1. Introduction & Scope
At NextVPN ("NextVPN", "we", "our", or "us"), protecting your privacy and personal data is our primary commitment. This Privacy Policy explains how we collect, use, process, and safeguard your information when you access our website, client panel, mobile/desktop applications, and virtual private network (VPN) services.
By registering, accessing, or using NextVPN, you acknowledge that you have read and agreed to the practices described in this Privacy Policy.
2. Information We Collect
We believe in minimal data collection necessary to provide reliable, high-performance secure connection services:
- Account Credentials: When creating an account, we collect your account identifier (username and/or email address) and hashed authentication tokens. We do not store plaintext passwords.
- Google Sign-In & Identity Data: If you sign in via Google OAuth, we collect basic profile identity information explicitly provided by Google OIDC (your verified email address, Google unique subject identifier, and name). We use this data solely to authenticate your account and facilitate passwordless login.
- Billing & Payment Data: Transaction details, credit top-up history, payment reference IDs, and subscription plan choices. Sensitive payment credentials (card numbers or bank keys) are processed via external secure payment gateways and are never stored directly on our servers.
- Session & Security Cookies: Essential session cookies required for user authentication, security verification (e.g., anti-CSRF state tokens), and session persistence.
Strict No-Logs Policy for VPN Traffic: NextVPN enforces a strict zero-logs policy regarding your online activity. We do NOT record, log, monitor, or store browsing history, traffic destinations, data payload content, DNS queries, or originating IP addresses associated with your active VPN sessions.
3. Operational Data & Bandwidth Usage
To ensure fair usage, prevent service abuse, and maintain server health across our global infrastructure, we aggregate non-identifiable technical operational metrics:
- Total data bandwidth consumed (e.g., megabytes/gigabytes used) to enforce active plan quotas and billing limits.
- Active connection duration and plan expiry status.
- Server cluster load metrics stripped of any user-identifying IP addresses.
4. How We Use Your Information
We process the limited personal data we collect for the following legitimate business purposes:
- To provision, maintain, and deliver secure VPN connections and subscription services.
- To authenticate account sign-ins, verify Email OTP codes, and authorize Google OAuth access.
- To process billing transactions, maintain account wallet balances, and issue invoices.
- To deliver technical support, service notifications, and security updates.
- To detect and prevent fraudulent account creation, security threats, or unauthorized system access.
5. Third-Party Services & Integration
We do not sell, rent, or trade your personal data to third parties. We interact with third-party service providers strictly to perform essential operational functions:
- Google OAuth 2.0 / OpenID Connect: Used exclusively for single sign-on authentication. Identity data provided by Google is handled according to Google's User Data Policy.
- Payment Processors & Gateways: Used to securely process subscription payments and top-ups under standard financial compliance rules.
6. Data Security & Retention
We implement industry-standard administrative, physical, and technical security measures to protect your data, including TLS encryption for data in transit, robust access controls, cryptographic password hashing (bcrypt), and secured database architecture.
Account records and transaction history are retained for as long as your account remains active or as required to comply with legal obligation requirements. You may request account closure and data deletion at any time.
7. Your Rights & Data Control
Subject to applicable data protection laws (such as GDPR), you maintain the following rights regarding your personal information:
- Access & Export: The right to view and request a copy of personal information associated with your account.
- Rectification: The right to update or correct your email address and profile details.
- Deletion: The right to request permanent deletion of your user account and associated personal data.
8. Contact Information
If you have questions, feedback, or requests concerning this Privacy Policy or our data protection practices, please contact us: