← Back to Home

Privacy Policy

Last updated: October 13, 2026 (version 2026-10-13)

This policy explains what OmnixVPN collects, why, who sees it, how long we keep it, and what you can ask us to do with it. It is written to be read, not skimmed, and it describes what our systems actually do.

1. Who is responsible

The data controller is Omnix Tech Ltd, registered in Cyprus under numberHE 494900, Kokkinokampos 4, Adonis Villa 4, Chloraka, 8220 Paphos, Cyprus. For anything in this policy, write toprivacy@omnixvpn.com.

2. What we collect

2.1 Account

Your email address, your phone number (used to send sign-in codes), the times your email and phone were verified, the time of your last sign-in, your plan and its status, and your acceptance of the Terms of Service (version, time, IP address and device). If you sign in with Google, we receive your email address and name from Google.

2.2 Devices

For each device you add: a device identifier generated by the app, the device name and type, operating system and app version, the IP address and browser or app identifier seen when the device was registered, the time it was last seen, and the routing rules you set (which apps or domains go through which country). The routing rules are the product; they tell our apps what to do.

2.3 Sign-in codes

One-time codes sent by SMS or email, with delivery attempts and counters we use to stop abuse. Codes expire within minutes.

2.4 Payments

The plan, amount, currency, date and status of each payment, and the identifiers our payment provider Stripe assigns to your customer record, subscription and invoices. Card numbers are entered directly with Stripe and never reach our servers. Purchases made through the Apple App Store or Google Play are handled by Apple or Google, who share with us only what is needed to activate your plan.

2.5 Activity on our API

Each request to our account and billing API is recorded with the action performed, your account identifier, your IP address, the app or browser used and the time. This is a security and audit log. It does not contain your VPN traffic.

2.6 Support

Messages you send us, with the details you include, and the issue reports sent from the apps (device type, app version, the problem you describe).

2.7 Website

Our website uses Plausible, an analytics tool that sets no cookies and does not identify you. If Google Analytics is enabled, it runs in consent mode with storage denied: it sets no cookies and stores no identifier on your device. The contact form sends us what you type.

3. What our VPN servers do not record

We do not keep logs of the websites you visit, the DNS queries you make, the content of your traffic, or which IP addresses you connect to through the VPN.Our servers verify your access token when you connect and move your traffic. Their logs are limited to errors, authentication failures (with the connecting IP address) and aggregate load, and are rotated automatically within 30 days. Data usage per billing period is counted as a total per account so we can apply plan limits. We cannot reconstruct your browsing from what we hold.

4. Why we use your data, and the legal basis

  • To provide the Service (account, sign-in codes, devices, routing rules, plan limits): performance of our contract with you.
  • To bill you and keep accounting records: performance of the contract and our legal obligations under tax law.
  • To keep the Service secure and prevent abuse (rate limits, audit log, abuse handling, dispute defence): our legitimate interest in running a safe service, and yours in keeping your account safe.
  • To send you service emails (sign-in codes, receipts, security notices, trial and subscription reminders): performance of the contract.
  • To send product news: your consent, which you can withdraw from any email or from your profile.
  • To answer legal requests: our legal obligations.

5. Who we share it with

We share personal data only with providers that process it for us under contract:

  • Amazon Web Services: hosting of our servers and database, and email delivery.
  • Stripe: payments, invoices and dispute handling.
  • Twilio: delivery of SMS sign-in codes.
  • Google: optional sign-in with Google, and website analytics as described above.
  • Plausible: cookieless website analytics.
  • Datadog: storage of our server logs, including the API audit log.
  • Telegram: internal alerts to our team about new sign-ups and payments, with email addresses and phone numbers masked.
  • Apple and Google: if you buy through their stores, under their own privacy policies.

We do not sell personal data, and we do not share it with advertisers or data brokers. We disclose data to authorities only as described in section 10.

6. Where your data is stored

Account, device and billing records are stored on Amazon Web Services in the European Union (Frankfurt). Our VPN servers are located in the countries we offer, currentlyUnited States, United Kingdom, Germany, Canada, Mexico, Brazil, France, Netherlands, Sweden, Switzerland, Norway, Spain, Italy, Poland, Czech Republic, Singapore, Japan, Australia, South Korea, India, United Arab Emirates; your traffic passes through the server you choose and is not stored there. Some of our providers process data in the United States under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. How long we keep it

  • Account and device data: while your account exists, then deleted within 30 days of your deletion request or of the account being closed. See our Data Deletion Policy.
  • Terms acceptance and checkout records: while your account exists and for as long as a payment can still be disputed, up to 18 months after the last charge.
  • Payment and invoice records: 7 years, as required by accounting and tax law.
  • Sign-in codes: minutes. Abuse counters: up to 90 days.
  • API audit log: up to 24 months.
  • VPN server diagnostics: rotated within 30 days.
  • Support messages: up to 24 months after the request is closed.
  • Email delivery log: a short rolling window used to avoid sending duplicates.

8. Your rights

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, and to receive a copy in a portable format. You can withdraw consent to product news at any time. To use these rights, emailprivacy@omnixvpn.com from your account address, or use the deletion page above. We answer within one month.

You can also complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the data protection authority of your own country.

9. Security

Traffic between your device and our servers is encrypted. Access to our systems is limited to the people who run the Service, protected by individual credentials and recorded. Card data never reaches our servers. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

10. Requests from authorities

We respond only to valid legal process under the law of Cyprus. What we can produce is limited to what we hold: account details, device records, billing records and the API audit log described above. We do not hold browsing history, DNS queries or traffic content, so we cannot produce them.

11. Children

The Service is for adults. We do not knowingly collect data from anyone under18. If you believe a minor has created an account, tell us and we will delete it.

12. Changes to this policy

We will post changes on this page and update the date and version at the top. For material changes we will email the address on your account before they take effect.

13. Contact

Privacy requests: privacy@omnixvpn.com
Support: support@omnixvpn.com
Post: Omnix Tech Ltd, Kokkinokampos 4, Adonis Villa 4, Chloraka, 8220 Paphos, Cyprus