App privacy policy

Version of 7 November 2026. Applies to the CatsVPN mobile app, and to the CatsVPN Telegram bot and website through which the subscription is purchased and managed.

This Privacy Policy (the “Policy”) sets out how we process and protect the personal data of users of the CatsVPN VPN service, provided through the CatsVPN mobile app for Android and iOS (including Android TV and Apple TV), the Telegram bot https://t.me/CatsVPN_robot and the website https://catsvpn.net (the “Service”).

This Policy takes into account applicable personal data protection law and the Google Play and App Store requirements for apps that provide VPN services.

1. General provisions

1.1.This Policy applies to information that ZAVOZ SOLUTIONS LTD (the “Operator”, “we”, “us”) receives when you register for and use the Service, including the CatsVPN mobile app.

1.2.We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation and storage limitation.

1.3.By using the Service, you confirm that you have read this Policy.

1.4.Before it first contacts our server, the mobile app shows a “Before you start” screen describing the data it processes, and starts working only after you tap “Accept and continue”. If you do not give your consent, the app sends no data to the server.

1.5.In any other case where your consent is required to process personal data, it is obtained in a form that allows us to confirm that it was given.

2. Data controller

The controller of your personal data is:

ZAVOZ SOLUTIONS LTD

Address: 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom

D-U-N-S® Number: 235300792

Email for personal data enquiries: privacy@catsvpn.net

Telegram: https://t.me/CatsVPN_robot

3. What data may be processed

We may process the following categories of data.

3.1. Telegram data

When you use the Telegram bot, the following may be processed:

• your Telegram ID;
• your username;
• the name shown in your Telegram profile;
• your interface language;
• other information that Telegram technically transmits when you interact with the bot.

We never ask for your Telegram account password.

3.2. Subscription data

The following may be processed:

• the plan you selected;
• the date your subscription was purchased;
• the subscription term;
• the payment status;
• the payment ID;
• information about refunds;
• the transaction history needed to account for payments and perform the contract.

3.3. Payment data

When you pay for the Service, you may be redirected to a third-party payment service.

Bank details and payment card data are processed by the relevant payment provider, unless the payment interface expressly states otherwise.

We do not store your full payment card details, unless the infrastructure of the payment provider used requires otherwise.

The mobile app does not accept payments and does not process payment data: the subscription is paid for in the Telegram bot or on the website.

3.4. Connection and technical data

When you connect to a VPN server and use the Service, the following is processed:

• your IP address;
• the date and time of connection;
• the VPN session ID and information about the VPN server;
• the protocol used and technical connection parameters;
• the amount of traffic transferred, to count it against your plan’s limit;
• information about your actions in the Telegram mini app interface (which screens were opened and which buttons were tapped), under a pseudonym;
• data about errors and failures on the Service’s servers.

Retention periods for this data are set out in section 9.

3.5. VPN traffic data

We do not record or store the content of your internet traffic, the sites you visit, your DNS queries or the content of the data you transmit.

3.6. The CatsVPN mobile app

The CatsVPN mobile app for Android and iOS (including Android TV and Apple TV) processes:

• the access code you enter to sign in, which links the app to your subscription;
• an app-specific device identifier (Android ID on Android, identifier for vendor on iOS), the device name and model, the operating system version and the app version. This data is used to sign you in, manage the devices on your subscription and prevent abuse; it is how the device appears in your device list in the bot and on the website, where you can disconnect it. On iOS the identifier is kept in the device keychain so that reinstalling the app does not take up another device slot on your subscription;
• the result of an app integrity check via Google Play Integrity or Apple App Attest, so that modified copies of the app cannot connect to our server;
• on Android, the list of installed apps, so that you can choose which apps bypass the VPN. This list never leaves your device and is not sent to us.

The app contains no ads, third-party analytics, tracking or crash reporting, and uses no cookies or advertising identifiers.

Before it first contacts our server, the app shows a screen describing this data and starts working only after you agree (clause 1.4).

4. Purposes of processing

We process personal data for the following purposes:

• to register you with the Service and sign you in to the mobile app;
• to provide access to the VPN;
• to manage your subscription and the devices connected to it;
• to process and account for payments;
• to provide technical support;
• to identify you within the Service;
• to keep the Service secure;
• to prevent abuse and violations;
• to diagnose technical faults;
• to analyse how the Telegram mini app is used in order to improve how it works and its interface (no such analysis is carried out in the mobile app);
• to perform our contract with you;
• to comply with obligations under applicable law;
• to handle requests and complaints;
• to protect the rights and legitimate interests of the Operator and third parties.

5. Legal bases for processing

We process personal data only where we have a legal basis for doing so under applicable law.

Depending on the specific purpose, these bases may include:

• entering into and performing a contract with you;
• complying with obligations established by law;
• your consent;
• the legitimate interests of the Operator or a third party, provided that your rights and legitimate interests are respected;
• other bases provided for by applicable law.

6. Use of Telegram

6.1.The subscription is purchased and managed through the Telegram bot; the mobile app connects to it using the access code.

6.2.When you interact with the Telegram bot, some information is processed directly by Telegram in accordance with Telegram’s own terms and policies.

