Privacy Policy

The controller of your personal data is Ravaiq Ltd., registration number HE485497, Soliou 2, 8560 Peyia, Cyprus (trading as “ARC Proxies”, “we”).

For any privacy question, or to exercise the rights in Section 8, write to contact@arcproxies.io. Please use email for data-protection requests so that both of us have a record.

Data you give us when you register:

• Your email address. This is your account identifier — we cannot run an account without it.
• Your name, if you choose to provide one. It is optional.
• Your password, which we store only as a salted hash. We never see it in plain text.

If you sign in with Google or Discord:

• We receive your email address and basic profile information from that provider in order to create or match your account. We do not receive your password, and we do not post anything on your behalf.

When you buy bandwidth:

• Your order: the plan, the number of gigabytes, the amount, the currency, the status, and the date.
• Identifiers issued by Stripe: a customer id, a checkout session id and a payment id, which let us match a payment to your account.
• Whether you have redeemed a one-time discount code, so it cannot be used twice.

We do not receive or store your card number or CVC.

Payments are handled entirely by Stripe on their own systems. We see the identifiers above and the outcome of the payment.

When you pay by card:

• Stripe keeps the card on your customer record with Stripe for 30 days after your most recent purchase, so that you can buy again in one click. Every purchase restarts the 30 days; after that we have Stripe delete it, unless it pays a subscription that is still running, in which case it stays until that subscription ends.
• From Stripe we read the card's brand, its last four digits and its expiry date, to show you which card a one-click purchase will use. We never see the full number.

When you use the Services:

• Your proxy credentials — the username, and the password, which is encrypted at rest in our database so that we can show you your connection string.
• Your bandwidth balance: how many gigabytes you bought, used and have left.
• A time series of your bandwidth consumption, so the dashboard can chart your usage.
• For dedicated static IPs, the endpoint details of the IPs allocated to you (address, port, country, network).

If you link Discord or change your notification settings:

• Your Discord user ID and username, so that our bot can send you the messages you asked for.
• Your settings: whether low-balance alerts are on and at what threshold, and whether you want to receive offers.
• A record of each message our bot sent you: what kind it was, when, and whether Discord delivered it. This lets us see what you were told, and stop writing to someone who has blocked us.

Your marketing choices:

• Whether you agreed to receive offers, and when you withdrew that consent or objected to our marketing.

• To provide the Services (Art. 6(1)(b) GDPR — performance of a contract). Creating your account, taking payment, provisioning your proxy credentials, crediting your bandwidth, showing you your balance and usage. Without this data we cannot deliver what you paid for.
• To comply with the law (Art. 6(1)(c)). Keeping records of transactions for tax and accounting purposes, and responding to lawful requests from competent authorities.
• To protect the Services (Art. 6(1)(f) — legitimate interests). Preventing fraud, chargeback abuse, duplicate-account discount abuse, and detecting use that violates our Acceptable Use policy. Our interest is in operating a network that is not used for crime; we consider this not to override your rights, and you may object under Section 8.
• To answer you (Art. 6(1)(b) or (f)). Handling your support requests.
• To keep your card for your next purchase (Art. 6(1)(f) — legitimate interests). Keeping your card for 30 days after a purchase lets you buy again in one click — in the dashboard or from a Discord alert — without entering it. Our interest, and we think yours, is a quick top-up when you run low; the period is short and ends by itself. You can object at any time by removing the card in the billing portal (Billing → Manage in the dashboard). Each one-click purchase you confirm is a contract like any other (Art. 6(1)(b)). So that a saved card cannot be charged over and over by someone else, we cap one-click purchases per order and per 24 hours and alert our staff when the daily cap is reached (Art. 6(1)(f) — preventing fraud, in your interest as much as ours).
• To send you offers you asked for (Art. 6(1)(a) — consent). Offers, discount codes and news about our products, by Discord direct message or by email — only if you switched this on. You can withdraw at any time in the same place, and every offer email has a link to stop them.
• To email customers about similar products (Art. 6(1)(f), under the rule for existing customers in Art. 13(2) of the ePrivacy Directive as it applies in Cyprus). If you bought from us, we may email you about our own proxy products that are similar to what you bought, without asking first. We tell you about this when you buy, and every such email has a link to stop them; one click is enough and costs you nothing. We never use this for anyone else’s products.
• To choose which offer fits you (Art. 6(1)(f) — legitimate interests). Rather than send everyone the same message, we sort customers into groups using data we already hold: what you bought and when, which plan you use, which codes you redeemed, how much bandwidth you have left and how fast you use it, which of our sites you signed up on, and whether Discord is linked. Someone about to run out may get a top-up offer; someone who has only ever bought one plan may hear about another. We do not use your proxy traffic for this (we do not have it — see Section 4), what you told us when requesting access to a private plan, or analytics data. An offer may include a discount; it never raises the regular price for you, and no grouping leads to a decision with legal or similarly significant effect on you (Art. 22). You can object at any time and we will stop (Section 8).
• To measure how the site is used (Art. 6(1)(a) — consent). Analytics cookies, and only if you allow it. You can withdraw at any time. Section 10 sets out exactly what the analytics tag does before and after you answer, because the two differ.
• To measure our ads in ChatGPT (Art. 6(1)(a) — consent). Only if you allow it: OpenAI’s measurement pixel tells us whether a visit, a sign-up or a purchase followed a click on one of our ads. Unlike the analytics tag it is not loaded at all until you agree. Section 10 says what it does.
• To count page views before you answer the banner (Art. 6(1)(f) — legitimate interests). Until you answer, the analytics tag sends Google one request per page you open, carrying the page address, the page that referred you, your IP address, and an identifier that is regenerated on every single page load. Our interest is in seeing which pages work at all, which we cannot learn from only the people who say yes. Against that: nothing is written to your device — no cookies, no local storage — and because that identifier does not survive a page load, this cannot be used to recognise you, to follow you from one page to the next, or to build a profile. It is never combined with your account. We consider this not to override your rights, and you may object under Section 8.

