Privacy Policy
A plain-language explanation of what data we collect, why we need it, what we deliberately don't store, and what rights you have as a user — no matter which country you're in. A couple of minutes to read.
UNION VPN is an internet access service that you use through apps on your device and a Telegram bot. We haven't appointed a dedicated Data Protection Officer (DPO) — the scope and nature of our data processing doesn't require one under applicable data protection rules.
This policy applies to all users regardless of country of residence and follows commonly accepted international data protection standards, including the GDPR (European Union) and CCPA/CPRA (California, USA). By using the service or paying for UNION VPN, you agree to the terms described below.
The terms of providing the services — payment, refunds, rules of use — are set out in the Terms of Service.
Our no-logs policy
We do not collect, store, or share your browsing history, traffic content, or the addresses of sites/services you accessed through the VPN.
- VPN servers only receive the technical information needed to route the connection (e.g. a pseudonymous session identifier) — never linked to specific sites or traffic content.
- Your IP address is used only in the server's memory for the duration of the active session and is never written to disk.
- Account, billing, and analytics data are processed separately from the VPN tunnel and are never linked to which sites and services you visit or to the content of your traffic.
Personal data we collect
| Data category | Why we need it | Legal basis | Retention period |
|---|---|---|---|
| Telegram ID and username | Identifying you in the bot, granting subscription access | Performance of a contract | 3 years after subscription ends |
| Payment data (amount, date, method) | Confirming and renewing your subscription, tax accounting | Performance of a contract; legal obligation | Up to 7 years — if required by tax/accounting law applicable to the payment |
| Technical subscription data: traffic volume for the billing period, number of connected devices, start and end dates of the paid period (with no information about the resources visited or the content of traffic) | Applying plan limits, protection against abuse, confirming that services were provided in disputes | Performance of a contract; legitimate interest | 3 years after subscription ends |
| Email / phone number (if you provide it) | Communication about your subscription and support | Consent | 3 years after subscription ends |
| Support requests | Answering questions, resolving disputes | Performance of a contract; legitimate interest | 3 years |
| Anonymized documentation web analytics | Improving the docs and website | Legitimate interest | 3 years (may be kept longer once aggregated) |
We never see or store your full card details — they are handled directly by the payment provider.
Who we share data with
Some data unavoidably passes through third-party services we rely on to run UNION VPN:
| Who | Role | What data |
|---|---|---|
| Payment provider | Payment processing | Payment data, subject to the provider's own security policy |
| Telegram | Platform for the bot and support | Telegram ID/username, support messages |
| VPN server hosting providers | Running VPN nodes | Technical session information, not linked to traffic |
| Documentation web analytics | Visit statistics for the docs site | Anonymized, aggregated visit data |
We do not sell personal data and do not share it with third parties for marketing purposes.
International data transfers
Because UNION VPN serves users worldwide, and the providers we rely on (payment provider, server hosting, Telegram) may be located in different countries, your data may be processed outside your country of residence — including in countries with a different level of data protection.
In these cases we rely on the safeguards those providers themselves use: adequacy decisions where applicable, and Standard Contractual Clauses or similar mechanisms where adequacy has not been established.
How long we keep data
We keep data only for as long as necessary for the purposes described above, following the principle of storage minimization:
- account data and contact details — 3 years after the subscription ends;
- support requests — 3 years;
- payment data — as required by applicable tax/accounting law;
- anonymized analytics — may be kept longer, since it can't be tied to a specific person.
Once the retention period expires, data is deleted or anonymized.
Your rights
Regardless of your country of residence, you can at any time:
- know what data we hold about you and get a copy of it (right of access);
- ask us to correct inaccurate or incomplete data (right to rectification);
- request deletion of your data — the "right to be forgotten" — unless this conflicts with legal requirements or refund conditions;
- restrict or object to processing;
- withdraw consent to processing at any time, where processing is based on consent — this won't affect the lawfulness of processing before the withdrawal;
- receive your data in a structured, machine-readable format to transfer to another provider (right to data portability).
If you're located in the European Union, you also have the right to lodge a complaint with your country's data protection authority if you believe we've violated your rights under the GDPR.
If you're a California resident, under the CCPA/CPRA you additionally have the right to know what categories of data we collect and for what purpose, and the right to opt out of the sale or sharing of data with third parties for value — we do not sell user data and never have. Exercising any of these rights will not result in discriminatory treatment in your access to the service.
How to exercise your rights. Message support via the Telegram bot and describe your request. To protect your data, we may ask you to confirm the request is really coming from you (for example, from the same Telegram account). We respond to requests within a reasonable time, typically no later than one month.
Age requirement
The service is available to users aged 18 and older. Users aged 14 to 18 may use it only with the consent of a parent or legal guardian. The service is not intended for children under 14, and we do not knowingly collect their data.
Data security
We apply reasonable technical and organizational measures to protect data: access is limited to support staff who need it to do their job, and data collection is minimized through our no-logs architecture. No security method offers a 100% guarantee — if we discover an incident affecting your data, we will take reasonable steps to address it and, where necessary, notify affected users without undue delay.
Changes to this policy
We may update this policy from time to time — for example, if the set of services we use or applicable legal requirements change. The current version is always available on this page; the last update date is noted below.
Last updated: October 2026.
Still have questions?
Something's not working, or you still have questions — message us on Telegram. We'll help any time, day or night.