Privacy Policy

Effective 1 May 2026 · Version 1.3

This policy describes what FleetProxy collects, why, how long we keep it, and what you can do about it. It describes the system as it is actually built. Where a common practice is absent — third-party advertising trackers, for example — it is absent because we do not do it, not because it was left out.

1. Who we are

FleetProxy operates the website at fleetproxy.com, the customer dashboard, and the proxy network. For the personal data described here, we act as the controller. Contact: [email protected].

2. What we collect

2.1 Account data

Email address, password (stored only as a bcrypt hash — we cannot read it), optional display name, optional company name, optional country, an optional avatar URL, and your marketing preference. If you sign in with Google we store the Google account identifier and the email that account provides; we never receive your Google password. If you enable two-factor authentication we store the shared secret needed to verify your codes.

2.2 Session and security data

For each active sign-in we store a hash of the session token (never the token itself), the IP address the session was created from, the user-agent string, an inferred country, and timestamps for creation, last activity, and expiry. Your last login time and last login IP are stored on the account so you can spot access you do not recognise.

2.3 Order and billing data

Order number, line items, amounts in cents, currency, coupon code, payment provider, the provider's transaction reference, the IP address and user-agent the order was placed from, and the campaign attribution captured at checkout (referrer and any utm parameters). Every change to your account balance is written to a ledger with an amount, a description, and the resulting balance.

We never receive or store card numbers. Card payments are processed by Stripe and cryptocurrency payments by Cryptomus, each on their own systems. We receive only a transaction reference and a status.

2.4 Service data

For each proxy plan: the product, targeting defaults, provisioned credentials, and any dedicated IP addresses leased to you.

Usage is metered as hourly aggregates: bytes up, bytes down, request count, success count, failure count, mean latency, and the exit country, per plan per hour. We do not log destination hostnames or URLs, request or response headers, or any traffic content. The usage tables in this system have no column capable of holding them.

2.5 Support data

Ticket subject, category, and the full text of every message you send us, together with your email address. Support agents can see your account, plans, orders, and usage aggregates in order to answer you.

2.6 Website analytics

We run first-party analytics with no third-party script. When you visit a page we record: a salted hash of a visitor identifier stored in a first-party cookie, a session identifier, the path, the referrer, any utm parameters, an inferred country, and coarse device, browser and operating-system categories. We do not store the raw IP address in these analytics records. Signed-in visits are linked to the account so we can answer questions like which documentation pages precede a support ticket.

We also record named product events — sign-up started, sign-up completed, checkout started, purchase completed, trial claimed, coupon applied — with the same identifiers and, where relevant, an order value.

2.7 Affiliate data

If you join the affiliate programme, clicks on your referral link are recorded with the IP address, user-agent, referrer, landing path, and inferred country, so that commissions can be attributed and fraudulent self-referral detected.

2.8 Administrative logs

Staff actions on your account — a suspension, a manual balance adjustment, a refund — are written to an audit log with the acting staff member, the action, the affected record, the acting IP address, and a description of what changed. Outbound emails we send you are logged with recipient, subject, and template so support can confirm delivery.

3. Why we process it, and on what basis

Where we rely on legitimate interests we have weighed them against your rights; you can object at any time using the contact address in clause 8.

4. What we do not do

• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We do not load third-party advertising or analytics scripts on the website.
• We do not inspect, store, or analyse the content of traffic passing through the proxy network.
• We do not use your data to train machine-learning models.
• We do not build profiles for automated decisions that produce legal or similarly significant effects.

5. Who we share it with

• Payment processors (Stripe, Cryptomus) — to take payment.
• Infrastructure and email providers — hosting, transactional email delivery.
• Network partners — only the minimum needed to provision and support a dedicated address you have ordered.
• Law enforcement and regulators — where we are legally compelled. We require valid legal process, we log every such request, and we notify the affected customer unless legally prohibited.
• A successor entity — on a merger or sale, subject to this policy.

Each processor is bound by a written agreement limiting them to our instructions.

6. International transfers

Data is processed primarily within the European Economic Area and the United Kingdom. Where a processor is located elsewhere, transfers rely on an adequacy decision or on the Standard Contractual Clauses with a transfer risk assessment.

7. Retention

Deleting your account does not delete the records in the second and third rows, because we are required to keep them.

8. Your rights

Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent. California residents have the rights to know, delete, correct, and opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of.

Exercise any of these by emailing [email protected] from your account address. We respond within 30 days. You can export your account data and delete your account directly from the dashboard without contacting us. You may also complain to your local supervisory authority.

9. Security

Passwords are hashed with bcrypt. Session tokens are signed and stored only as hashes. Traffic to the site and the dashboard is TLS-only. Access to production data is limited to staff who need it and is audit-logged. Two-factor authentication is available on every account and we recommend enabling it.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant authority within the periods the law requires.

10. Children

The Service is not directed to anyone under 18 and we do not knowingly collect their data. If we learn we have, we delete it.

11. Changes

Material changes are notified by email and in the dashboard at least 14 days before they take effect. Every version is retained with its effective date.

What this means

We hold the things a proxy business has to hold: who you are, what you bought, how many bytes you used and from which country, what you wrote to support, and which pages you visited on our site. We do not know which websites you visit through the proxy, because we never record them. Card details never reach us. Site analytics use a hashed visitor identifier rather than your IP address, and there is no advertising tracker anywhere on the site. You can export everything and delete your account yourself; the only things that survive that are the invoices tax law makes us keep.