Privacy Policy
This policy explains what personal data Ulasnet VPN (the apps for Android, iOS, macOS and Windows, and the website vpn.ulasnet.com) processes, why, for how long, and what choices you have. We keep it as short and concrete as we can.
1. Who we are
ULASNET LTD, registered in England & Wales, company number 17490184, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("we", "us"). We are the controller of the data described here. Contact: info@ulasnet.com.
2. What we process
| Data | Why | Notes |
|---|---|---|
| Account data (paid plans): your email address and your plan (type, source, expiry) | To create and secure your account and to know which features you may use | Handled by Amazon Cognito, our identity provider. Your password goes from the app straight to Cognito over HTTPS; we never see or store it. |
| Device ID: a random identifier the app generates on first start | To enforce the device limit (one device at a time per paid account), issue your personal connection credential and prevent abuse | Not your hardware ID and not your advertising ID. We store it only as a one-way hash, except for a short-lived copy used to verify an ad view (see 4). |
| Connection credential and session data: a random per-device VPN key, the region you chose, session start/expiry | To let you connect, to end sessions when you sign out or your plan ends | Kept only while the session is valid plus a short period (see 6). |
| Usage totals: bytes uploaded and downloaded per session, per day (free plan, per device) or per month (paid plan, per account) | To enforce plan limits (free: 1 GB per day; paid: 75 GB per month on desktop, 50 GB on mobile) | Totals only. Never the sites or services you used. |
| IP address | Technically required to carry your connection; to prevent abuse of the free plan | See 3. For abuse prevention we store only a salted-per-day hash of the IP, not the IP. |
| Payment confirmation record (paid plans): the exact confirmation text you accepted before paying, when you accepted it, and your account and Stripe reference numbers | To prove what you confirmed before paying and to handle disputes and legal claims | Kept in a locked, append-only archive. It contains no email address and no IP address. We keep it for 1 year after the payment, even if you delete your account. |
| Support messages | To answer you | Only what you send us by email. |
3. Your VPN traffic
While you are connected, your traffic passes through our server, so that server can technically see your IP address and the destinations your traffic is sent to. By design we do not store this. Specifically:
- We do not write the websites, apps or content you access to disk, and we do not build a history of your activity.
- The server keeps a short-lived technical log in memory only to attribute traffic to a session; it is emptied every few seconds and is never written to disk. Our session software reads only the connection's source address/port and the session identifier from it, and discards the rest.
- The records our session software keeps on disk contain session identifiers, random keys, timestamps and byte totals. They contain no IP addresses and no destinations. The operating system's routine error logs on our servers are rotated automatically, and we do not use them to identify users or to reconstruct what you did.
We cannot give you a legal guarantee beyond how the service is built today; we describe what it does, and we will update this page if it changes. No system is immune to compromise or lawful orders applicable to us or our infrastructure providers; because we do not keep browsing data, there is little to hand over.
Our own API records technical events (request ID, route, status code and duration) for operations. These records do not contain your IP address, email or traffic data.
4. Advertising (free plan on mobile)
The free plan on Android and iOS is supported by ads. Before a free session starts, the app shows a rewarded video ad from Google AdMob. Paid plans show no ads.
- The ad is shown while the VPN is off, so ad traffic does not travel through our VPN servers and our servers do not see it.
- We request non-personalised ads only. In the EEA and the UK, Google's consent form (UMP) may be shown first; if you decline consent, ads are not loaded and the free plan cannot be started.
- Google, as an independent ad provider, may collect and use device and usage data (for example IP address, device identifiers, ad interaction) to deliver ads, limit repeats, measure performance and prevent fraud. See How Google uses information from sites or apps that use its services and the Google Privacy Policy.
- To make sure a free session is only given after an ad was actually watched, our app attaches a random single-use code (and the device ID) to the ad; Google reports the completed ad view to our server with that code. We keep it for up to 24 hours.
- The Android app declares the advertising-ID permission because the ads SDK requires it. We do not use the advertising ID ourselves, and we ask for non-personalised ads.
5. Why we process data (legal bases, UK GDPR)
- Contract — to provide the service you asked for (account, connection, plan limits).
- Legitimate interests — security, abuse and fraud prevention, keeping the service running, and defending legal claims (the payment confirmation record).
- Consent — advertising, where required (UK/EEA); you can refuse.
- Legal obligation — records we must keep by law (for example payment records once paid plans are sold through payment providers).
We do not sell your personal data and we do not use it for profiling or personalised advertising.
6. How long we keep data
| Data | Kept |
|---|---|
| Account (email, plan) | Until you delete the account |
| Session records (credential, region, times, totals) | Session length plus up to 3 days |
| Daily usage totals (free plan, per device) | Up to 35 days |
| Monthly usage totals (paid plan, per account) | Up to 62 days |
| Abuse-prevention counters (hashed IP, per day) | Up to 3 days |
| Ad-view verification code and device ID | Up to 24 hours |
| Payment confirmation record (no email address, no IP) | 1 year after the payment, also after account deletion |
| Technical API and server logs (no IP, email or traffic data) | 14 to 30 days |
| Support emails | As long as needed to help you, then deleted |
Records are removed automatically when these periods end.
7. Who we share data with
- Amazon Web Services — hosts our accounts (Amazon Cognito), databases and servers. Our account and API data is stored in the AWS US East (N. Virginia) region. Some VPN servers run on AWS in Germany, the USA, Brazil, Australia, Japan and South Africa.
- OVHcloud — hosts the free-plan VPN server (Canada).
- Google (AdMob) — ads on the free plan (see 4).
- Payment providers — when paid plans are sold, payments will be handled by Stripe (web/desktop) and by Apple or Google (mobile). We will not receive your card number. We will update this policy when this goes live.
- Authorities — only where the law requires.
Your data may therefore be processed outside the UK. Where required, we rely on appropriate safeguards for international transfers.
8. Your rights and deleting your account
Under UK and EU data protection law you can ask to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. You can delete your account in the app (Profile → Delete account): this permanently removes your account, your plan record and ends your sessions. Deleting the account does not cancel a subscription bought through an app store or a payment provider; cancel that there. For any request write to info@ulasnet.com. If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
9. Security
Connections use the VLESS protocol with REALITY, which is designed to resist detection and interference. App sign-in tokens are stored in the operating system's secure storage (Android Keystore, Apple Keychain). Each node can only access its own sessions in our backend. No online service is perfectly secure.
10. Children
Ulasnet VPN is not directed at children and we do not knowingly collect their data. You must be at least 16 years old to use it.
11. Changes
We will update this page when what we do changes (for example when payments or sign-up open) and change the date above. Material changes will also be announced in the app.