Nuvotik VPN Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains what personal data Value Brands FZE LLC ("we", "us") processes when you use the Nuvotik VPN apps for iOS and Android, the Nuvotik VPN service and the website at nuvotik.com (together, the "Service"), why we process it, how long we keep it and what choices you have.

We have tried to write this policy precisely. A VPN provider handles sensitive network traffic, so we describe not only what we keep but also what passes through our systems without being kept, and what a VPN cannot protect you from.

1. Who we are

The controller responsible for your personal data is:

Value Brands FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates

Licence No. 4426291.01, issued by Sharjah Publishing City Free Zone.

Contact for privacy questions and requests: support@nuvotik.com

2. Summary

• We do not record the websites you visit, your DNS queries, the content of your traffic, or the destination addresses of your connections.
• Our VPN servers do not record or export your real (source) IP address. While you are connected, WireGuard necessarily holds your current network address in the server's memory so it can send traffic back to you; it is not written to disk or sent to us.
• We do keep the data needed to run an account-based subscription service: your account details, your devices, your subscription status, short-lived VPN session records (deleted after 30 days) and security logs that store a keyed hash of the IP address instead of the address itself (deleted after 1 year). That hash is pseudonymous, not anonymous: we hold the key and can check whether it matches a known IP address (see 4.6).
• Payments are handled entirely by Apple (App Store) or Google (Google Play). We never receive your card details.
• The apps include the Google Mobile Ads SDK (AdMob). Subscribers never see ads. If you use the app without a paid subscription, it may show non-personalized ads from Google when we turn advertising on. Advertising is currently turned off, so no ads are shown at the moment (see section 7). We give the ad provider nothing about your account, VPN connections, servers or traffic, we do not track you across other companies' apps or websites, and we do not sell your personal data.
• You can delete your account in the app at any time (Account (the person icon at the top of the home screen) → Delete account) or by email. See our Account Deletion page.

3. What we do not collect

We do not collect, log or store:

• your browsing history or the URLs you visit;
• your DNS queries. Each VPN server runs its own DNS resolver configured with query logging and reply logging disabled;
• the content (payload) of your traffic;
• the destination IP addresses, domains or ports of your connections;
• your real (source) IP address on our VPN servers. The software that reports from our VPN servers to our control systems never exports WireGuard endpoint addresses, and the servers' firewall rules have logging disabled;
• your location. We do not run GeoIP lookups on your IP address. Server recommendations are based on connection latencies that your device measures itself and, optionally, a country code that the app supplies with the request; that country code is used only to compute the recommendation and is not stored;
• your contacts, photos, files, health or fitness data;
• payment card or bank details.

Section 9 explains the limited data that exists only temporarily in the memory of a VPN server while you are connected.

4. Data we collect and why

4.1 Account data

• Email address — to create and identify your account, to sign you in, to send verification codes, password-reset codes and service messages (for example, about security or your account). Required.
• Name — optional. You may provide it, or Apple may provide it when you use Sign in with Apple and choose to share it.
• Language preference (locale) — to show the app and messages in your language.
• Password — if you register with an email and password, we store only a salted hash generated with the argon2id algorithm. We cannot see your password.
• Sign in with Apple or Google identifier — if you sign in with Apple or Google, we store the stable account identifier that Apple or Google provides for our app, so that we can recognise you next time. Apple and Google process your sign-in under their own privacy policies.
• Account status and timestamps — for example, when the account was created, when your email was verified and when you last signed in.
• Store account tokens — a random identifier that we give Apple with your purchases, and a one-way hash of your account identifier that we give Google, so that a subscription can be matched to your account without sharing your email with the store.

Verification and password-reset codes are stored only as hashes and expire shortly after they are issued.

4.2 Devices and sign-in sessions

When you sign in on a device, the app sends a device descriptor, which we store to show you your devices, enforce your plan's device limit, and let you revoke a lost device:

• platform (iOS or Android), device model, device name, operating-system version and app version;
• an installation identifier generated by the app (it is not a hardware identifier or an advertising identifier);
• a push notification token issued by your device's platform notification service, only if you allow notifications (currently the iOS app only; the Android app does not register for push notifications);
• the time the device was last active and, if applicable, when it was revoked.

