Privacy Policy

What personal data AeonProxy collects, why we use it, who receives it, how long we keep it and how to use your privacy rights.

Last updated: October 22, 2026

1. Who we are and how to contact us

Company details will be published here after registration. In this policy, "AeonProxy", "we", "us" and "our" mean AeonProxy. "You" means anyone whose personal data we process: customers, visitors to our website and people who contact us.

We are the controller of the personal data described in this policy. This means we decide why and how it is used.

Email: [email protected]

2. What this policy covers

This policy applies to personal data we process when you:

visit aeonproxy.com;
create and use an account (your "Account") and our customer dashboard (the "Dashboard"), including API keys and sub-users;
use our proxies through our gateway, gate.aeonproxy.com, which is located in Frankfurt, Germany;
contact us through the live chat on our site, by email, through our Telegram support bot @aeonproxysup_bot or our Telegram channel @aeonproxy, or through our contact and partner forms;
take part in our trial, promotions or affiliate program.

Together we call these the "Services". The Services include residential and mobile proxies sold as prepaid traffic in GB ("Traffic") and ISP and Datacenter proxies sold per IP per month ("Dedicated IPs"). You pay from a prepaid balance on your Account (your "Balance"). Residential and mobile Traffic is carried through the networks of upstream providers that we call "Network Partners".

Our Cookie Policy explains how we use cookies and similar browser storage. This policy works together with our Terms of Service.

3. Data we collect

The table below shows each category of personal data, where it comes from, why we use it, our legal basis under GDPR and UK GDPR, and how long we keep it. The legal bases are:

Contract: we need the data to provide the Services you asked for (Article 6(1)(b)).
Legal obligation: the law requires us to process the data, for example tax, accounting or sanctions law (Article 6(1)(c)). Where that law is not EU or UK law, we rely on our legitimate interest in complying with it.
Legitimate interests: we need the data for our legitimate interests, and these are not overridden by your rights (Article 6(1)(f)). Our interests are keeping the Services secure, preventing fraud, abuse and repeat trials, enforcing our terms, answering people who contact us, understanding how our website is used and telling customers about similar services. You can object to this processing (section 8).
Consent: you agreed, and you can withdraw your consent at any time (Article 6(1)(a)).

Category	Examples	Source	Purpose	Legal basis	Retention
Account data	Email; password (stored only as a hash); Google account ID and email if you sign in with Google; your acceptance of the Terms and this policy; API keys, sub-users, settings	You; Google	Create and secure your Account, sign you in, provide the Services, send service emails	Contract	While your Account exists, then only what tax and accounting law requires
Billing data	Top-ups, purchases, Balance, Traffic used; invoices and invoice details; refund requests; crypto wallet addresses, transaction IDs and amounts.	You; public blockchains; payment processors	Take payments, keep your Balance, issue invoices and refunds, prevent payment fraud, keep accounting records	Contract; legal obligation (tax, accounting); legitimate interests (fraud prevention)	While your Account exists, then as long as tax and accounting law requires
Session log from the gateway	Account or sub-user, session, client IP (the IP address you connect from), start and end time of each session. No websites, domains or URLs	Our gateway	Keep the network secure, match abuse reports and legal requests to an Account	Legitimate interests (security, abuse prevention)	14 days. Exceptions: section 7
Usage figures	Traffic used per Account and sub-user: hourly figures for the Dashboard charts (traffic, number of requests, share of successful requests, response time) and running totals; which Dedicated IPs are assigned to your Account and when	Our gateway; our systems	Count and bill Traffic, enforce limits, show usage in the Dashboard	Contract	Hourly figures: 30 days. Totals: kept with billing data
Content of your connections	Pages, files, form data, cookies and other content you send or receive through the Services	Not collected	We do not inspect or store it	Not applicable	Not stored
Support data	Live chat messages; emails; Telegram username, ID and messages to @aeonproxysup_bot; contact form (name, work email, company, monthly volume); partner form (company, website, email)	You; Telegram	Provide support, answer sales and partner requests	Contract (customers); legitimate interests (other requests)	While your Account exists; 12 months for visitors without an Account
Trial data	Telegram ID and username, whether you joined @aeonproxy, the linked Account, trial dates and use	You; Telegram	Provide the 200 MB trial and allow one trial per person	Contract; legitimate interests (preventing repeat trials)	While your Account exists. After that, only the Telegram ID and trial date, while we offer the trial
Affiliate data	Your referral code and link; Accounts you referred and their purchases; commissions; payouts; payout wallet. If you were referred: which affiliate referred you	You; our systems; the referral code entered at signup; the `ap_ref` cookie	Run the affiliate program, attribute referrals, pay commissions, prevent self-referrals and fraud	Contract (affiliates); consent (the `ap_ref` cookie, where required); legitimate interests (attribution, fraud prevention)	While you take part in the program; the referral link while the referred Account exists; payout records with billing data
Identity verification data	Name, date of birth, identity document and, if the check requires it, a photo of your face; the result. For companies: company and registration details, owners or representatives	You	Verify identity only when our KYC Policy applies, for example for access to targets blocked by default, after abuse reports or suspicious activity, before affiliate payouts, or for sanctions screening	Legitimate interests (fraud and abuse prevention); legal obligation (sanctions); explicit consent for any face comparison	5 years after your Account closes, unless the law requires otherwise
Security logs	IP addresses, browser and device data, sign-in events, failed attempts, fraud and abuse signals	Your browser and device; our systems	Protect Accounts, detect fraud and abuse, enforce our Acceptable Use Policy, apply sanctions rules	Legitimate interests; legal obligation (sanctions)	14 days, longer only for records linked to a fraud or abuse case
Marketing email	Email address, your consent or customer status, opt-outs	You	Send news and offers about AeonProxy	Consent; for customers, legitimate interests (similar services, where the law allows)	Until you opt out, then a do-not-contact record so we respect your choice
Abuse reports and legal requests	Reporter's name, email, organization, report and evidence; details of the requesting authority	Reporters; authorities	Act on abuse, answer legal requests, establish or defend legal claims	Legitimate interests; legal obligation	Until the matter is closed, then as long as needed to defend legal claims

