your choice: that provider’s sign-in page or tool authenticates you directly, then SanazNet receives only the identity assertion and account identifiers needed to sign you in. Your provider password is not sent to SanazNet’s server, and we do not send your VPN connection records to those providers for sign-in. The native iOS app uses Firebase Messaging for notification capability; Google may process a push token and device technical data. The Home Screen web app currently uses the in-account notification center and does not enable system Web Push. SanazNet does not send VPN traffic contents or connection records to sign-in or notification providers as part of these features.

PayPal Privacy · Google Privacy · Microsoft Privacy · Apple Privacy

6. VPN privacy commitment and sharing

SanazNet does not sell VPN user data. We do not use the contents of VPN traffic or browsing destinations for advertising, behavioral analytics or profiling, or disclose them to third parties for those purposes. The connection metadata listed in section 2 is processed only to provide and secure the connection, account for usage, prevent abuse, support users and meet legal obligations. We do not authorize sign-in, notification or advertising providers to use VPN connection records for their own purposes.

Necessary account and service data, such as authentication details, a push token, purchase receipts, support email and identity documents when provided, may be processed by the relevant providers as described above and according to your choices. Infrastructure, email and storage providers process necessary data to deliver services for SanazNet. Data may be provided to a competent authority in response to a valid legal obligation. We use appropriate legal mechanisms for international transfers. These flows do not authorize the sale or sharing of VPN connection data for independent third-party use.

Optional app analytics and crash reporting

From version 1.14.45, Android and iOS offer separate choices for limited usage analytics and crash reporting. Both default off and can be changed in Settings. With your consent, Google Firebase processes technical device/version information, SDK-generated installation identifiers, limited usage events and error reports. Dart reports omit raw exception messages, passwords and tokens; native crash reports may include technical exception and system metadata. We do not attach VPN traffic content, browsing destinations, VPN profiles or account identifiers. This processing improves application reliability and usability, not advertising targeting. On Windows, macOS and Linux, optional reporting sends only Flutter error codes to SanazNet while signed in and does not capture native process crashes. Declining or withdrawing consent does not restrict access. Firebase and Google Analytics retention follows those services settings and rules independently of the internal retention described above. This desktop path does not provide Firebase Analytics, native crash capture, pre-login error capture or automatic offline crash delivery. Internal error reports follow the 30-day client-stage retention period. Turning a choice off stops its future optional sends; it does not automatically erase reports already sent. Use the privacy-request or account-deletion process to request erasure.

7. Retention schedule and security

• After account deletion, access, passwords, tokens and direct identifiers are erased or made unusable in the operational system, and KYC document files are deleted. Where necessary for a legal obligation or the establishment, exercise or defence of legal claims, minimal identity and KYC verification evidence is encrypted, access-restricted and audited only until the final legal deadline. Sign in with Apple authorization is revoked when a revocable credential exists and the stored credential is erased; a missing legacy credential does not prevent the customer from registering again.
• Necessary support, security and connection records are retained for up to 730 days and are then automatically purged.
• Minimal payment and accounting records are normally retained for 6 years after the relevant financial year; a tax enquiry, legal claim or lawful order may extend that period.
• Rotating backups expire within 90 days, are removed from operational use and are retained only for disaster recovery.

We do not retain data indefinitely merely in case it may be useful. A legal hold applies only to the data and period necessary and is protected by access controls and audit logging.

8. Your rights and account deletion

Depending on the law in your eligible residence, you may have rights of access, correction, erasure, restriction, objection, portability, consent withdrawal and complaint to a data protection authority. A password user can sign in and delete the account immediately. If you cannot access the account, submit a request through the contact form under Privacy and account data; after ownership verification, an erasure request is normally answered within one month. Erasure is not absolute, and data necessary for a legal obligation or the establishment, exercise or defence of legal claims may be retained temporarily.

Delete account or submit a request

9. Cookies and changes

Cookie Policy · Privacy request