The device name is the name reported by your operating system or the name you give the device in the app. You can rename a device in the app at any time.

For each sign-in session (in the app or on the website) we store when it was created and last used, whether and why it was revoked, and a keyed hash of the IP address it was created from (see 4.6). Sign-in tokens are stored only as hashes. A session record is deleted 30 days after it is revoked or expires.

4.3 VPN connection data

To provide the VPN we process:

• WireGuard public key for each of your devices. The matching private key is generated on your device and never leaves it; we never receive it.
• Preshared key for each VPN peer, generated by us to add an extra layer of protection. It is stored encrypted at rest with AES-256-GCM.
• Internal tunnel IP address assigned to each peer, a private address in the 10.x.x.x range used only inside our network. It is not your real IP address.
• Aggregate traffic counters and last handshake time for each peer: the total number of bytes sent and received through that peer and the time of the most recent WireGuard handshake. These are totals; they say nothing about where the traffic went.
• VPN session records: when a connection started and ended, which server and which of your devices was used, and why the session ended (for example, you disconnected or switched server). Session records contain no IP addresses and no traffic destinations. They are deleted 30 days after the session ends (and immediately if you delete your account).
• Favourite servers that you mark in the app.

We use this data to establish and maintain your connection, to show you your connection status and devices, to enforce your plan's device and server limits, and to keep the service secure and working.

4.4 Subscription and payment data

Subscriptions are purchased through the Apple App Store or Google Play. Apple or Google processes your payment; we never receive your card details or billing address. We receive and store:

• the store used, the plan, the subscription status (for example active, in grace period, expired or refunded), whether it will auto-renew, and the current period and grace-period end dates;
• the transaction identifiers that Apple or Google assigns to your purchases;
• for Google Play purchases, a one-way hash of the purchase token (never the token itself);
• payment transaction records (product, transaction identifier, purchase date, price and currency where the store provides them, and any refund or revocation date), which we must keep for tax and accounting purposes;
• notifications that Apple and Google send us about changes to your subscription. We keep only a summary of each notification that contains no personal contact details and no tokens.

4.5 Notifications

We store in-app notifications addressed to your account (for example, about your subscription or a revoked device) and whether you have read them. If you allow push notifications, we use the push token described in 4.2 to deliver them; you can turn them off in your device settings at any time.

4.6 Security and audit logs

We keep audit logs of security-relevant actions — for example sign-ins, failed sign-in attempts, password changes, device revocations, account deletion and actions taken by our staff. Each entry records what happened, when, the account or system that performed it, the outcome, and a keyed hash of the IP address involved.

We never store your IP address in raw form. The hash is computed with HMAC-SHA256 using a secret key held only by us, and is truncated. It lets us recognise repeated requests from the same address for abuse prevention and rate limiting. Someone without the key cannot turn the hash back into an IP address. The hash is pseudonymous, not anonymous: because we hold the key, we can compute the hash of a given IP address and check whether it appears in our logs, and because the number of possible IPv4 addresses is limited, a party holding both the key and the logs could recover the address. Entries for sign-ins and other account actions are linked to the account that performed them, so for up to 1 year these logs can show that an account was used from a particular IP address. Audit logs are deleted 1 year after each entry is created, including after account deletion.

Our application logs do not contain IP addresses and automatically redact authorization headers, cookies, passwords, tokens, keys, purchase data and VPN configuration. Warning and error entries can contain internal identifiers (for example an account, device or subscription ID). These logs are kept in size-limited files that are overwritten as new entries are written. The operating-system logs of our servers, which contain no user IP addresses or traffic data, are deleted after at most 4 weeks.

4.7 Support communications

If you contact us by email, we process your email address, the content of your message and our replies in order to help you. We keep this correspondence only as long as needed to resolve your request and to handle any follow-up, unless the law requires us to keep it longer.

