Privacy Policy

Account data: email address; password hash; when signing in with Google — the Google account ID, email address, name and profile picture; account settings (currency, notifications, auto-renewal); two-factor authentication data in encrypted form.

Orders and services: Orders, their parameters and statuses; delivered Proxies and Connection details; Periods, renewals and replacements; purchased and used traffic volume; Proxy check results.

Payments: amount, currency, method, status and time of payment, the payment service’s transaction ID; for cryptocurrency — network, sender address and transaction hash; for cards and SBP — masked card number or sender’s bank, if the payment service provides them. Full card details are processed by payment services — we don’t receive or store them.

Proxy connection metadata: the IP address you connect from; session start and end times; volume of transferred data; the Proxy used and the exit IP address; where available, the Target resource’s address and port. This data is recorded by the Operator’s and Providers’ infrastructure.

Technical data of the Site and dashboard: IP address, browser and device type, language, time zone, referrer; sign-in log (time, IP address, method, result); security events, including failed sign-in and recovery attempts.

Connected services: which third-party services, such as TradeOn Ultra, have access to your Account and when access was granted and revoked; a log of their requests (time, IP address, method, result).

Requests: correspondence with Support and attachments, information about Complaints and their outcomes; when Telegram is connected — ID, username and chat ID.

Verification data: if we request confirmation of identity or of a payment method (clause 4.6 of the Agreement) — the documents and information you provide.

We don’t collect special categories of data (health, race, political and religious views, etc.) or biometric data. Please don’t include such data in your requests.

We process data to:

• register the Account, enable sign-in and its management;
• place, pay for and fulfil Orders: deliver, renew and replace Proxies, meter traffic;
• make settlements and refunds, keep accounting and tax records;
• send service notifications by email, in the Dashboard and in Telegram — without Proxy passwords;
• respond to requests and review claims;
• protect the Service from hacking, password guessing, fraud, discount abuse and unjustified payment disputes;
• review Complaints, prevent and investigate prohibited use of Proxies;
• comply with legal requirements and lawful requests from government authorities;
• protect the rights of the Operator, Providers and third parties, including in court;
• analyze and improve the Service based on aggregated data;
• send marketing emails — only with your consent.

We don’t use data for purposes incompatible with those listed without your consent or another legal basis.

Performance of a contract — processing necessary to provide the Service under the Agreement: the Account, Orders, payments, Proxy delivery, support. Without this data the Services can’t be provided.

Legal obligations — accounting and taxes, anti-money laundering, responding to lawful requests from government authorities.

Legitimate interests — Service security, preventing fraud and abuse, reviewing Complaints, protecting rights in disputes, improving the Service. We balance these interests against your rights and don’t use data in ways you couldn’t reasonably expect.

Consent — marketing emails, optional cookies and other cases where the law requires consent. You can withdraw consent at any time; this doesn’t affect the lawfulness of processing before withdrawal.

We share data, to the extent necessary for a specific purpose, with the following recipients:

• proxy infrastructure Providers — parameters of Orders and delivered Proxies; Providers process connection metadata on their infrastructure under their own rules;
• payment services, banks and crypto processing — payment data to process, verify and refund payments;
• contractors for hosting, infrastructure, email delivery and error monitoring — to run the Service;
• Google and Telegram — when signing in with Google and connecting the Telegram bot;
• TradeOn ecosystem services and other third-party services — on your instructions when you grant them access to your Account;
• the Operator’s affiliates — for support, security and accounting;
• professional advisers — lawyers, auditors, tax advisers bound by confidentiality obligations;
• government authorities — on lawful requests (section 6);
• successors — in a reorganization, sale of the business or assets, with data protection preserved.

With recipients that process data on our behalf, we sign confidentiality and data protection agreements. A list of recipient categories and their countries is available on request.

We disclose data to government authorities only on requests made in accordance with applicable law; we check the lawfulness of each request and provide the minimum necessary data.

