Privacy Policy

1. Who We Are

NovaBridgeVPN is operated by NovaBridgeVPN Limited, registered in England and Wales (Company No. 16903183). Contact us at contact@novabridgevpn.com. We are the data controller for all personal data described in this policy.

2. Information We Collect

• Account data: email address and, optionally, your display name when you register.
• Device identifier: a generated device ID stored on your device, used to enforce the guest free-time allowance and to manage authorised devices on your account.
• Push notification token (FCM): collected when you enable push notifications so we can deliver service alerts to your device.
• Support ticket contents: any information you voluntarily submit when contacting support.
• Connection metadata: see Section 3 below.

3. Connection Metadata

We do not log your browsing activity, DNS queries, traffic contents, or the websites you visit through the VPN.

To operate and secure the service we collect minimal connection metadata per session: connection timestamp, disconnection timestamp, session duration, and the VPN server location used. This data is retained for 30 days and then automatically deleted.

4. How We Use Your Data

• Authenticating and managing your account.
• Delivering the VPN service and enforcing guest free-time limits.
• Sending transactional emails (receipts, account alerts, support replies).
• Sending push notifications you have opted in to.
• Fraud prevention and abuse detection.

We do not sell your personal data or share it with third parties for marketing purposes.

5. Payment Processing

Payments are processed by third-party processors: Stripe, PayPal, NOWPayments, Google Play (Google LLC), and Apple App Store (Apple Inc.). We do not store full card numbers or sensitive payment credentials on our servers. Each processor handles billing under its own privacy policy.

6. Third-Party Services

• Firebase Authentication & Firebase Cloud Messaging (Google LLC): identity management and push notification delivery.
• Microsoft 365: transactional and support email delivery.
• Twilio: operational alerts only; no user personal data is shared.

7. Data Retention

• Account data: retained while your account is active.
• Connection metadata: automatically deleted after 30 days.
• Support tickets: retained for 12 months after closure.
• Payment records: retained for 7 years for legal and accounting purposes (personal details anonymised on account deletion).

8. Account Deletion

You can delete your account from within the app (Settings → Account → Delete Account) or by visiting novabridgevpn.com/account/delete.

Deletion permanently removes your account, session history, connected devices, push token, and support tickets. Payment transaction records are retained for legal purposes with your personal details anonymised.

9. Your Rights (UK GDPR)

If you are in the UK or EEA you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability.

To exercise any right, contact us at contact@novabridgevpn.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Changes to This Policy

We will notify users of material changes via in-app notification or email. Continued use of the service after changes constitutes acceptance.