Privacy Policy

1. Who We Are

NovaBridgeVPN is operated by NovaBridgeVPN Limited, registered in England and Wales (Company No. 16903183). Contact us at contact@novabridgevpn.com. We are the data controller for all personal data described in this policy.

2. Information We Collect

• Account data: email address and, optionally, your display name when you register.
• Device identifier: a generated device ID stored on your device, used to enforce the guest free-time allowance and to manage authorised devices on your account.
• Push notification token (FCM): collected when you enable push notifications so we can deliver service alerts to your device.
• Support ticket contents: any information you voluntarily submit when contacting support.
• Connection metadata: see Section 3 below.

3. Connection Metadata

We do not log your browsing activity, DNS queries, traffic contents, or the websites you visit through the VPN.

To operate and secure the service we collect minimal connection metadata per session: connection timestamp, disconnection timestamp, session duration, and the VPN server location used. This data is retained for 30 days and then automatically deleted.

4. How We Use Your Data

• Authenticating and managing your account.
• Delivering the VPN service and enforcing guest free-time limits.
• Sending transactional emails (receipts, account alerts, support replies).
• Sending push notifications you have opted in to.
• Fraud prevention and abuse detection.

We do not sell your personal data. Optional promotional measurement with GetTraffic365 is described below.

Promotional attribution choice

Some promotional links carry a random, opaque gt365_visit identifier. We remove it from the visible URL and hold a valid identifier briefly in the website session while you choose whether to allow measurement. Choosing No thanks discards the pending identifier and does not affect the VPN service. Choosing Allow measurement keeps the first valid identifier in the website session. We do not attach it to a customer account or payment unless an existing flow can deterministically establish that relationship; otherwise a registration or subscription remains unattributed. You can change your choice later; opting in later does not attribute earlier rejected visits.

A pending identifier is eligible for an immediate choice for 15 minutes. An accepted session-held identifier is eligible for at most 30 days after capture and may disappear sooner when the session ends. The preference itself is remembered for up to 180 days in a first-party cookie. Existing completed audit/payment records are not rewritten when you change your choice.

GetTraffic365 receives only a controlled event type, stable event ID, UTC event time, accepted opaque visit identifier where eligible, and for verified paid events only an authoritative amount/currency if available plus limited plan/provider codes. It does not receive your name, email, Firebase identity or ID token, payment card details, provider receipts or account identifiers, VPN credentials, device fingerprint, connection IP, VPN server usage, browsing/DNS history, destinations, or traffic content. We do not use VPN-usage data for this attribution.

The Cookie Notice explains the session and preference cookie used for this choice.

5. Payment Processing

Payments are processed by third-party processors: Stripe, PayPal, NOWPayments, Google Play (Google LLC), and Apple App Store (Apple Inc.). We do not store full card numbers or sensitive payment credentials on our servers. Each processor handles billing under its own privacy policy.

6. Third-Party Services

• Firebase Authentication & Firebase Cloud Messaging (Google LLC): identity management and push notification delivery.
• Microsoft 365: transactional and support email delivery.
• Twilio: operational alerts only; no user personal data is shared.

7. Data Retention

• Account data: retained while your account is active.
• Connection metadata: automatically deleted after 30 days.
• Support tickets: retained for 12 months after closure.
• Payment records: retained for 7 years for legal and accounting purposes (personal details anonymised on account deletion).

8. Account Deletion

You can delete your account from within the app (Settings → Account → Delete Account) or by visiting novabridgevpn.com/account/delete.

Deletion permanently removes your account, session history, connected devices, push token, and support tickets. Payment transaction records are retained for legal purposes with your personal details anonymised.

9. Your Rights (UK GDPR)

If you are in the UK or EEA you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability.

To exercise any right, contact us at contact@novabridgevpn.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Changes to This Policy

We will notify users of material changes via in-app notification or email. Continued use of the service after changes constitutes acceptance.