1. Data we process

We process only the data we need to run the service:

Account data: your email address, a hashed password, email-verification status, preferred language, and — if you enable two-factor authentication — an encrypted 2FA secret and recovery codes.
Device data: device identifiers (a hardware ID and its hash), device name, operating system and version, device model, and last-seen time. We use these to enforce your plan's device limit and to keep your account secure.
Subscription & VPN data: your plan, device limit, subscription expiry and the internal VPN account identifiers needed to deliver the service.
Traffic volume: the aggregate amount of data your account uses, as a byte count, so we can apply plan limits.
Payment data: the order amount (in RUB), the payment method type (card, SBP or crypto), the provider's order ID and status, and the technical response from the payment provider. Payments are processed by third-party payment and banking partners selected by Clementine from time to time; we do not receive or store your full card number or wallet credentials.
Support communications: the content of messages you send to support (by email or in-app), your name and email as provided, any attachments, and related metadata.
Technical logs: short-lived operational server logs that may contain technical data such as IP address, request time and the endpoint accessed, used for security, abuse prevention and debugging. Passwords, tokens and authorization headers are redacted from logs.

2. What we do NOT log (your VPN activity)

We do not log or store your browsing history, the websites or services you connect to, your DNS queries, the contents of your traffic, or any record linking your real IP address to your online activity. The VPN exists to carry your traffic, not to record it.

3. Why we process data

to create and secure your account and to authenticate you;
to deliver the VPN, enforce device and plan limits, and manage your subscription;
to process payments and keep the payment records required for accounting;
to provide support and respond to your requests;
to prevent fraud, abuse and attacks and to keep the service reliable;
to comply with legal obligations.

4. Sharing

We do not sell your data. We share data only with the parties needed to run the service: payment providers (to process payments), infrastructure, hosting and VPN-node providers (to operate the service), push-notification services (Firebase Cloud Messaging, for Android notifications), and the email provider used for verification and support.

5. International transfers

Our servers and VPN nodes are located in several countries (for example, the Netherlands). Using the service may involve transferring data across borders.

6. Retention & deletion

We keep account, device and subscription data while your account is active. Payment records may be kept longer where required for accounting, security or dispute resolution. Operational technical logs are kept only for a short period. To ask about your data or request deletion of the technical data tied to your account, contact support@clementinevpn.com.

7. Security

We protect data with encryption in transit, hashed passwords, encrypted 2FA secrets, access controls and rate limiting. No system is perfectly secure, but we work to keep your data safe.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct or delete your personal data, or to object to or restrict certain processing. To exercise these rights, contact support@clementinevpn.com.

9. Changes to this Policy

We may update this Policy. We will change the "last updated" date and, for material changes, notify you in the app or by email. Continuing to use the service means you accept the updated Policy.

10. Contact

Questions about this Policy or your data: support@clementinevpn.com.

Privacy Policy