Privacy Policy

This Privacy Policy sets out how Budget Proxies ("we", "us", "our") gathers, uses, shares and looks after your personal information when you visit budgetproxies.com, set up an account, or make use of our proxy services (the "Service"). We believe in keeping things lean with your data: we ask for only what we honestly need to run, secure and bill the Service. Please read this policy alongside our Terms of Service.

Data controller: © 2026 Budget Proxies — budgetproxies.com. All rights reserved. The data controller answerable for your personal information is Budget Proxies, who you can reach at [email protected].

1. Introduction & scope

The personal information dealt with here is what we handle about visitors to our website and about registered customers of the Service. Websites, applications and services belonging to third parties, which you may reach through our proxies, fall outside this policy: each of those operates under its own privacy policy, and none of them is under our control. Use the Service and you take on the practices described below. Should local law grant you specific rights, for example under the EU/UK General Data Protection Regulation ("GDPR") or the California Consumer Privacy Act ("CCPA"/CPRA), Section 12 sets those rights out in full.

2. About us — data controller & contact details

Under applicable data protection law, Budget Proxies, the operator of budgetproxies.com, is the data controller answerable for your personal information. If anything in this policy is unclear, or you would like to know more about how we treat your data, our privacy team is happy to help at [email protected] or via our contact page. Where we act as a processor for a business customer, that customer is the controller and their own privacy policy applies.

3. Information we collect

Listed below are the categories of personal information we collect, and in each case we take no more than is genuinely necessary:

• Account data: your name (or the username you pick), email address and a securely hashed password. We never keep your password as plain text.
• Billing & payment data: order details, plan and quantity, transaction amounts, currency, invoice history and the last four digits and card brand passed back to us by our payment processor. Full card numbers and security codes go straight to Stripe and are never sent to or held on our servers.
• Technical & usage data: the IP address and browser user-agent logged at signup, login and important account actions, retained in standard web-server and security logs for a limited time (see Section 10). We also note aggregate bandwidth and connection counts purely for billing and capacity planning.
• Support communications: the content of messages you send us through the contact form, support tickets or email, along with anything else you decide to include.
• Cookies & similar technologies: a strictly necessary session identifier, and — only if you agree — limited analytics data (see Section 7).

4. What we never collect and never log

Privacy was the starting point for the way the Service is built. We do not log, inspect, store or sell the proxy traffic you create. To be clear, we hold no record of:

• the destination websites, hostnames or IP addresses you connect to;
• the URLs, search queries or pages you ask for;
• the content of the data travelling through our proxies.

We measure bandwidth in aggregate and nothing finer, purely for billing and for stopping abuse. No log exists here that ties an individual customer to the particular sites they visit through the Service. Special-category (sensitive) personal data is not something we set out to collect, and we would ask you not to send it to us.

5. What your information is used for

The personal information described above gets used by us in the following ways:

• set up and run your account and check your logins;
• deliver, configure, provision and bill for the Service you bought;
• collect payment, issue invoices, and handle refunds along with chargebacks by way of our payment processor;
• issue transactional and service messages, receipts, expiry reminders and security alerts among them (anything non-essential can be turned off from your dashboard);
• offer customer support and answer your questions;
• spot, look into and stop fraud, abuse, network misuse and security incidents;
• keep our website and infrastructure running, improved and secure; and
• satisfy our legal, tax and accounting obligations, and enforce our Terms of Service.

6. Grounds on which we process (GDPR)

In cases where the GDPR applies, these are the legal bases we rely on:

• Performance of a contract: to set up your account, supply the Service you ordered and take your payments.
• Legitimate interests: to keep our network secure, head off fraud and abuse, maintain basic security logs, and run and improve our business — weighed against your rights and freedoms.
• Consent: for any optional analytics cookies and any non-essential marketing messages. You can take back your consent whenever you like, without affecting anything we did beforehand.
• Legal obligation: to keep billing and tax records and to answer lawful requests from the proper authorities.

7. Cookies & similar technologies

A cookie is a small text file stored on your device. We keep our use of them low, and they fall into two groups:

Strictly necessary cookies

A single essential session cookie is set (cps_sess) to keep you signed in and to guard against cross-site request forgery. This cookie is needed for the Service to work and cannot be turned off through our consent banner. It does not follow you around other websites.

Analytics & optional cookies

We do not use third-party advertising or cross-site tracking cookies. Any optional analytics cookies, where used, are loaded only once you have agreed through our cookie banner, are explained there, and can be turned down or withdrawn whenever you like without affecting your ability to use the Service. You can also manage or remove cookies through your browser settings.

