Privacy Policy

A VPN is a trust product. This policy says exactly what we collect, what we never collect, and what happens to your data. It is written to be read, not skimmed past.

The short version

• We do not log what you do online. Not your browsing, not your DNS queries, not your traffic.
• We keep the minimum needed to run your account: your email and your subscription state.
• Your WireGuard private key is generated on your device and never leaves it. We only ever see the public key.
• We do not sell, rent, share, or disclose your data to third parties for any purpose. The only companies that ever touch it are the processors listed below, acting on our instructions to deliver the service.

Who we are

SecuremeVPN is operated by VISATECH S.R.L. ("we", "us"), a company incorporated in Italy, which is the data controller for the personal data described here.

VISATECH S.R.L.
Registered office: Via del Lauro 9, 20121 Milan (MI), Italy
Company Registration No. (Milan Companies Register): MI-2631753
VAT No.: IT 11929140967
support@securemevpn.com

What we collect

Account data

• Email address. Used to sign you in with one-time codes, deliver any redeem codes we issue you, and send service emails such as trial and renewal notices.
• Sign in with Apple or Google identifiers. If you use social sign-in we store the provider's stable account identifier so we can recognize you next time. Apple may give us a private relay email instead of your real one; that is fine with us.
• Subscription state. Which plan you are on, whether it is active, when it renews or expires, and who billed it. This comes from Apple, Google, or, for purchases made on our website, from our payment service provider.
• Device records. A name, platform, and app version for each signed-in device, so you can see and remove your devices and so we can enforce the 5 device limit.
• Push notification token. If you allow notifications, the app stores a push token with your device record so we can tell you when your subscription starts, renews, or ends. The token is removed when you sign out or remove the device.

Operational data

• Live session records. While a tunnel is connected, our API holds the session needed to keep it running: the device's WireGuard public key, the private tunnel address it was assigned, the server it is on, when the session started, and the time of the last handshake (used only to expire dead sessions). When you disconnect, or the session goes stale, the record is deleted within one hour. We do not keep a history of your connections.
• Aggregate bandwidth counters per server. Each VPN server reports totals so we can plan capacity and keep servers fast. These are counters per server node, never per user.
• WireGuard public keys. When a device connects, it registers its public key so the server will accept the tunnel. The matching private key is created on your device and never transmitted anywhere.
• Support messages. If you contact us, we keep the message and our reply so we can actually help you.
• API and website access logs. Like every web service, our API and website servers keep short-lived technical logs (IP address, time, endpoint, response code) for security, rate limiting, and abuse prevention. These are the servers you sign in and manage your account through, not the VPN servers, and they are rotated within 30 days.

What we never collect

• Browsing history or the content of your traffic.
• DNS queries.
• A history of your connections. Live sessions exist only while you are connected and are deleted afterwards.
• Your source IP address on VPN servers. VPN servers do not write connection or activity logs.
• Bandwidth usage tied to an individual user.

Our VPN servers are configured without user-level activity logging. If a server is seized or compromised, there is no history of who connected where, because that history is never written.

Third parties

We do not sell, use, or disclose any of your data to third parties for any purpose other than delivering the service to you. We never share VPN usage data with anyone, because we do not have it. The only companies that process personal data on our behalf are:

• Apple, Google, and our payment service provider for payments, as described below.
• Adapty, which manages App Store and Google Play subscriptions for us. It receives an anonymous account identifier, your purchase state, and subscription events such as a paywall being viewed or a plan being bought, which we use to understand our own sales; it does not receive your email or any VPN data, and we have disabled its collection of advertising identifiers (IDFA and Google Advertising ID) and of your IP address.
• Amazon Web Services, which delivers our service emails.
• PostHog, which measures how visitors move through our purchase pages on get.securemevpn.com: the pages viewed, steps such as starting checkout or confirming an email address, and whether the purchase completed, so that we can find and fix the places where checkout fails. It receives your IP address and your browser and device type, as any website does, and an identifier for the page visit. It runs without cookies or local storage: that identifier lives only in the open page and is gone when you close or reload it. PostHog does not receive your email address, your card details, or any VPN data. It processes this data in the United States.
• Google Firebase Cloud Messaging and Apple Push Notification service, which relay push notifications to your device. They receive the device's push token and the notification itself, a short subscription status message, and nothing else.
• Hosting providers that run our API and VPN servers. They provide the machines; they do not have access to your account data or traffic.

We do not use advertising SDKs, cross-app tracking, or the advertising identifier, and we never sell your data or use it to advertise other companies' products. Two things come close enough that we want to spell them out: the subscription events Adapty records for us, described above, and Apple Search Ads attribution when we advertise on the App Store, where Apple tells us (through Adapty, using Apple's own AdServices framework rather than the advertising identifier) which of our own ads led to a download so we can measure them. Neither involves your browsing, traffic, or VPN use, and neither is shared with anyone else.

Legal requests

If we receive a lawful request for user data, we can only provide what we hold: the account data listed above. We have no connection logs, browsing data, or traffic to hand over, and we will contest overbroad requests where the law allows.

