Service operator: ZlexXQ LLC, a limited liability company organized in Wyoming, United States. Zlex VPN is the service operated by ZlexXQ LLC. Contact: [email protected].
ZlexXQ LLC is responsible for the personal information it processes to operate Zlex VPN. We aim to limit data processing to what is needed to provide, secure and bill for the service. This policy distinguishes necessary service records from the content of your internet activity.
1. Account and service information
We process your email, username, password hash, account settings, email verification status, subscription or data balance, payment references and support messages. Payment providers handle payment credentials; do not send card details to support.
To authorize and operate connections, we process device names and public keys, device and app authorizations, selected nodes and routes, virtual or assigned addresses, connection status, usage counters and relevant timestamps. Device Link and port forwarding also require peer permissions, port numbers and public mapping information. These records support access control, usage billing, troubleshooting and revocation.
2. IP addresses and network activity
We do not use your packet contents, browsing history or IP address to build advertising profiles. A working VPN must process network addresses and packets to carry your traffic. This is not a promise that no IP address is ever processed or stored anywhere.
The website and API use connection IP addresses for abuse prevention and rate limits; rate-limit records use derived identifiers. Country detection for routing may send a public IP address to AntiVPN.io. Its local country cache can contain an IPv4 network prefix or a full IPv6 address and a country result. Results are reused for up to 90 days; cache records can remain until replaced or removed. Necessary error, security or support diagnostics may also contain technical connection information.
Account-linked traffic counters measure data volume, not a list of websites you visit. Do not include browsing contents or other sensitive information in support logs unless it is necessary for the issue you want us to investigate.
3. Providers and partner networks
Hosting, transit and partner networks may carry encrypted packets. We do not provide a forwarding network with VPN decryption keys simply because it carries those packets. Nevertheless, the provider may observe connection IP addresses, timing and traffic volume. At a point where encryption terminates, the terminating provider can process that layer's contents. Disabling optional encryption changes the protection on the affected segment.
Cloudflare may process website, API or supported tunnel traffic and network metadata. hCaptcha processes verification information, including the connection IP when verification is used. Stripe or PayPal processes payments; Zoho supplies transactional email; AntiVPN.io supports country detection. Providers receive the information needed for their role and may process it in other countries under their own privacy policies and legal obligations. We cannot guarantee that they never retain IP addresses or other operational records.
Device Link can disclose your device name, public key and virtual addresses to an authorized peer. A port-forwarding entry is reachable by others while enabled. Split routing or system DNS may send selected traffic to your ordinary internet or DNS provider instead of through Zlex.
4. Cookies, retention and security
The website uses essential session and security cookies. Client apps store credentials or tokens and settings needed to keep you signed in and operate the service. Human-verification and payment services may use their own cookies when those features are used.
We retain account, entitlement and authorization records while needed to operate the account; billing and support records may be retained for accounting, disputes, fraud prevention or legal duties. Temporary tokens and rate limits expire, while deletion from backups or caches may occur later. We use access restrictions, encrypted connections and protected credential storage, but cannot guarantee absolute security.
5. Access, correction and deletion
You can edit available account details and revoke device or app authorizations from your account. To request access, correction or complete account deletion, email [email protected] or open a support ticket. We may verify that the account is yours before acting.
Deletion ends access and removes data we no longer need. We will explain any records that must remain for legal, accounting, security or unresolved-dispute reasons. Backup copies may persist until their normal removal cycle, and independent providers may have their own retention duties. A deletion request does not itself create a refund entitlement; see the Refund Policy.