MIR VPN Privacy Policy

1. Scope and principles

This Policy applies to mirvpn.net, the official @mirvpn_net_bot Telegram bot, MIR VPN applications for supported platforms, and support requests. It does not govern Telegram, payment providers, app stores, operating systems, or websites you visit when they process data independently.

MIR VPN processes only the data needed to provide and protect the service, perform the contract, process payments, provide support, and comply with law. Data is not sold, shared for third-party advertising, or used to create advertising profiles.

2. Data processed

• Account: a protected technical Telegram identifier, language, internal account reference, and creation and last-activity timestamps.
• Subscription and payments: selected plan, price, currency, term, subscription status, transaction reference, refund information, and data required for receipts and accounting. MIR VPN does not receive or store full card numbers, CVC/CVV codes, or bank passwords.
• Free access: the one-time grant record for the protected Telegram identifier, preparation state, owner repeat-grant number, technical free-access reference, and expiry. These records prevent duplicate grants and charges.
• Device and access: a random installation identifier, device label, platform, app version, public cryptographic keys, installation status, and access status. Private keys remain on the device.
• Security and diagnostics: connection time and outcome, app version, selected route country, error code, and limited service events. Diagnostics are sent only after a separate user action or consent.
• Support: messages and replies, information voluntarily attached by the user, language, ticket reference, and delivery status.
• Website: the selected language in the functional mir_lang cookie and request data needed to deliver the page and protect it from attacks.

3. Data not recorded

MIR VPN does not log internet traffic contents, pages visited, or user DNS queries, and does not associate such information with an account. The service does not request contacts, files, messages from other apps, passwords, device serial numbers, Wi-Fi SSID/BSSID, or precise location.

A VPN changes the path of data transmission but does not override the logs or rules of third-party websites, apps, internet providers, or payment systems.

4. Purposes and legal grounds

• Account creation, access provisioning, multi-device subscriptions, and support: steps requested by the user and performance of a contract.
• Payments, refunds, receipts, accounting, and tax records: contract performance and compliance with legal obligations.
• Abuse prevention, user and infrastructure protection, and fault investigation: the controller's legitimate interests where not overridden by user rights, or compliance with data-security duties.
• Optional diagnostics and other processing requiring consent: separate informed consent, withdrawable for future processing.
• Responses to lawful court or government requests: compliance with a legal obligation. MIR VPN does not disclose data in response to informal or legally non-binding requests.

5. Processing operations

Processing may include collection, recording, organization, storage, updating, retrieval, use, disclosure to an authorized processor, restriction, erasure, and destruction, by automated or non-automated means. MIR VPN does not make decisions producing legal effects for a user solely through automated profiling.

6. Recipients, processors, and other countries

To the extent necessary, data may be processed by hosting and network infrastructure providers, Telegram for bot operation, the selected payment provider for charges and refunds, and a support model provider solely to answer a support request. The current payment provider and its terms are displayed before payment.

Initial collection of Russian citizens' personal data follows applicable localization rules. Cross-border transfers take place only with a lawful basis and after required procedures. Do not send passport data, bank details, private keys, passwords, or other secrets to support.

7. Retention and deletion

At the end of a retention period, data is erased, destroyed, or irreversibly anonymized. Backups leave active use through their secure overwrite cycle.

• Functional language cookie: up to 12 months or until deleted by the user.
• Voluntary diagnostic reports and route observations: no more than 72 hours.
• Support correspondence: up to 30 days after the last ticket action, unless a dispute or law requires longer retention.
• Account, subscription, and device data: while the account or subscription obligations remain active, then up to 3 years for claims; revoked access keys and secrets are restricted or destroyed sooner when no longer needed.
• Payment, receipt, and accounting records: for the period required by applicable tax, accounting, and other law, generally at least 5 years after the relevant reporting period.
• Security records and consent evidence: up to 3 years unless an incident, dispute, or law requires longer retention.

8. Data security

Safeguards include access controls, secret encryption, administrator audit records, component isolation, backups, software updates, and release integrity checks. No transmission or storage method removes all risk, and MIR VPN does not promise absolute security.

9. Your rights

You may request information about processing, correction, restriction, or erasure where legally available, object to processing, withdraw consent for the future, and complain to a competent regulator or court. Processing needed to perform an active contract or legal duty may continue without consent to the extent allowed by law.

Send requests through official support at @mirvpn_net_bot. To protect the account, the controller may request reasonable proof of identity and connection to the account. Responses and actions follow the deadlines required by applicable law.

10. Minors

The service is not intended for independent purchase by a person who cannot legally enter the paid contract without a representative. If the controller learns that a child's data was obtained unlawfully, it will erase the data or bring the processing into compliance with law.

11. Changes and contact

A new version is published on this page with its effective date. Material changes do not retroactively remove accrued rights. Privacy questions, data-subject requests, and incident reports are accepted through official Telegram support at @mirvpn_net_bot.