8. Third parties & sub-processors

Only the minimum personal information required goes to a small number of trusted service providers ("sub-processors"), each acting on our instructions and bound by appropriate contractual safeguards:

• Stripe — our PCI-DSS-compliant payment processor, which looks after card data and handles your payments.
• Our email / SMTP provider — sending transactional, account and support emails.
• Our proxy infrastructure suppliers — supplying the ethically sourced IP addresses and network capacity behind the Service.

Personal information may also be disclosed by us where the law demands it, where enforcing our agreements calls for it, or to protect the rights, safety and property of our users or of anyone else. In a merger, an acquisition or a sale of assets, personal data may be transferred on, still subject to this policy. We do not sell or rent your personal information to anyone, and we do not share it for cross-context behavioural advertising.

9. International data transfers

Your personal information may be processed by us and by our sub-processors in countries other than the one you live in, including places beyond the European Economic Area and the United Kingdom. Any time personal data crosses a border, we lean on appropriate safeguards: the European Commission’s Standard Contractual Clauses, for instance, together with the UK Addendum where that applies, or transfers to countries assessed as offering an adequate level of protection. Should you want more detail on those safeguards, ask us using the contact details set out below.

10. Data retention

Personal information stays in our hands for no longer than the purposes described in this policy genuinely call for, and here is how that works out:

• Account data is kept for as long as your account stays active.
• Billing & transaction records are kept for the time needed to satisfy our legal, tax and accounting duties (usually several years under applicable law).
• Technical & security logs (such as IP and user-agent records) are held for a limited time and then erased or anonymised.

Close or delete your account and we will erase or anonymise the personal data we hold on you within 30 days. Two exceptions apply: records the law obliges us to retain, and records we need in order to resolve disputes and enforce our agreements.

11. Data security

Reasonable technical and organisational measures are in place here to protect your information. Passwords sit in storage under strong one-way hashing. Traffic to our website is encrypted while in transit (HTTPS/TLS), payments pass through a PCI-DSS-compliant processor, and access to personal data is restricted to authorised staff on a need-to-know basis. We watch for unauthorised access and apply security updates as they arrive. No system can be promised as perfectly secure, though, and keeping your account credentials to yourself remains your responsibility.

12. Your privacy rights

Which of these rights you hold over your personal information depends on where you happen to live. Some may apply, or all of them:

• Access — obtain from us a copy of the personal data we hold about you.
• Rectification — have data that is inaccurate or incomplete corrected.
• Erasure — request deletion of your data, subject to the legal retention rules.
• Restriction — ask, in certain situations, that we narrow how we use your data.
• Portability — be given your data in a structured, machine-readable format.
• Objection — object where processing is grounded in our legitimate interests.
• Withdraw consent — where consent underpins the processing, withdraw it at any point.

California residents hold further rights under the CCPA/CPRA: the right to know which personal information we collect and how it is used and disclosed, the right to have it deleted and the right to have it corrected, plus the right to opt out of any “sale” or “sharing” of personal information. We do not sell or share your personal information, so there is nothing to opt out of, and we will never treat you unfairly for exercising any of your rights.

A good deal of your information can be managed by you directly in the dashboard. For any other right, write to us at [email protected]. We may need to confirm your identity before we respond, and we will reply within the timeframe applicable law sets.

13. Children’s privacy

The Service is built for adults and is not directed at children. We will not knowingly collect personal information from anyone under the age of 18, or under 16 in places where that is the applicable age of digital consent. If you think a child has given us personal data, please tell us, and we will act to remove it.

14. Automated decision-making

We take no decision that carries legal or similarly significant effects for you on the basis of automated processing by itself. Some narrow automated checks do help us flag fraud, abuse or payment risk. Those checks are reviewed by a member of our team, and where a decision genuinely affects you they never replace human judgement.

15. Data breach notification

In the unlikely event that a personal data breach occurs and is likely to place your rights and freedoms at risk, we will notify the relevant supervisory authority, and, where the law demands it, the individuals affected, without undue delay. Procedures are maintained here for detecting security incidents, investigating them, containing them and putting them right.

16. Revisions to this policy & where to reach us

From time to time we may revise this Privacy Policy, keeping it in step with changes to our practices or to the law. Where a change is meaningful, the “Last updated” date at the head of this page will be refreshed and, where that seems sensible, we will also let you know by email or through the Service. Do look back at this page occasionally.

Questions, concerns or complaints about this policy, or about the way your personal data is handled here? Please do write to us at [email protected] or via our contact page. We will do our utmost to put things right. If you are in the EEA or the UK and are still unhappy, you also have the right to raise a complaint with your local data protection supervisory authority.