We advertise only our own products, and only to you directly, in the ways listed above. We do not use your account data to show you ads on other websites, we do not sell your data, we do not give it to anyone for their own advertising, and we never use your proxy traffic for marketing. The only other advertising use is measuring our own ads in ChatGPT, described above, and only with your consent.

We do not log the content of your traffic, the websites you connect to, or the requests you make.

Our systems record how many gigabytes you have consumed. They do not record what those gigabytes contained, where they went, or when you visited a particular destination. There is no browsing history attached to your account, because we never create one.

We also do not record your own IP address or browser user-agent in the application when you use the dashboard.

Two honest caveats, because a privacy policy that overclaims is worse than useless:

• Our servers keep short-lived technical logs. Like any web service, our hosting and infrastructure keep standard server logs, which can include the IP address a request came from, for security and abuse prevention. They are kept only as long as that purpose requires and are not used to build a picture of what you do on the network.
• The network layer is not ours. The proxy network is operated by an upstream provider (Section 5). What happens inside their infrastructure is outside our systems and outside our knowledge. Their published policy states that they monitor the volume of data transferred, keep short-term operational metrics for a maximum of six hours before deleting them, and keep no logs of user activity beyond that. They also state that they do not control the exit IP addresses and cannot link them to individual users.

We share your data only with the parties we need in order to run the Services. Each is bound by a contract that limits what they may do with it.

• Stripe (Stripe Payments Europe, Ltd., Ireland) — to take and manage your payment, and to keep your card if you choose to save it. Stripe is a controller in its own right for parts of this; see stripe.com/privacy.
• Our upstream network provider — to provision the proxy account and bandwidth that you use. We pass the minimum needed to create and top up your account on their platform, under a data processing agreement that limits what they may do with it.
• Google and Discord — only if you choose to sign in with or link them: to authenticate you, and for Discord also to deliver the messages our bot sends you (the alerts you switch on and, if you agreed, offers). Discord handles those messages under its own privacy policy.
• An email delivery provider — to send our emails, including offers where Section 3 allows them. It acts on our instructions only, under a data processing agreement.
• Google Analytics (Google Ireland Limited) — to measure how the site and dashboard are used. See Section 10, and policies.google.com/privacy.
• OpenAI — only if you agree to the cookies banner, to measure whether visits and purchases followed a click on our ads in ChatGPT. See Section 10, and openai.com/policies/privacy-policy.
• Our hosting and infrastructure providers — to run the servers the Services depend on. They act on our instructions only and may not use your data for their own purposes.
• Competent authorities — where we are legally required to disclose, or where we report activity of the kind described in our Terms of Service.

We are established in Cyprus and prefer to keep data within the EU/EEA. Where a provider processes data outside the EEA, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

Discord is based in the United States, so the messages our bot sends you, and your Discord user ID, are processed there under those safeguards. The same applies to our email delivery provider if it processes data outside the EEA.

If you would like details of the safeguards that apply to a specific transfer, write to us at the address in Section 1 and we will provide them.