Payment processors

We never see or store your full card number. Payments are handled by:

• Apple App Store for purchases made on iPhone, iPad, and Mac App Store builds.
• Google Play for purchases made on Android.
• PayPoye, our payment service provider, for purchases made on our website. You enter your card details on the provider's secure checkout, which is certified to the PCI DSS standard. We receive the outcome of the payment, the plan, the amount, the email you gave at checkout, and a masked card reference (the last four digits and card type) so we can find the payment if you ask about it.

Each processor has its own privacy policy that applies to the payment itself. Billing records for website purchases are kept for as long as Italian tax and accounting law requires, which is ten years.

Cookies and similar technologies

Our website uses very few cookies, and none of them relate to your VPN traffic. When you first visit we show a banner where you can accept or reject the non-essential ones; rejecting is one click and has no effect on the service. You can change your mind at any time from the Cookie settings link in the footer of every page.

Name	Type	Purpose	Duration
smv_consent	Strictly necessary (first party)	Remembers whether you accepted or rejected non-essential cookies, so we do not ask again.	180 days
smv_params, smv_click_id (plus a localStorage mirror)	Marketing and attribution (first party), only with your consent	Records the campaign parameters and click identifier of the advertisement that brought you to the site, so that if you later install the app we can tell which of our own ads worked. We do not share this with anyone.	90 days
_fbp, _fbc	Marketing (Meta), only with your consent and only on pages where the pixel is enabled	Meta Pixel identifiers used to measure our advertising on Facebook and Instagram. Governed by Meta's privacy policy.	90 days
_ttp	Marketing (TikTok), only with your consent and only on pages where the pixel is enabled	TikTok Pixel identifier used to measure our advertising on TikTok. Governed by TikTok's privacy policy.	13 months

The manage page keeps your sign-in token in memory only; it is gone when you close the tab and never written to a cookie. We do not use analytics cookies, and there is no advertising SDK or tracking inside the apps. Our purchase pages on get.securemevpn.com measure checkout with PostHog without setting any cookie or using local storage, as described under Third parties.

Email

Service emails, such as sign-in codes and receipts, are delivered through Amazon Simple Email Service. We send transactional email only. We do not send marketing email unless you have explicitly opted in, and every non-essential email includes a working way out.

Data retention

• Account data is kept while your account exists.
• If you delete your account, in the app under Settings, your account is deactivated immediately: all devices and sessions are removed and, if you signed in with Apple, we revoke the Sign in with Apple token. Signing in again within 30 days restores the account; after 30 days your email, sign-in identifiers, and device records are permanently erased and any remaining billing records are anonymized.
• Live VPN session records are deleted within one hour of the session ending.
• One-time sign-in codes expire within 10 minutes and are stored only as hashes.
• Technical access logs for the API and website are rotated within 30 days.
• Aggregate server counters contain no personal data and may be kept for capacity planning.

Why we are allowed to process this data

If you are in the EEA or the UK, the GDPR requires us to name a legal basis for each purpose. Ours are:

• Performance of a contract. Your email, sign-in identifiers, subscription state, device records, live session records, and WireGuard public keys. Without these we cannot give you an account or a working tunnel.
• Legitimate interests. Short-lived API and website access logs, aggregate per-server bandwidth counters, cookieless measurement of our purchase pages, and acting on credible abuse reports. Our interest is keeping the service secure, available, and fast; we have balanced it against your privacy by keeping these records minimal, aggregated where possible, and short-lived.
• Consent. Marketing email, which we send only if you opt in and which you can withdraw at any time. Withdrawing consent does not affect processing that already happened.
• Legal obligation. Retaining billing and tax records, and responding to lawful requests, where the law requires it of us.

Where your data is processed

We are based in Italy, in the European Union. Our processors and VPN servers are located in several countries, so some of your personal data is transferred internationally. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), or on an adequacy decision where one covers the destination, and we require each processor to apply security measures appropriate to the data. You can ask us for details of the safeguards used for a specific transfer.

Your rights

Wherever you live, we extend the same rights to you: access, correction, export, and deletion of your personal data, and objection to processing. If you are in the EEA or UK these are your GDPR rights, which also include the right to restrict processing and the right to data portability; in California, your CCPA rights, including the right not to be discriminated against for exercising them; in India, your rights under the Digital Personal Data Protection Act, 2023. To exercise any of them, use the contact page or email support@securemevpn.com from your account email. We respond within 30 days, and we do not charge for this.

We would rather hear from you first, but you always have the right to complain to a regulator. In the EEA that is the data protection supervisory authority of the country you live or work in; our lead authority in Italy is the Garante per la protezione dei dati personali (garanteprivacy.it); in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India.

Children

SecuremeVPN is not directed at children under 16 and we do not knowingly collect data from them.

Changes to this policy

If we change this policy in a way that matters, we will notify you by email or in the app before the change takes effect. The effective date below always reflects the current version.

Contact

Privacy questions go to support@securemevpn.com or the contact page.

Data controller: VISATECH S.R.L.
Registered office: Via del Lauro 9, 20121 Milan (MI), Italy
Company Registration No. (Milan Companies Register): MI-2631753
VAT No.: IT 11929140967
support@securemevpn.com