What you must give us. You need an email address and a password, or a Google account, to open an Account, and we need billing data to take payments. Without this data we cannot provide the Services. We ask for identity verification only in the cases in our KYC Policy. If you refuse or do not pass it, we may limit or close your Account and refund unused Balance where the law allows. Other data is optional, but we cannot reply to you without contact details.

Identity checks. If an identity check compares your face with your document photo, it uses biometric data. We ask for your explicit consent before such a check starts.

Crypto payments. Blockchain transactions, including wallet addresses and amounts, are public and cannot be deleted by us or anyone else. For a crypto refund we may ask you to prove control of the sending wallet or to give a deposit address in your name. See our Refund Policy.

Content of your connections and the websites you visit. We don't store the websites you visit. The gateway reads the destination domain and port of each connection only while the connection is open, because it needs them to route the connection and apply our default blocks, and does not write them down. We do not inspect or store the content you send or receive. For HTTPS connections, the content is encrypted between you and the destination.

Marketing. We send marketing email only with your consent or, if you are a customer, about similar services where the law allows. Every marketing email has an unsubscribe link. Service emails about your Account, payments or changes to our terms are not marketing.

4. Customers' own targets

When you use the Services, you decide which websites and services ("targets") you connect to and what data you collect from them. For these connections we act as a conduit: we carry them, but we do not choose the targets, select who receives the data or change the content.

You are responsible for making sure that your data collection is lawful, including under data protection law, and for having a legal basis for any personal data you collect from targets.
Where we process personal data on your behalf while we carry your connections, we do so only under your instructions and only to provide the Services.
Our Acceptable Use Policy lists the uses that are not allowed.

5. Service providers we use

We share personal data only with the recipients below, and only as needed for the purposes in section 3. Service providers acting for us may use the data only to provide their services to us. Telegram, Google and our Network Partners also process data under their own privacy policies.

Hosting provider in Germany. Hosts our servers, including the gateway gate.aeonproxy.com in Frankfurt.
Cloudflare. Provides DNS, content delivery and email routing for aeonproxy.com, so it processes visitors' IP addresses and request data and routes emails sent to us.
Resend. Sends our system emails, such as payment confirmations and notices about your Account.
Network Partners. Carry residential and mobile Traffic. They receive what is needed to carry each connection, such as the destination and your targeting and session settings, and the details needed to handle abuse reports about their networks. They may keep their own connection logs under their own policies.
Payment processors. Crypto payments are processed by NOWPayments, which receives the payment amount, currency and transaction details.
Telegram. Carries the messages you send to @aeonproxysup_bot and runs our channel @aeonproxy.
Google. If you choose to sign in with Google, Google confirms your identity to us.
Affiliates. If you signed up through an affiliate's link or code, that affiliate receives information about the commissions earned on your purchases.
Professional advisers, such as lawyers and accountants, who must keep the data confidential.
Authorities, only as described in section 9.
A buyer or successor, if all or part of our business is sold or merged. The new owner must protect the data as this policy describes.

We do not sell personal data. A current list of our service providers is available on request from [email protected].