We may disclose data without a request if necessary to prevent a threat to people’s life and health, the distribution of child sexual abuse material or terrorist activity.

We may not notify you of a request or disclosure if notification is prohibited by law or could hinder an investigation.

Data may be processed outside your country of residence: in the Kyrgyz Republic, where the Operator is registered; in the European Economic Area and the US, where our contractors’ infrastructure and services are located; in the countries of the Providers and of the Proxies you choose.

When transferring data, we use mechanisms provided by applicable law, including recipients’ contractual data protection obligations and the European Commission’s standard contractual clauses where GDPR applies.

By using a Proxy in a chosen country, you understand that your traffic passes through infrastructure in that country and is subject to its laws.

We keep data no longer than necessary for the purposes of processing and to meet legal requirements:

Periods may be extended for the duration of a Complaint review, dispute, investigation or audit and until the limitation period expires, or if the law requires it.

We may keep data of Accounts blocked for breaching the Agreement for up to 5 years to prevent repeat registration and abuse.

When periods expire, data is deleted or anonymized so that it can’t be linked to you. Anonymized data may be used for statistics indefinitely.

We apply technical and organizational safeguards proportionate to the risks:

• TLS encryption of connections to the Site and API;
• storing Account passwords only as hashes, and Proxy passwords and secrets in encrypted form;
• keeping passwords, access tokens and Connection details out of logs;
• notifications without Proxy passwords;
• limiting sign-in and recovery attempts;
• least-privilege employee access and two-factor authentication in work systems;
• encrypted backups and security event monitoring.

In an incident affecting personal data, we take measures to resolve it and notify supervisory authorities and affected users in the manner and within the time limits set by applicable law.

You are responsible for keeping your passwords, email access and Connection details safe. The Operator’s employees never ask for your Account password.

To the extent provided by applicable law, you may:

• obtain confirmation of processing and a copy of your data;
• request correction of inaccurate data;
• request deletion of data if the grounds for processing no longer apply;
• request restriction of processing;
• receive your data in a structured, machine-readable format;
• object to processing based on legitimate interests and to marketing emails;
• withdraw consent;
• request human review of an automated decision that significantly affects you;
• lodge a complaint with a supervisory authority.

Send requests to privacy@ultraproxy.io from your Account email address. We may ask for additional information to confirm your identity. We reply within 30 days; in complex cases the period may be extended as permitted by law, with notice.

We may refuse a request in whole or in part or charge a reasonable fee if the data must be kept by law or for reviewing a Complaint, dispute or investigation, or if the request is clearly unfounded or excessive.

Account deletion is done on request through Support. Active Services end, and data is deleted or anonymized, except data we must or may keep under section 8.

You can unsubscribe from marketing emails via the link in the email or in Dashboard settings. Service notifications arrive as long as you have an Account.

The Site uses cookies and the browser’s local storage (localStorage) to enable Account sign-in, protect against request forgery, remember settings and save an order until payment.

Analytics cookies, if we use them, collect aggregated statistics and are set with your consent where the law requires it. We don’t use advertising cookies, retargeting pixels or cross-site tracking.

You can delete cookies and localStorage data in your browser settings. Without essential cookies, Account sign-in isn’t possible.

To protect the Service, we use automated rules: we temporarily restrict sign-in after several failed attempts, detect signs of fraud and abuse, and restrict suspicious payments and operations.

Such decisions may temporarily restrict access to certain features. You can request a review by an employee through Support.

The Service is not intended for persons under 18, and we don’t knowingly collect their data.

If we learn that an Account belongs to a minor, we will block it and delete the data, except data required by law. Parents and legal guardians can report this to privacy@ultraproxy.io.

We may change the Policy. The current version is published on the Site with its number and date.

We notify of material changes — new purposes, data categories or recipients — by email or in the Dashboard at least 14 days before they take effect. Other changes take effect upon publication.

If a change requires your consent, we will ask for it separately. Continued use of the Service after changes take effect means you have read the new version.