6.3.We do not control the rules Telegram applies to information it processes directly.

7. Disclosure of personal data to third parties

7.1.We do not sell personal data and do not disclose it to third parties — neither data from the mobile app nor data about your VPN traffic — and we do not use it for advertising, profiling or any purpose other than providing the Service.

7.2.To run the Service we use processors: hosting providers and data centres that host our VPN servers and the Service’s servers. They process data only on our instructions, only as far as their task requires, and must protect it at least as well as this Policy describes.

7.3.Telegram (to run the bot), payment providers (to process a payment by the method you choose) and the Google Play and App Store app stores (to install and update the app) receive only the data needed for the action you have chosen, and process it in accordance with their own privacy policies.

7.4.We may disclose data to a public authority only when we are legally required to do so. We do not store the content of your traffic, the sites you visit or your DNS queries, so we cannot disclose them.

8. International data transfers

8.1.Because we use international technical and payment services, personal data may be processed outside the country in which the Operator is registered.

8.2.Our VPN servers are located in the countries shown in the app’s server list; when you connect, your traffic goes to a server in the country you choose.

8.3.When transferring data internationally, we comply with the requirements of applicable law.

8.4.Where provided for by law, an international transfer may be based on your consent, the performance of a contract, an international treaty or another basis provided for by law.

9. Data retention

9.1.We keep personal data no longer than necessary for the purposes for which it is processed, unless a different period is set by law or by contract.

9.2.Retention periods:

• VPN connection. IP address and connection time on a VPN server — no more than 24 hours, for abuse prevention. Traffic volume — for the current subscription period, to count your limit. Traffic content, visited sites and DNS queries are never stored.
• Account and subscription. While the subscription is active; after it ends — until you ask us to delete your account, but no longer than 12 months of inactivity.
• Devices. Device identifier, name and model, operating system and app versions — while the device is on your subscription; no more than 30 days after you disconnect the device in the bot or on the website.
• Payments and refunds. Until the refund period ends and any possible dispute is resolved; after that, payment records are kept as accounting records for the period required by applicable law.
• Support requests. 90 days after the request is closed.
• Actions in the Telegram mini app interface. No more than 30 days, under a pseudonym.
• Claims and disputes. Until the limitation period expires, usually three years.

9.3.When the retention period ends, data is deleted or anonymised. Data is kept longer than these periods only where required by law or by a binding request from a public authority.

10. Protection of personal data

10.1.We take the necessary organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure, destruction and other unlawful actions.

10.2.These measures may include:

• restricting access for staff and contractors;
• using authentication;
• encrypting data in transit;
• backups;
• information security monitoring;
• keeping software up to date;
• other measures appropriate to the nature of the data processed.

10.3.We follow the principle of data protection by design when building our digital systems.

11. Your rights

You have the rights provided for by applicable law, including the right to receive information about the processing of your personal data.

In particular, you may request information about:

• the processing of your personal data;
• the purposes and legal bases of processing;
• where the data is processed;
• who has access to the data;
• how long the data is processed;
• your rights;
• the consequences of refusing the processing of data.

12. Withdrawing consent

12.1.Where we process personal data on the basis of your consent, you may withdraw that consent.

12.2.To withdraw consent given in the mobile app, sign out in the app and send a request to the contacts in section 17. Consent given in any other way is withdrawn by a request to our support bot https://t.me/CVPNSUPBOT or to privacy@catsvpn.net.

12.3.Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

12.4.If, after you withdraw consent, there is no other legal basis for processing, the relevant personal data is deleted in the cases and manner provided for by law.

13. Deleting your data

13.1.You may request the deletion of your personal data.

13.2.To delete your device data, sign out in the mobile app and disconnect the device in the bot or on the website; the device data is then deleted within the period set out in clause 9.2.

13.3.To delete your account and all related data, contact our support bot https://t.me/CVPNSUPBOT or privacy@catsvpn.net. We will delete it within 30 days, except data that the law requires us to keep longer; we will tell you about such data in our reply.

14. Children’s personal data

14.1.The Service is not intended for anyone under 13. We do not knowingly collect personal data of children without a basis provided for by law.

14.2.Where required by law, a child’s personal data is processed only with the consent of their legal representative.

15. Cookies and similar technologies

15.1.The Service’s website uses only cookies that are necessary for it to work: to keep you signed in to your account, remember your language, record a referral link and the source from which you came to the site. The website has no advertising cookies and no third-party analytics cookies.

15.2.The mobile app does not use cookies.

16. Changes to this Policy

16.1.We may change this Policy.

16.2.A new version takes effect when it is published, unless the new version states otherwise. The date of the current version is shown at the top of this Policy.

16.3.The current version of this Policy is available at https://catsvpn.net/en/app-privacy (in Russian: https://catsvpn.net/app-privacy).

17. Contact information

For questions about personal data, withdrawing consent or deleting your data, contact us by email at privacy@catsvpn.net or via our support bot https://t.me/CVPNSUPBOT. We reply within 30 days.

ZAVOZ SOLUTIONS LTD

Address: 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom

D-U-N-S® Number: 235300792

Telegram: https://t.me/CatsVPN_robot