In effect from 6 August 2026

Privacy policy

A VPN that collects a lot about you defeats its own purpose. This page sets out everything AmosVPN Single Member Private Company holds, why, and for how long — in plain language first, with the legal detail underneath.

1. Who is responsible for your data

The data controller is AmosVPN Single Member Private Company, a single-member private company registered in Greece, at 131 Germanou Str, 26224 Patras, Greece. You can reach us about anything on this page at support@amosvpn.com.

Because we are established in the EU, the General Data Protection Regulation (GDPR) applies to everything described here, wherever in the world you are. Our supervisory authority is the Hellenic Data Protection Authority.

2. What we collect

Your account

An account needs an identifier and a password. An email address is optional. If you choose not to give one, we hold no contact details for you at all — which also means we cannot help you recover the account if you lose the password, and we will not make an exception, because we have nothing to check you against.

If you do give us an email address, we use it for exactly two things: proving the account belongs to you (sign-in confirmation, password reset) and contacting you about the service you are paying for. We do not use it for marketing unless you separately ask us to, and you can withdraw that at any time.

Payment

We accept cards, PayPal, cryptocurrency, Alipay and WeChat Pay. Each of these is handled by a payment processor. We never receive or store your full card number, your PayPal login, or your Alipay or WeChat account. What reaches us is: that a payment succeeded or failed, the amount and currency, the plan it relates to, and a reference the processor gives us so we can match the payment to your account. For cards we may also receive the last four digits and the expiry month, which the processor sends so you can recognise your own payment method.

Cryptocurrency payments involve no identity information at all. Alipay and WeChat Pay are processed entirely by a third party; we are told the payment status and nothing about the account behind it.

Your use of the VPN

Almost nothing, and the exception is worth stating precisely. We do not record which servers you connect to, when you connect, how long you stay, what your originating IP address is, or anything about the traffic itself. We do keep one cumulative data-volume figure per account — how many bytes it has moved this billing period — because our refund guarantee is conditioned on it. That number describes a quantity and nothing else. This is the subject of a separate policy, because it is the part that matters most.

Support

If you write to us, we have your message and whatever you chose to put in it, including the address you wrote from. We keep support threads so we can follow up and so we can see whether a problem is recurring.

This website

We measure how the site is used with Rybbit Cloud, a privacy-focused analytics service. It records page views, the page that referred you, and coarse technical details such as country, browser and device type. It sets no cookies, it does not fingerprint you, and it cannot follow you to other websites. We use it to see which pages people read, not to build a picture of any individual. It is the only script on this site loaded from another company's servers.

Apart from that one script, the site loads no advertising pixels, no social widgets, and no fonts or images from other domains.

It stores one thing in your browser: a localStorage entry recording which language you chose, so the site stops guessing on your next visit. It never leaves your device. Clearing your browser storage removes it.

Our web server keeps ordinary access logs for 7 days for security and troubleshooting, then discards them.

3. Why we are allowed to process it

Under GDPR Article 6, our lawful bases are:

• Performance of a contract — your account, your subscription and your payments. We cannot sell you a service without these.
• Legal obligation — tax and accounting law requires us to keep records of what we invoiced and to whom.
• Legitimate interests — keeping the service secure and preventing fraud and abuse. We have weighed this against your interests and limited what we keep to what that purpose actually needs.
• Consent — only for optional marketing email, if you ask for it. You can withdraw consent at any time, and withdrawing is as easy as giving it.

4. We do not sell your information

We do not sell, rent, licence or trade personal data. We do not share it with advertisers, data brokers, analytics companies or "partners". We do not build profiles of you and we do not carry out automated decision-making or profiling that produces legal effects for you.

This is not a promise about our current intentions that we can quietly change later: if it ever stopped being true, this page would have to say so, and you would have to be told before it applied to you.

5. Who else sees your data

Only the suppliers we need to run the service, and only the parts they need. Each is bound by a data-processing agreement, may act only on our instructions, and may not use your data for their own purposes.

• Payments — Stripe handles card and PayPal payments. Alipay and WeChat Pay are handled by a separate provider, which we do not name here so that the choice of payment method cannot itself say anything about you.
• Email — Google Mail, for account and support mail.
• Analytics — Rybbit Cloud, as described above.

Our hosting and network suppliers are not listed here because they hold no personal data of yours to see — they provide capacity, not access.

We may also disclose data where we are legally compelled to. We will only do so where the demand is valid and binding on us, we will resist demands that are not, and we will tell you unless we are legally forbidden from doing so. In practice, what we can hand over is limited by what we hold — and for your VPN activity, that is nothing.

6. How long we keep it

• Account data — while your account is open, and for 30 days after you close it, so that an accidental closure can be undone.
• Invoices and payment records — as long as Greek tax law requires.
• Support threads — 24 months from the last message.
• Server access logs — 7 days.
• VPN activity — not applicable; it is never written down.

7. Where your data is processed

Our infrastructure spans several countries, so data may be processed outside the European Economic Area. Google Workspace, which carries our account and support mail, is operated by a company in the United States. Where a transfer outside the EEA happens, it relies on an adequacy decision by the European Commission or on Standard Contractual Clauses, along with additional safeguards where they are needed. You can ask us for details of the safeguards that apply to you.

8. Your rights

Under GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify anything inaccurate.
• Erase your data, where we have no overriding legal reason to keep it.
• Restrict or object to processing based on legitimate interests.
• Port your data to another provider in a machine-readable format.
• Withdraw consent at any time, where consent is the basis.

Write to support@amosvpn.com and we will respond within one month. There is no charge. We may need to verify that the request comes from you — which, if you gave us no email address, may be impossible; that is the trade-off of an anonymous account, and we would rather be unable to help than hand your data to someone claiming to be you.

If you think we have got this wrong, you can complain to the Hellenic Data Protection Authority, or to the supervisory authority where you live. We would rather you told us first, but it is your right either way.

9. Children

The service is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to support@amosvpn.com and we will delete it.

10. Security

Passwords are stored hashed, never in a form we can read. Data in transit is encrypted. Access to production systems is limited to the people who need it. No system is perfectly secure, and anyone who tells you otherwise is selling something — but the best protection we can offer is the data we chose not to collect in the first place.

11. Changes to this policy

If we change this policy in a way that matters, we will change the date at the top and, where we hold an address for you, tell you before the change takes effect. Continuing to use the service after that means you accept the revised policy.

12. Contact

Questions, requests, or complaints: support@amosvpn.com. A real person reads it.