6. International transfers

AeonProxy is based in the United States, so when you use the Services from another country you give your personal data directly to a US company. Our gateway and servers are located in Germany. Some service providers process data in other countries, including the United States.

When personal data from the European Economic Area or the United Kingdom goes to a provider in a country without an adequacy decision, we use appropriate safeguards where needed, such as the European Commission's Standard Contractual Clauses and their UK equivalent, or the provider's certification under the EU-US Data Privacy Framework. You can ask [email protected] for details.

7. How long we keep data

The table in section 3 gives the retention for each category. In summary:

Session log from the gateway: 14 days.
Usage figures: hourly figures 30 days, totals with billing data.
Security logs: 14 days.
Account and billing records: as long as your Account exists, then as long as tax and accounting law requires.
Support conversations: as long as your Account exists, or 12 months if you do not have an Account.
Identity verification results: 5 years after your Account closes, unless the law requires otherwise.
Marketing: until you opt out, plus a do-not-contact record.
Content of your connections: never stored.

We may keep specific records longer when we need them for an open abuse or fraud case, to establish or defend a legal claim, or because we received a preservation request (section 9). When a retention period ends, we delete the data or make it anonymous.

8. Your rights

If GDPR or UK GDPR applies to you, you have the rights below. Customers in other countries can use the same process, and we will apply the rights that their local law gives them.

Access: ask for a copy of your personal data and information about how we use it.
Correction: ask us to correct inaccurate or incomplete data.
Deletion: ask us to delete your data. We may keep data that the law requires us to keep, such as tax records, or that we need to establish or defend legal claims. Deleting your data closes your Account. Our Refund Policy explains what happens to unused Balance.
Restriction: ask us to limit how we use your data, for example while we check a correction request.
Objection: object to processing based on legitimate interests. You can always object to direct marketing, and we will then stop it.
Portability: receive the data you gave us in a structured, machine-readable format, or ask us to send it to another provider where this is technically possible.
Withdraw consent: where we rely on consent, withdraw it at any time, for example through the cookie settings on our site or the unsubscribe link in our emails. This does not affect processing that took place before you withdrew.
Complaint: complain to a supervisory authority. In the EU or EEA, this is the data protection authority where you live, where you work or where the issue happened. In the UK, it is the Information Commissioner's Office (ICO). We would like the chance to deal with your concern first.

How to use your rights. Email [email protected] from your Account email, or write to us. We may ask you to confirm your identity first. We respond within one month. For complex or numerous requests we may extend this by up to two months, and we will tell you why within the first month. Using your rights is free, unless a request is clearly unfounded or excessive.

9. Law-enforcement and legal requests

We disclose customer data to law enforcement and other government authorities only:

in response to valid legal process, such as a subpoena, court order or warrant; or
in an emergency involving danger of death or serious physical injury.

We check each request and disclose only the data that it lawfully covers. On a preservation request, we can preserve specific records for 90 days, and for another 90 days if the request is extended once. We do not have the content of your requests or responses, so we cannot disclose it. The session log is available only for the last 14 days, unless it was preserved.

We may also use personal data to establish, exercise or defend legal claims. Authorities and people who want to report abuse can find how to contact us on our Report abuse and legal requests page.

10. Security

We protect personal data with technical and organizational measures that suit the risk, including:

encrypted connections (HTTPS) for the website and the Dashboard;
passwords stored only as hashes;
access to personal data only for people who need it for their work;
deletion of session log entries after 14 days.

No system is perfectly secure. Help protect your Account with a strong, unique password, keep your API keys and proxy credentials private, and use sub-users to give others limited access. If a data breach puts your rights at risk, we will tell you and the authorities as the law requires.

11. Children

The Services are only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that an Account belongs to someone under 18, we close it and delete their data, except data that the law requires us to keep. If you think that a person under 18 has given us personal data, contact [email protected].

12. Automated decisions

We use automated fraud and abuse scoring on sign-ups, payments and use of the Services. It can block a payment or a connection, or flag an Account for review, without a person taking part.

If an automated decision affects you and you think it is wrong, ask [email protected] or [email protected] for human review. A person will review it, consider what you tell us and tell you the result.

13. California and other US state notices

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Sections 3 and 5 list the categories we collect, their sources, our purposes and the recipients. If your state's law gives you rights to know, access, correct or delete your personal information, you can use them as described in section 8. We will not treat you differently for using your rights.

14. Changes

We may update this policy when our Services or the law change. We will post the new version on this page and change the date at the top. If a change significantly affects how we use your personal data, we will tell you by email or in the Dashboard before it takes effect.

15. Contact

Privacy questions and requests: [email protected]
Customer support: [email protected]
Abuse reports: [email protected]
Legal requests: [email protected]