Privacy and Acceptable Use Policy

Effective Date: 14.09.2026

At Amnezia, we prioritize the privacy and security of your data above all else. We strive to collect the minimum amount of personal data and remain transparent about what data we collect and why. This Privacy Policy describes how we collect, use, and protect your information, and it complies with applicable data protection laws, including the General Data Protection Regulation (GDPR).

1. What We Offer and How It Works

Amnezia provides functionality for creating a VPN on your own server, as well as ready-made VPN services available in the Amnezia VPN application.

1.1 Self-Hosted VPN Setup

A user can set up their own VPN server by entering server access details (IP, login, password/key) into the Amnezia VPN client. We do not collect, store, or transmit these details - they remain only on the user’s device.

1.2 Amnezia Free

A user can obtain a VPN configuration (key) in two ways:

• Via the Telegram bot – when using the bot, we only collect the user’s Telegram ID for identification;
• Via the Amnezia VPN application.

When connecting to Amnezia Free, we collect:

• The application version and operating system (for internal statistics);
• An application-generated device identifier (UUID) – created when the application is installed and used to associate VPN keys with the device and provide technical support.

When connecting to Amnezia Free, we process connection IP addresses as described in Section 2.2 to support service availability, security, and connection stability.

1.3 Amnezia Premium

When purchasing a subscription through pay.amnezia.org, we collect the user's email address. The user's IP address may be processed temporarily to calculate applicable taxes. The IP address is not stored for these purposes. It may also be transmitted to the payment provider where necessary to process the transaction.

After connecting to Amnezia Premium through the application, we collect:

• The application version and operating system (for internal analytics);
• An application-generated device identifier (UUID) – created when the application is installed and used to associate VPN keys with the device and provide technical support.

When connecting to Amnezia Premium, we process connection IP addresses as described in Section 2.2 to support service availability, security, and connection stability.

1.4 Amnezia Affiliate (Partner and Referral Program)

Under our affiliate program, we collect:

• An email (user identifier);
• A cryptocurrency wallet (for commission payouts);

1.5 Websites (amnezia.org, docs.amnezia.org)

On the amnezia.org website, we use:

• Language cookies;
• Anonymized statistical data (visits, referral sources, downloads, user regions, and devices);

Data is collected using Matomo. The data is processed within our own infrastructure and is not shared with third-party analytics services. The data is anonymized and cannot be used to identify individual users.

When submitting the form at https://amnezia.org/business, we collect:

• Email;
• Company name;
• Number of employees;

On the docs.amnezia.org website, only a cookie for the interface language is used.

2. What Data We Collect and Why

2.1 Data Provided by the User

• Email – for purchasing and paying for a subscription through pay.amnezia.org;
• Company name and number of employees – when filling out the business form;
• Cryptocurrency wallet – for affiliate payouts.

2.2 Data Collected Automatically

• Telegram ID – for issuing Amnezia Free configurations;
• An application-generated device identifier (UUID) – created when the application is installed and used to associate VPN keys with the device and provide technical support;
• Application version and OS – for compatibility and improvements;
• IP address – when connecting to our VPN service, we process the IP address from which the connection to our servers is established. It is used to select appropriate connection parameters and to support service availability, security, and connection stability. For connections from locations where additional technical measures are required to maintain service availability and stable operation, the connection IP address may also be retained. This data may also be used to prevent abuse and protect our infrastructure.

We do not use connection data to track users’ online activity.

2.3 What Data We Do Not Collect

We do not collect or store information about users’ online activity through the VPN, including browsing history, visited websites, traffic destinations, or the content of VPN traffic. We do not receive data from third-party authorization services (such as Google, Apple and others).

3. How We Use Data

We use data solely for:

• Providing access to our services;
• Maintaining and improving service stability;
• Communicating with users at their request;
• Processing payments and payouts;
• Preventing abuse and attacks;
• Analyzing anonymized statistics to improve the product;
• Sending offers and product news (you can unsubscribe at any time by clicking the link in the email or by contacting us).

VPN traffic and activity are not used for analytics or advertising.

4. Transfer of Data to Third Parties

We do not transfer your data to third parties, except in the following cases:

• data submitted through the business form at https://amnezia.org/business are transferred to the Web3Forms service (see their privacy policy);
• data provided through the pay.amnezia.org may be transmitted directly to payment providers during checkout (such as the user’s email address and IP address, where required by the payment processor);
• authorized government authorities only upon a valid, official, and lawful request, and only to the extent required by applicable law.