4.8 Our website and web account area

The information pages on nuvotik.com that host this policy do not use cookies, advertising or third-party tracking scripts. As with any website, our web server receives your IP address in order to deliver the page; we do not use it to identify you and we do not store it in raw form.

Website statistics (optional). With your permission, nuvotik.com measures how its pages are used: pages viewed, the site that referred you, buttons clicked, approximate time on page, device type, browser and operating system. We do not use cookies for this and do not store your IP address: our server turns it, together with your browser's user agent, into a code that changes every day and cannot identify you or link visits on different days. Statistics are kept for 90 days and are never linked to your Nuvotik account or to your VPN use. With your permission we also use Google Analytics (Google Ireland Ltd / Google LLC) in the account area at nuvotik.com/vpn, which sets cookies and processes your IP address; advertising features and Google signals are off and data is kept for 2 months. With separate permission, Microsoft Clarity (Microsoft Corporation) records how you scroll and click on our public VPN landing page (never on sign-in or account pages; text and form fields are masked). You can change these choices at any time through "Privacy choices" at the bottom of each page. Your browser's Global Privacy Control or Do Not Track signal is treated as a refusal.

Apart from the optional Google Analytics and Microsoft Clarity cookies described above, the account area at nuvotik.com/vpn, where you can sign in with your Nuvotik account in a browser, uses only strictly necessary cookies, and only after you sign in:

• nv_web — an httpOnly session cookie that keeps you signed in. It holds a random token (we store only its hash), is sent only to our sign-in endpoints, is replaced each time it is used, and expires after a period of inactivity (12 hours by default) and in any case at the end of the session (7 days by default) or when you sign out.
• nv_web_csrf — a security token that protects your session against cross-site request forgery. It is readable by our page and expires with the session cookie.

These cookies are not used for analytics or advertising and are not shared with anyone. The account area also stores your language and theme choice, and our pages store your privacy choices, in your browser's local storage; this never leaves your device. Web sign-ins are recorded in the security logs described in 4.6 like sign-ins in the app.

Sign in with Google on the website. The sign-in page at nuvotik.com/vpn offers "Continue with Google". Nothing is loaded from Google until you click that button. When you do, the page loads Google's sign-in service from accounts.google.com, which may set its own cookies and processes your sign-in under Google's privacy policy (https://policies.google.com/privacy). Google then gives us the same account identifier, email address and name as when you sign in with Google in the app.

4.9 Server performance data

Each VPN server reports aggregate operational metrics — such as CPU, memory and disk usage, total bandwidth and the number of active peers. These figures describe the server as a whole and are not linked to any user. Per-minute samples are deleted after 30 days.

4.10 Help assistant on our website

If the help assistant on nuvotik.com/vpn is available and you use it, the question you type is sent to our servers to find a matching answer in our approved help content (and, for questions about prices, ads or free access, the current service settings). Answers are never written by AI: every answer is text from our approved help content.

Optional topic recognition by an AI service provider. When our own matching cannot recognise a question, we can use an AI language model, Cloudflare Workers AI (provided by Cloudflare, Inc.), only to recognise which topic of our approved help content the question is about. In that case the text of your question (at most 300 characters) and the list of our help topics are sent from our servers to Cloudflare. Nothing else is sent: not your account, your IP address, your VPN or browsing data, or your earlier messages, and a question that appears to contain a password, payment card number, email address or access token is never sent. The model can only choose one of our help topics or none; our own checks then decide whether to show that topic's approved answer. Cloudflare acts as our service provider and states that it does not use this content to train AI models. This topic recognition is turned on. We can turn it off at any time; questions our own matching recognises are never sent to Cloudflare.

Your question and the answer are not stored by us, are not written to our logs, are not linked to your Nuvotik account and are not kept as a conversation history: the conversation exists only in your browser tab until you close or reload it. To prevent abuse, we count requests per IP address for up to one minute using the keyed hash described in 4.6 (a counter only), and we keep daily totals of how many questions were answered or declined and in which language for 40 days; these totals contain no question or answer text and nothing that identifies you. On the public VPN page the assistant window is excluded from Microsoft Clarity recordings. The assistant cannot access your account; please do not include passwords, payment details or other personal information in your question.

