1. Companies that process data for us
Each company receives only what it needs to do its part and is bound by a contract with data protection obligations.
| Company | What it does | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the website and API and protects them from attacks | IP address and request logs, for up to 7 days; support message attachments, for as long as the messages are kept | United States, with a global network |
| Neon | Database | Account, devices and subscriptions | United States (Ohio) |
| Resend | Sends the email with your sign-in code and receives and sends support messages | Email address and message content, including attachments | Sent from Brazil (São Paulo); US company |
| Brazilian internet provider (name kept confidential under a commercial agreement) | Operates the VPN servers in Brazil | Each device's public key and internal address; the encrypted traffic passing through the network | Brazil |
| Network infrastructure partner (name kept confidential under a commercial agreement) | Operates the VPN servers | Each device's technical code and the encrypted traffic passing through the network | Based outside Brazil and the European Union; servers in dozens of countries |
2. Payments
These companies receive your payment, each one for the method you choose:
| Company | What it does | Data involved | Where |
|---|---|---|---|
| XGate Pagamentos S/A | Receives PIX payments | Order identifier, amount, the payer's CPF or CNPJ (when provided) and the payment details sent by the bank | Brazil (São Paulo) |
| Asaas Gestão Financeira S/A | Receives credit card payments in reais | Cardholder's name, email, CPF or CNPJ, postal code and street number, phone, card details and the buyer's IP address | Brazil (Joinville, SC) |
| Stripe, Inc. | Receives international card payments and charges renewals | Account email, country, card details, IP address and device information used to prevent fraud | United States |
International card details are typed into a Stripe form inside our website and go straight to Stripe: the card number never passes through our systems and is not stored by us. We keep only what the subscription needs — the customer and subscription identifiers at Stripe and the payment history.
The App Store (Apple), Google Play (Google) and Amazon aren't listed as processors: when you buy through them, each store handles your data as an independent controller.
The DNS resolution service isn't listed either: it isn't our processor and has no agreement with us, and it receives the queries coming from the VPN server, without any of your account data.
3. Changes to this list
Before we share customer data with a new company, we update this page. Questions: [email protected].
Update of October 5, 2026: adds the Brazilian internet provider that operates the VPN servers in Brazil, used by the plans sold today.