Consent to the Processing of Personal Data for Guardex VPN

Last updated: 30 August 2026

Document version: 1.1

This Consent is provided separately from the Public Offer and the Privacy Policy.

By actively selecting the separate required checkbox “I consent to the processing of personal data” and completing registration, or by confirming this Consent through another Guardex interface, the User freely, voluntarily, and in the User’s own interest gives specific, informed, conscious, and unambiguous consent to processing on the following terms.

1. Controller

This Consent is given to the Guardex VPN Controller, an individual applying the Russian Professional Income Tax (NPD) regime. Full controller details, Russian Taxpayer Identification Number, and contacts are set out in section 13 at the end of this Consent.

2. Data Subject

The data subject is the Guardex User confirming this Consent through an Account, e-mail address, device, or selected authentication provider under the User’s lawful control.

The User confirms that the e-mail address used belongs to or is lawfully controlled by the User and that the User is entitled to provide this Consent.

3. Personal Data Covered by Consent

This Consent covers the following categories where they are actually provided by the User, generated by Guardex, or necessary for a selected feature.

3.1. Account

• e-mail address;

• nickname or display name;

• internal User ID;

• password hash;

• Account status and creation date;

• subscription status and expiry;

• authentication tokens;

• versions of accepted documents, acceptance date and time, IP address, and User Agent.

3.2. Third-Party Authentication

• Google User ID, e-mail, e-mail verification status, display name, and authorization code or token;

• Apple `sub`, e-mail or Hide My Email address, name supplied on first authorization, e-mail verification status, and technical authorization code;

• Telegram ID, chat ID, username, first and last name, language, and time of bot interaction.

3.3. Device and Application

• Device ID;

• technical fingerprint;

• device name and model;

• operating system, version, and platform;

• installation public key;

• FCM token or another notification token where used;

• latest activity date.

3.4. VPN Sessions and Usage

• User ID and Device ID;

• selected server, country, and city;

• session start time and duration;

• bytes sent and received;

• daily and monthly traffic counters;

• diagnostic events, availability data, and technical errors.

3.5. IP Address and Security

• IP address in a short-lived rate-limiting mechanism;

• IP addresses and technical events in server, security, and administrator logs;

• indicators of automated registrations, attacks, fraud, chargebacks, and limit evasion.

3.6. Payments and Subscriptions

• order ID and payment or transaction ID;

• payment date, amount, currency, method, and status;

• Plan and access period;

• error code;

• refund information;

• App Store product ID and transaction ID;

• Google Play product ID and purchase token;

• receipt identifier or URL where used.

Guardex does not request or store full payment-card numbers, CVV/CVC codes, or online-banking passwords.

3.7. Support

• e-mail address, User ID, and Telegram ID;

• subject, content, and history of a support request;

• language, source, status, and priority;

• voluntarily attached files and technical information.

3.8. Website

• technical cookies;

• CSRF data;

• localStorage and sessionStorage required for login, language, theme, and interface state.

4. Purposes

Data may be processed to:

1. register an Account and verify e-mail;

2. authenticate the User and recover access;

3. create and maintain the Account;

4. provide VPN access;

5. manage devices and limits;

6. administer free and paid Plans;

7. accept payment, activate access, issue a receipt, and process refunds;

8. restore application-store purchases;

9. send service notices;

10. provide support;

11. diagnose errors and improve stability;

12. prevent attacks, fraud, and abuse;

13. maintain mandatory tax, payment, and legal records;

14. resolve disputes and protect the parties’ rights.

This Consent does not include advertising. Advertising is sent only under a separate voluntary consent.

5. Processing Operations and Methods

The Controller may collect, record, organize, accumulate, store, update, retrieve, use, compare, provide to authorized processors, anonymize, block, delete, and destroy data.

Processing is automated or mixed and includes transmission over the Internet.

6. Parties Involved in Processing

Where necessary, data may be processed by:

• Google, Apple, and Telegram when the User selects the relevant authentication method;

• a Payment Provider, the App Store, or Google Play when a purchase is made;

• Resend for verification codes, account recovery, receipts, and service e-mails, including the e-mail address, message content, and delivery information;

• hosting and VPS providers that host the website, API, database, and VPN nodes;

• authorized developers and support personnel within their assigned roles;

• public authorities only where required by law.

These parties are not authorized to use data for incompatible independent purposes.

7. Cross-Border Processing

The User agrees that limited data may be processed outside the Russian Federation when using Google, Apple, Telegram, the App Store, Google Play, Resend, or foreign VPN nodes.

A foreign VPN node may technically receive the originating IP address, a short-lived access token, an installation identifier, and connection parameters. E-mail and payment-profile data are not sent to VPN nodes. Resend may process the e-mail address, service-message content, and delivery logs in the United States.

The primary database is located on server infrastructure in Moscow, Russian Federation.

Backups are stored in separate object storage in the Russian Federation, separate from the primary production server, on a rolling basis for up to 30 days.

This Consent does not replace any other obligation imposed on the Controller by applicable law.

8. Duration

Consent applies from confirmation:

• while the Account exists;

• for the retention periods stated for particular categories in the Privacy Policy;

• until withdrawal for processing based only on Consent.

Payment, tax, fraud-prevention, and dispute records may be retained after withdrawal where another lawful ground applies.

9. Withdrawal

Consent may be withdrawn by:

• deleting the Account in the Application or user dashboard;

• e-mailing support@guardex-vpn.com.

After withdrawal, the Controller stops processing based solely on Consent and deletes data that is no longer necessary within the applicable period. Where data is necessary to perform or terminate an agreement, comply with law, process a refund, protect rights, or maintain security, processing may continue on another lawful ground.

Withdrawal of Consent necessary for the Account may make further use of Guardex impossible.

10. No Consent to Public Dissemination

The User does not consent to dissemination of personal data to an unrestricted public. A nickname is used within the Account and is not published without a separate User action or separate consent.

11. Evidence of Consent

Guardex stores the User ID, document type and version, confirmation date and time, IP address, User Agent, and registration source to demonstrate that Consent was obtained.

12. Related Documents

Further details are provided in the Guardex VPN Privacy and Personal Data Processing Policy. Use of the Service is governed by the Public Offer and Terms of Use.

Contact: support@guardex-vpn.com

13. Controller Details and Contacts

Controller: Крайник Борис, individual payer of Professional Income Tax (NPD)

Russian Taxpayer Identification Number: 390003958372

Website: https://guardex-vpn.com

E-mail for personal-data matters, withdrawal, and support: support@guardex-vpn.com