Privacy Policy
Last updated: September 11, 2026
VPN Nepal ("vpnnepal.com", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our VPN service. We adhere to EU GDPR standards to provide you with world-class data protection.
1Information We Collect
Account Information
When you create an account, we collect:
- - Email address (required for account creation and communication)
- - Password (stored as a secure hash, never in plain text)
- - Full name (optional, for personalization)
- - Phone number (required to verify free and demo accounts by SMS; optional on paid plans, for 2FA and account recovery)
Payment Information
When you subscribe to a paid plan:
- - Payment method type (Khalti, eSewa, or Card)
- - Transaction ID and date
- - Subscription plan and billing cycle
Note: Full payment details (card numbers, bank accounts) are processed and stored by our payment partners (Stripe, Khalti, eSewa) and never stored on our servers.
Technical Information
For service operation, abuse prevention, security, and troubleshooting:
- - Device type and operating system (for app compatibility)
- - App version
- - Assigned VPN IP address, VPN node, device, and issued configuration
- - WireGuard peer endpoint seen by the node, latest handshake, and connection timestamps
- - Bandwidth counters and byte deltas reported by WireGuard
- - Security/audit events such as unknown peers, node sync reports, and abuse-prevention actions
- - Browser proxy demo mode abuse metadata as described in Section 8
2What We DO NOT Collect (No Activity Logs)
For full VPN app connections, we maintain a strict no-browsing-activity-logs policy. Except for limited VPN connection metadata described in Section 1 and browser proxy/demo mode abuse metadata described in Section 8, we DO NOT collect, store, or monitor:
- Your browsing history or websites visited
- The websites, apps, or services you access while connected
- DNS queries
- Traffic content or data transmitted through the VPN
This means we do not inspect or store traffic content, request bodies, cookies, headers, decrypted HTTPS content, or full browsing history.
We do keep the limited connection metadata listed in Section 1, including connection timestamps, to run the service, enforce plan limits and answer abuse reports. It shows that a device connected, never what you did while connected.
3How We Use Your Information
We use the information we collect to:
- Provide and maintain the VPN service
- Process your subscription and payments
- Send important service notifications (outages, security alerts)
- Respond to your support requests
- Improve our service based on aggregate usage patterns
- Prevent abuse and enforce our Terms of Service
4Data Sharing & Third Parties
We do not sell, trade, or rent your personal information. We may share limited data with:
Our VPN commitment: we do not sell, use, or disclose to any third party the data described in Section 1 that our VPN service handles — the connection metadata, the addresses assigned to your device, or anything about your use of the tunnel — for any purpose. We use it only to run the service, enforce the limits of your plan and answer abuse reports, and we disclose it only where the law requires it, as set out below.
Payment Processors
Stripe, Khalti, and eSewa process your payments. They have their own privacy policies governing the handling of your payment information.
Service Providers
We run our own mail servers, so your email address is not handed to a third-party email provider. Third parties we do rely on: the payment providers you choose at checkout (Khalti, eSewa), the mobile network that carries an SMS when we send you a verification code, and the data centres our servers run in. Each receives only the minimum data needed to do that job.
Legal Requirements
We may disclose account information and, where browser proxy or demo mode was used, the limited abuse-prevention metadata described in Section 8 if required by law, valid court order, or to protect the rights and safety of VPN Nepal and others. See our Terms of Service for details on cooperation with legal authorities.
5Data Security
We implement robust security measures including:
- AES-256 encryption for all VPN traffic
- Secure password hashing (bcrypt)
- HTTPS for all web communications
- Two-factor authentication (2FA) option
- Regular security audits and updates
- EU-compliant data centers with physical security
While we take all reasonable precautions, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any breaches affecting your personal data as required by law.
6Your Rights (GDPR)
Under GDPR and our commitment to privacy, you have the right to:
Access
Request a copy of your personal data we hold
Rectification
Correct inaccurate or incomplete data
Erasure
Request deletion of your data ("right to be forgotten")
Portability
Receive your data in a portable format
Objection
Object to certain processing of your data
Withdraw Consent
Withdraw consent for marketing communications
To exercise these rights, contact us at privacy@vpnnepal.com. We will respond within 30 days as required by GDPR.
7Data Retention
- Active accounts: Data retained while your account is active
- Deleted accounts: Personal data deleted within 30 days of account closure
- Payment records: Retained for 7 years for tax/legal compliance
- Support tickets: Retained for 2 years, then anonymized
- Full VPN connection metadata: Raw WireGuard runtime samples are kept short term for abuse prevention and troubleshooting, with longer-lived hourly rollups and security audit events kept only as needed for security, legal compliance, dispute handling, and service integrity
- Browser proxy abuse metadata: Retained only as long as needed for abuse prevention, security, legal compliance, and dispute handling, then deleted or anonymized
8Browser Proxy & Demo Mode Abuse Prevention
VPN Nepal may offer browser proxy or demo access for users who do not install the full native VPN app. This mode is different from full WireGuard VPN app connections because each browser proxy session uses a short-lived authenticated proxy credential issued by our control plane.
To prevent abuse, enforce device/session limits, respond to security incidents, and identify which customer account used a shared proxy egress IP at a specific time, we may collect limited browser proxy metadata:
- Account/session identifiers: account ID, device ID, proxy session ID, extension ID, node ID, and proxy username
- Network attribution: source IP seen by our service, proxy node, public egress IP, destination host or IP, destination port, protocol, timestamps, and byte counts
- Security events: denied requests, expired sessions, rate-limit events, and abuse-prevention actions
We do not log request bodies, cookies, authentication headers, decrypted HTTPS content, or the content of pages you visit. Browser proxy metadata is used for abuse prevention, security, legal compliance, and service integrity, not advertising or sale to third parties.
9Cookies & Tracking
Our website uses minimal cookies for:
- Essential cookies: Required for login and site functionality
- Preference cookies: Remember your settings (theme, language)
Our website does not use third-party tracking cookies, advertising cookies, or analytics that track individual users. You can disable cookies in your browser settings, but some features may not work properly.
10Children's Privacy
VPN Nepal is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately. If you believe a child has provided us with their data, please contact us.
11Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12Contact Us
For privacy-related questions or to exercise your data rights:
Email: privacy@vpnnepal.com
Legal: legal@vpnnepal.com
Address: Kathmandu, Nepal
13Deleting Your Account
You can ask us to delete your VPN Nepal account and the personal data we hold about you at any time. Your personal data is deleted within 30 days of your account being closed; payment and invoice records are kept for 7 years, as tax and accounting law requires.
How to delete your account