Privacy Policy

AVALANCHE Service

1. General

1.1. This Privacy Policy (“Policy”) governs the processing and protection of personal data relating to users of the AVALANCHE service (“Service”), including the website, account dashboard, and VPN client applications.

1.2. Personal data is processed in connection with the AVALANCHE service (“AVALANCHE”). Legal entity details are in the Legal details section at the bottom of this page.

1.3. By using the Service, registering an account, or paying for a subscription, you acknowledge this Policy to the extent permitted by mandatory law. Access to the Service is governed by the Terms of Service.

1.4. Privacy inquiries: support@avalanche.vu (from the email address registered on the account).

2. Scope

2.1. This Policy applies to processing in connection with operating the Service, support requests, and service-related notifications.

2.2. It does not govern third-party resources (payment provider pages, app stores, external websites), even when linked from the Service.

3. Categories of data processed

3.1. Account data: email address; password hash (plain passwords are not stored); interface language; display name if provided.

3.2. Billing and subscription data: amount, date, status, and payment method; plan and billing period; renewal history; internal balance transactions where used; transaction identifiers and masked data from the payment processor. Full card numbers and CVV are processed by the payment provider only.

3.3. VPN and plan-related data: number of registered devices/access keys; aggregate traffic volume per account (for plan metering); data required for client authentication and abuse prevention (including success/failure of authentication), without logging visited internet resources or storing traffic contents.

3.4. Support: message content, email, attachments, and other information you voluntarily provide.

3.5. Website/dashboard: cookies and localStorage for sessions and settings. No third-party advertising or behavioral trackers on the Service website.

3.6. De-identified site analytics: aggregated or de-identified page events and UTM parameters when present. Processed on our infrastructure, not shared with ad networks, without third-party ad/analytics SDKs on site pages.

4. VPN traffic principles

4.1. We do not monitor, record, or store the contents of user internet traffic passing through the VPN, including visited URLs, DNS queries, or connection payloads, for profiling or disclosure to third parties.

4.2. Traffic and device metering (section 3.3) is used solely to perform the contract (access, plan limits, abuse prevention) and does not substitute for browsing activity logs.

4.3. We do not sell personal data or share it for marketing purposes.

5. Purposes and legal bases

5.1. Processing purposes include: providing the Service (registration, authentication, VPN access, subscription administration); payments, refunds, and balance; service emails (verification, billing, subscription status); support; security and abuse prevention; de-identified site analytics; legal compliance.

5.2. Legal bases include, as applicable: contract performance; legitimate interests in security and site improvement, balanced against user rights; consent where required; legal obligations.

6. Recipients and international processing

6.1. We share data only as needed with payment processors, hosting/cloud/network providers, and transactional email services.

6.2. They process data on our instructions under contract and may not use it for their own purposes except as required by law.

6.3. Processing may occur outside the Kyrgyz Republic; we apply safeguards appropriate to the data involved.

6.4. Disclosure to authorities occurs when legally required and properly requested.

7. Retention

7.1. Account and subscription data: while the account is active.

7.2. Support correspondence: up to three years from the last ticket unless longer retention is required for disputes or law.

7.3. Payment records: as required by law and accounting rules.

7.4. De-identified analytics: up to twenty-four months.

7.5. On account deletion, personal data is deleted or anonymized within thirty calendar days except where retention is mandatory (including payment records).

8. Your rights

8.1. You may request access, correction, restriction, or deletion where applicable, and withdraw consent where processing is consent-based.

8.2. Contact support@avalanche.vu from your registered email. We respond within thirty calendar days unless mandatory law requires otherwise.

9. Security

9.1. Website/dashboard traffic uses TLS. Passwords are stored as cryptographic hashes. Staff access is limited. We apply organizational and technical measures appropriate to the data. Absolute security cannot be guaranteed.

10. Minors

10.1. The Service is intended for users aged eighteen (18) and older. We do not knowingly collect data from minors; contact us to request deletion if applicable.

11. Policy changes

11.1. The current Policy is published on the site with the revision date. Material changes may be notified via dashboard or email.