What we collect, why, who we share it with, and how to get it deleted. In plain language, under the GDPR.
Per Art. 4 (7) GDPR, the data controller for personal data processed via HProxy is:
When you sign up, we collect your email address and (if you choose Google sign-in) your Google profile basics. We do not require a name, phone number, or physical address to open an account.
Card details are never stored on our servers. They flow directly to our PCI-DSS Level 1 payment processor. We retain only the transaction reference and the last 4 digits for invoicing and chargeback handling.
When you route through our proxy infrastructure we log: timestamp, target hostname, bytes transferred, and response code. We do NOT log request bodies, response bodies, or full URL paths. Logs are retained 30 days for billing reconciliation and abuse investigation.
When you route traffic through our proxy infrastructure, we process Verkehrsdaten within the meaning of §9 (1) TKG (destination host, timestamp, bytes, status code). We retain this for 30 days strictly for: (a) billing reconciliation (§9 (3) TKG) and (b) detection of abuse, fraud, and system disruption (§10 (3) TKG). After 30 days we permanently delete or anonymise the data. We do not process traffic contents (request bodies, response bodies, full URL paths) and we do not retain them in any form.
Your IP when connecting to our infrastructure is logged for authentication, abuse prevention, and fraud monitoring; legal basis Art. 6 (1) (f) GDPR legitimate interest. Retained 30 days, then deleted.
Emails, chat messages, and ticket history sent to support@ or legal@. Retained 24 months for service quality and legal-hold purposes.
We process personal data under the following legal bases per Art. 6 GDPR:
Account data is retained for the lifetime of your account plus 6 months after deletion. Billing records are retained 10 years (HGB §257). Usage logs are retained 30 days. Support correspondence is retained 24 months. Beyond these windows, data is securely erased or anonymised for aggregate metrics.
We use a small number of sub-processors to run the service. Each is bound by a Data Processing Agreement (Art. 28 GDPR). We do NOT sell your data to third parties under any circumstance.
We use PostHog for product analytics and session replay, hosted on PostHog’s EU Cloud (Frankfurt) so your data stays within the EU/EEA. PostHog runs only after you opt in via the analytics cookie category; with analytics consent off, it is not loaded and sets no cookies. PostHog acts as a sub-processor under a Data Processing Agreement (Art. 28 GDPR). See PostHog’s published DPA.
Where a sub-processor is based outside the EU/EEA, transfers occur under Standard Contractual Clauses (SCC) per Art. 46 GDPR, with a transfer impact assessment where required. The full sub-processor list and DPAs are available from [email protected] on request.
You have the following rights regarding personal data we hold about you:
Email [email protected] from the address on your account. We respond within 30 days per Art. 12 (3) GDPR. No fee for routine requests.
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For HProxy, the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
We use automated risk scoring to decide whether to auto-fulfill, hold for manual review, or decline an order. The scoring considers: order velocity, card-BIN diversity per user, IP velocity, payment-attempt patterns. If your order is held, a human reviews it before any final decision. You have the right under Art. 22 (3) GDPR to (a) obtain human intervention, (b) express your point of view, (c) contest the decision. Email [email protected] to invoke any of these.
HProxy is not directed to children. We do not knowingly collect personal data from children under 16 (Art. 8 GDPR). If you become aware that a child has provided us personal data, contact [email protected] and we will delete it.
We use a small number of cookies for session authentication, fraud prevention, and (with your consent) anonymous analytics. The full breakdown of categories and durations is on our cookies page.
Read the cookie policy