5. How long we keep data

Deleted data can remain in our database backups until those backups are deleted, which happens automatically 14 days after each backup is made. Backups are stored on our own servers with restricted access; we do not currently keep copies with another provider. If we add encrypted off-site copies, we will state their retention period here. Backup copies are used only to restore the Service after a failure and for no other purpose.

6. Purposes and legal bases

We use personal data only for the purposes described in this policy:

• To provide the Service — creating your account, signing you in, connecting you to VPN servers, managing devices and subscriptions. Legal basis where applicable (for example, under the EU/UK GDPR): performance of our contract with you.
• To keep the Service secure — preventing fraud, abuse and unauthorised access, enforcing device limits and investigating security incidents. Legal basis: our legitimate interest in operating a secure service, and in some cases legal obligations.
• To communicate with you — verification codes, password resets, security notices, subscription updates and support replies. Legal basis: performance of our contract, and our legitimate interests.
• To meet legal obligations — for example, keeping payment records for tax and accounting. Legal basis: legal obligation.
• To fund the free use of the app with ads (only when advertising is turned on, and only for users without a paid subscription) — see "Advertising" in section 7. Legal basis: our legitimate interest in funding the Service, and your consent where the law requires it (for example in the EEA, the UK and Switzerland).

We do not use your account or VPN data for advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. (Automated checks such as whether your subscription is active, or whether a sign-in attempt should be rate-limited, apply the rules of the Service rather than profile you.)

7. Who we share data with

We do not sell your personal data, and we do not share your account or VPN data for advertising. We disclose personal data only to:

• Our infrastructure and hosting providers, which host our control-plane servers, databases and VPN servers on our behalf under contractual confidentiality and security obligations.
• Our email delivery provider, which receives your email address and the content of service emails (such as verification codes) in order to deliver them.
• Apple and Google, to the extent needed to verify purchases, receive subscription updates, verify Sign in with Apple or Google sign-in, and deliver push notifications.
• Google (AdMob), only for users without a paid subscription and only while advertising is turned on: see "Advertising" below.
• Cloudflare (Workers AI), only while AI topic recognition in the website help assistant is turned on: the text of a question the assistant could not match, and our list of help topics, as described in section 4.10. This is currently turned on.
• Authorities, courts or other parties where we are legally required to disclose information (see section 8), or where disclosure is necessary to protect the rights, property or safety of our users, the public or us, in accordance with applicable law.
• A successor organisation, if our business or the Service is transferred as part of a merger, acquisition or sale of assets. The successor would remain bound by commitments at least as protective as this policy for the data it receives, and we will tell you before your data becomes subject to a different privacy policy.

Advertising. The apps include the Google Mobile Ads SDK (AdMob). Ads can be shown only to users without a paid subscription, and only while we have turned advertising on in our servers. Advertising is currently turned off, so the app requests and shows no ads; if we turn it on, we will update this policy. Our servers decide whether ads may be shown from your subscription status, and for subscribers (including during a billing grace period) the app never requests ads. Ads are never shown while the VPN is connecting or disconnecting, during sign-in or a purchase, or during onboarding; full-screen ads appear only at natural breaks and are limited in number. When ads are on, the SDK requests non-personalized ads and sends Google the data it needs to serve and measure ads and to prevent fraud, such as an advertising or vendor identifier, approximate location derived from the IP address, device and app information and ad interactions. Google processes that data under its own policies (https://policies.google.com/technologies/partner-sites). The iOS app never asks for permission to track you. In the European Economic Area, the UK and Switzerland you are asked for consent where the law requires it and can change your choice at any time in Settings → Ad privacy choices. We do not use any analytics SDK, and we never give the ad provider anything about your account, VPN connections, servers or traffic.