Only requests submitted through official legal channels (for example, pursuant to a court order, a request from a competent governmental authority, or within the framework of an international legal assistance procedure) are considered legally valid.

We comply only with requests that are consistent with the laws of Romania and the European Union. Requests from foreign authorities without proper legal basis in Romania or the EU cannot be fulfilled.

We do not keep activity logs and do not monitor or record users’ VPN traffic, browsing history, visited websites, traffic destinations, or the content of communications. Limited technical connection data may be processed or retained as described in this Policy to support service availability, security, connection stability, and abuse prevention.

No other data is transferred to third parties.

5. Cookies and Analytics

We use cookies and privacy-focused analytics tools to support website functionality and improve our services:

• Language settings (cookies);
• Matomo (self-hosted), including on pay.amnezia.org, to analyze website usage and the subscription purchase process, including referral sources, campaign parameters (such as UTM tags), and checkout completion.

We do not use analytics to monitor VPN traffic or users’ online activity.

6. Security

We implement modern technical, organizational, and physical security measures to prevent unauthorized access, alteration, or loss of data. The service infrastructure is built using decentralized elements, reducing reliance on a single point of failure and increasing overall network resilience. Access to systems and data is granted strictly based on a role-based model and the principle of least privilege, ensuring clear separation of permissions and minimizing internal risks. All critical components undergo regular security checks, monitoring, and audits to maintain a high level of protection and user confidentiality.

7. International Data Transfer

Sometimes data may be transferred outside the EEA. In such cases, we:

• Use Standard Contractual Clauses (SCC) approved by the European Commission;
• Employ data minimization, encryption, and anonymization.

You can contact us for more details.

8. Data Retention

We store data only as long as it is necessary to provide our services or as required by law. After that, the data are deleted or anonymized.

9. Your Rights

You have the right to:

• Access your data;
• Correct or delete your data;
• Withdraw your consent;
• Restrict or object to processing;
• File a complaint with a supervisory authority.

To exercise your rights, email us at privacy@amnezia.org.

10. Children

Our services are not intended for individuals under 16 years of age. If we become aware that a child has provided us with personal data, we will delete them immediately. Parents or guardians can contact us directly.

11. Limitation of Liability

Our services are provided “as is” and “as available.” We make no express or implied warranties regarding uninterrupted operation, speed, security, or fitness for any particular purpose. Amnezia is not liable for:

• any indirect or consequential losses, including loss of profit or data;
• service disruptions caused by external factors, technical limitations, or actions of third parties;
• consequences arising from the use of the service for purposes that violate applicable law. To the extent permitted by law, our liability is limited to the minimum extent required by applicable legislation. Nothing in this Policy excludes or limits liability where such exclusion or limitation is prohibited by law (for example, in cases of intent or gross negligence).

11.1 Acceptable Use

Users agree to use the VPN service only for lawful purposes and not to engage in:

• illegal activities (such as hacking, malware distribution, or fraud);
• sending spam, phishing, or deceptive messages;
• distributing, storing, or transmitting prohibited content (including content that infringes copyrights);
• attacks on networks or services of third parties (such as DDoS);
• actions that harm other users, our infrastructure, or our partners.

We do not keep activity logs, monitor, or record user traffic. However, if we receive credible abuse notifications (for example, from hosting providers, network operators, or copyright holders), we may take necessary measures to protect our infrastructure and comply with legal requirements.

11.2 Content and Third-Party Resources

Amnezia is not responsible for materials posted or transmitted by users or third parties through our services. We do not continuously monitor or control such content but may take action where required or permitted by law. Amnezia is also not responsible for the content of third-party websites linked from our resources; such links are provided solely for user convenience.

12. Updates

This Policy may be updated from time to time. All changes will be posted on this page with a new effective date.

13. Our details

ANARCHY LAB S.R.L. is responsible for personal data processing as the data controller. Company is registered in Romania under registration number J2026000670007, address: Bucureşti, Sector 3, Bulevardul Unirii, No. 61, Bl. F3, Staircase 4, Floor 2, Apt. 208, Romania.

If you have any questions about our Privacy Policy, please contact the data controller at privacy@amnezia.org.

© 2026 Amnezia. All rights reserved