Privacy Policy

This policy explains what personal data PhantomProxies (“we”, “us”), operated by PhantomProxies, collects, why we collect it, who we share it with, and what control you have over it.

1. Data we collect

Account data (from Discord or Google)

When you sign in, your chosen provider gives us your name, email address, profile image URL, and a provider account ID. We also store the OAuth tokens issued by that provider so we can keep you signed in. We never receive your Discord or Google password.

Purchase data

For each purchase we store the package purchased, GB amount, amount charged, a Stripe session identifier, status, and timestamps.

We do not receive or store your card number, CVC, or expiry. Card details go directly to Stripe and never touch our servers.

Service data

We generate and store proxy credentials issued to you, and we read your bandwidth balance and consumption totals from our upstream network provider to display in your dashboard.

What we do not collect

We do not log the contents of your proxy traffic, the destinations you connect to, or the data you transmit. Aggregate bandwidth totals are measured by our upstream provider for billing.

2. Why we use it

• To create and authenticate your account.
• To take payment and provision the bandwidth you bought.
• To show your balance, credentials, and purchase history.
• To provide support and investigate abuse reports.
• To meet legal, tax, and accounting obligations.

Our legal bases (where the GDPR applies) are performance of a contract for account and fulfilment data, legal obligation for transaction records, and legitimate interests for security and abuse prevention.

3. Who we share it with

We use the following processors, each of which receives only what it needs:

• Stripe — payment processing. Receives your email and payment details directly.
• Our upstream residential proxy network provider — receives a generated, pseudonymous proxy username and a bandwidth allocation. It does not receive your name or email.
• Our database and hosting providers — store and serve the application and its data.
• Discord and Google — only as your chosen sign-in provider, in accordance with their own policies.

We do not sell your personal data, and we do not share it for advertising purposes. We may disclose data where legally required, or to protect our rights or the safety of others.

4. Cookies

We use a session cookie to keep you signed in, and related security cookies used by the authentication flow. These are strictly necessary for the Service to function. We do not use advertising or third-party tracking cookies.

5. Retention

• Account data — kept while your account exists, and deleted on request (see Section 7).
• Transaction records — retained for up to seven (7) years where required for tax and accounting.
• Sessions — expire automatically.

6. Security

Data is transmitted over TLS and stored with reputable cloud providers. Proxy credentials are stored so they can be displayed back to you in your dashboard, which means they are retrievable rather than irreversibly hashed. Treat them as sensitive, and contact us if you believe they have been exposed so we can rotate them.

No system is perfectly secure. We cannot guarantee absolute security, but we will notify affected users and any required regulator of a personal data breach without undue delay.

7. Your rights

Depending on where you live (including under the GDPR and CCPA), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data, subject to records we must retain for tax purposes.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent where processing relies on it, without affecting prior processing.

To exercise any of these, email support@phantomproxies.org. We will respond within the period required by applicable law. Deleting your account also revokes the proxy credentials issued to it, and any remaining bandwidth is forfeited unless refundable under our Refund Policy.

8. International transfers

We are based in the United States and our providers may process data in the United States and other countries. Where data is transferred out of the UK or EEA, our processors rely on appropriate safeguards such as Standard Contractual Clauses.

9. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.

10. Changes

We may update this policy. The “Last updated” date above will change, and material changes will be communicated where practical.

11. Contact

Privacy questions or requests: support@phantomproxies.org