8. Requests from authorities

We comply with valid legal process that applies to us. We review each request carefully, and we resist requests that are overbroad or not legally valid. We can only disclose data that exists: we cannot provide browsing history, DNS queries, traffic content, connection destinations or the IP addresses users connect to our VPN servers from, because we do not record them. The data we could be compelled to disclose is limited to the categories described in section 4, for the periods in section 5. This includes the pseudonymised IP hashes in our security logs (section 4.6): for up to 1 year we could confirm whether a specific IP address was used to sign in to, or to perform an account action on, a specific account.

Where the law allows, we will inform the affected user before disclosing their data.

9. What exists only temporarily on a VPN server

To be transparent about how a VPN technically works, the following data exists briefly in the memory (RAM) of the VPN server you are connected to. It is not written to disk, logged or exported to our control systems:

• Your current network endpoint. WireGuard keeps the most recent public IP address and port from which your device reached the server, so that it can send encrypted traffic back to you. It is replaced when your network changes and removed when your peer is removed from the server or the server restarts.
• Connection-tracking state. Like any router that performs network address translation, the server's operating system keeps a table of active connections (internal tunnel address and destination) so that replies reach the right device. Entries expire automatically shortly after a connection ends.
• DNS cache. The server's resolver caches DNS answers in memory to speed up lookups. The cache does not record which user asked for which name.

10. Security

We protect your data with measures appropriate to its sensitivity, including: encryption in transit (HTTPS/TLS) between the apps and our servers; WireGuard encryption for VPN traffic; argon2id password hashing; hashing of sign-in tokens, verification codes and Google purchase tokens; AES-256-GCM encryption at rest for VPN preshared keys and staff two-factor authentication secrets; mutual cryptographic authentication between our VPN servers and our control systems; role-based access and mandatory two-factor authentication for staff with administrative access; and audit logging of staff actions.

No system is perfectly secure. If a personal data breach affecting you occurs, we will notify you and the relevant authorities where the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it. You can:

• view and change your name and language in the app;
• view, rename and revoke your devices in the app;
• delete your account in the app (Account (the person icon at the top of the home screen) → Delete account) or by emailing support@nuvotik.com from your account's email address — see Account Deletion;
• turn off push notifications in your device settings;
• contact support@nuvotik.com to exercise any other right.

We will verify your request (for example, by confirming that it comes from your account's email address) and respond without undue delay and within the time limits set by applicable law. You also have the right to lodge a complaint with your local data protection authority.

12. International transfers

Our control-plane servers and our VPN server are currently located in India (Mumbai), on infrastructure rented from our hosting provider. When we add servers in other countries, we will list them here. Our service providers, such as Google for Google Play billing and, while AI topic recognition in the help assistant is turned on, Cloudflare on its global network, may process data in other countries, including countries other than yours. Where the law requires, we protect such transfers with appropriate safeguards, such as standard contractual clauses approved by the relevant authorities.

13. Children

Nuvotik VPN is intended for users aged 18 and older and is not directed at children or anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe that someone under 18 has provided us with personal data, contact support@nuvotik.com and we will delete it.

14. What a VPN does not do

A VPN encrypts your traffic between your device and our server and hides your real IP address from the websites and services you visit. It does not make you anonymous:

• websites and services can still identify you when you sign in to them, and through cookies, browser fingerprinting and the information you give them;
• traffic leaving our server for its destination is protected only by the encryption that the destination itself uses (such as HTTPS);
• the apps and operating system on your device, and the store and sign-in providers you use, process data under their own policies;
• we, as your VPN provider, are in a position of trust over the traffic that passes through our servers, which is why we limit what we keep as described in this policy.

The VPN Privacy Disclosure explains this in more detail.

15. Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version with a new "Last updated" date and, for material changes, notify you in the app or by email before they take effect.

16. Contact and governing law

Value Brands FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates

Licence No. 4426291.01, issued by Sharjah Publishing City Free Zone.

Email: support@nuvotik.com

This policy is governed by The laws of the United Arab Emirates, without prejudice to any mandatory data protection law that applies to you where you live.