• Account data — for as long as your account exists. If you close it, we delete or anonymise your data, except where we must keep it (see below).
• Orders and invoices — retained for as long as Cypriot tax and accounting law requires us to keep them, even after you close your account. We cannot delete these on request; the law requires us to keep them. Once that period has run, we delete them.
• Detailed usage records — raw usage measurements are condensed into daily totals after 30 days, and the detailed rows are deleted. The daily totals remain while your account is open so that your usage history stays meaningful.
• Proxy credentials — deleted when the corresponding account is closed.
• A saved card — kept by Stripe for 30 days after your most recent purchase, longer only while it pays a running subscription, or until you remove it sooner.
• Your settings — for as long as your account exists.
• The record of our bot’s messages — 90 days.
• Marketing choices — a consent for as long as it applies, and afterwards for as long as we may need to show that we had it. If you object or unsubscribe, we keep your address on a do-not-contact list, because that is the only way to make sure we do not write to you again.
• Records of a violation — where we terminated an account for abuse, we keep a minimal record for as long as necessary to defend a legal claim or to prevent the person from returning.

Under the GDPR you have the right to:

• ask us for a copy of the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data deleted (Art. 17), except where we are legally required to keep it — invoices being the usual case;
• have processing restricted (Art. 18);
• receive your data in a portable, machine-readable format (Art. 20);
• object to processing we base on legitimate interests (Art. 21) — including our fraud and abuse prevention, which we will then reassess for your case;
• object at any time to the use of your data for direct marketing, including the grouping described in Section 3 (Art. 21(2)) — we then stop, without weighing anything up;
• withdraw a consent you gave us at any time, without affecting what we did before you withdrew it (Art. 7(3)).

Write to contact@arcproxies.io and we will respond within one month. We do not charge for this.

To stop offers you do not need to write to us: use the link in any offer email, or withdraw where you agreed to them.

If you think we have handled your data unlawfully, you may complain to a supervisory authority — for us, the Office of the Commissioner for Personal Data Protection in Cyprus, or the authority in the EU country where you live. We would rather you came to us first, but it is your right either way.

• Passwords are stored as salted hashes, never in plain text.
• Your proxy password is encrypted at rest in our database.
• Card data never touches our servers; Stripe handles it.
• Access to production data is limited to the people who need it to operate the Services.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, we will tell you directly.

The marketing site and the dashboard both run Google Analytics 4, and we want to be exact about what that means before and after you answer the banner, because it is not the same thing.

Before you agree, the Google tag is loaded but runs in a cookieless mode. It writes nothing to your device — no cookies, no local storage — and the identifier it sends is regenerated on every page load, so it cannot recognise you or follow you from one page to the next. It does send Google a request for each page you open, and that request carries the page address, the page that sent you to us, and your IP address, from which an approximate location is derived. We do this to keep aggregate measurement of how the site performs; the legal basis is in Section 3 and you may object.

If you agree, it additionally sets cookies in your browser, which is what lets us tell a returning visitor from a new one and follow a journey across pages. We use this to see which pages bring in customers. Either way we do not use it to build advertising profiles or to target ads — the advertising features of the tag are switched off unconditionally — and we never send it your name, email address or account id.

The OpenAI Ads pixel works differently: it is not loaded at all until you agree, so before that nothing is sent to OpenAI. If you agree, it loads from OpenAI’s servers, which therefore receive your IP address; it sets two cookies, __oppref, which remembers for 30 days the ad click that brought you here, and __obref, a random browser reference kept for 365 days; and it reports each page you view with its address. We use this only to see whether visits, sign-ups and purchases followed a click on one of our ads in ChatGPT. We do not pass it your name, email address or account id, but OpenAI’s pixel can detect contact details such as an email address on the pages you use, and sends them to OpenAI only as a one-way hash.

If you agree and then buy something, our server also tells OpenAI about that purchase once the payment is confirmed, so that it still counts if you close the page after paying. It sends the order reference, the order’s value without VAT, the time, and the two cookie values above, which is how OpenAI matches it to the ad; it does not send your name, email address or account id. We keep the two cookie values with your order only until OpenAI has received that report. If you do not agree, nothing about your purchase is sent to OpenAI.

You can change your mind at any time, and it takes one click: Cookie settings at the bottom of this site, or in the dashboard sidebar. Withdrawing deletes the analytics cookies already set, returns the Google tag to the cookieless mode described above, and stops the OpenAI pixel and deletes its two cookies. Refusing or withdrawing costs you no functionality. We ask again after six months in any case.

We store your light/dark theme preference in your browser’s local storage, which never leaves your device.

The dashboard also uses cookies and local storage that are strictly necessary to keep you signed in, plus one cookie that remembers your answer to the question above. Those do not require consent, because the service does not work without them.

The Services are not for anyone under 18. We do not knowingly collect data from children. If we learn that we have, we delete it.

If we change how we handle your data, we will update this page and the date at the top. Where a change materially affects you, we will tell you by email before it takes effect.