This policy explains how Exalo Media processes personal data when you visit exalovpn.com, purchase or manage an Exalo VPN subscription, receive transactional email, or use the VPN service.
1. Controller
Exalo Media, Osingastate 13, 8926 LK Leeuwarden, the Netherlands, KvK 62256661, is the data controller for customer, billing, website and support data. Contact: info@exalo.nl.
2. Data we process
- Account data such as name, email address, preferred language and authentication records.
- Billing address, country, orders, invoices, payment status, currency, tax evidence and subscription history. Full card details are handled by the payment provider.
- Generated VPN username, service status, assigned plan and configuration requests.
- IP address, user agent, timestamps, request identifiers, rate-limit and fraud signals, and administrative audit logs.
- Support communications and privacy requests.
- Cookie or analytics data only where enabled and permitted.
3. Purposes and legal bases
- Contract: accounts, VPN access, authentication, configurations, subscriptions and support.
- Legal obligation: invoices, tax and OSS records, accounting and lawful requests.
- Legitimate interests: security, fraud prevention, diagnostics and audit trails.
- Consent: optional analytics or marketing where required. Transactional service email is not marketing.
4. VPN traffic and logs
Exalo Media does not use VPN traffic content for advertising and does not sell browsing data. VPN connections are supplied through an infrastructure connector. That provider may necessarily process connection and operational data to authenticate accounts, route traffic, prevent abuse and operate its network. We do not promise that no technical logs exist unless the active connector contract and technical documentation expressly support that claim.
5. Recipients and processors
Data may be shared only as necessary with our VPN infrastructure provider, Cloudflare for hosting and security, Stripe for payments and billing, Resend for transactional email, professional advisers and public authorities where legally required.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, we use an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and assess supplementary safeguards.
7. Retention
- Invoices, payment and tax/OSS evidence: normally seven years or longer where legally required.
- Active account data: for the subscription term.
- Inactive data: deleted or anonymised when no longer required for contract, disputes, fraud prevention or legal duties.
- Magic links: 60 minutes if unused and no more than 15 minutes after first click; a new link invalidates existing links.
- Security and API logs: for a limited period appropriate to investigation and platform security.
8. Security
We use access controls, encrypted transport, secret management, scoped project access, expiring authentication links, rate limiting, audit logging and provider security controls. No system is completely secure.
9. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent. Contact info@exalo.nl. You may complain to the Dutch Data Protection Authority or your local supervisory authority.
10. Children
The service is not directed to children. We do not knowingly create subscriptions for persons who cannot validly enter the agreement under applicable law.
11. Automated decisions
Security and payment providers may automatically score transactions or requests for fraud and abuse. We do not make decisions producing legal or similarly significant effects solely through our own automated processing unless permitted by law and accompanied by required safeguards.
12. Changes and contact
We may update this policy when services, providers or law change. Material changes will be highlighted or communicated where appropriate. Exalo Media · Osingastate 13 · 8926 LK Leeuwarden · The Netherlands · info@exalo.nl.