Privacy policy.

01Who we are.

Orli VPN is run by Molcode S.R.L., Humorului 82, Șcheia, Suceava, 727525, Romania, trade register no. ROONRC.J2018001990330, VAT no. RO40301070, which decides how your data is used (the “controller”). For anything about your data, email help@orlivpn.com.

02What we never collect.

Orli VPN doesn’t record the websites you visit, what you do on them, your DNS lookups or the contents of your traffic, and our VPN servers don’t record the address you connect from. The key that lets your device connect is made on your device and never leaves it. If an authority makes a lawful request, we can only hand over what this policy lists.

03Your account.

• Your email address and how you sign in: your password, passkeys, an authenticator app, the codes we email you, or Google or Apple and the name and picture they share with us.
• The browsers and apps signed in to your account, with their IP address and when they were last used. Settings lists them so you can sign any of them out.
• The language we write to you in.

We use these to run your account and keep it secure. To stop password guessing and misuse, we limit repeated requests by IP address and email address, and delete those records within a few days. When you create an account on our website, Cloudflare checks that you are a person, and receives your IP address and browser details to do so.

04Your devices.

For each device, we keep its keys, its type, the app’s version and language, the name you give it, the country, server and connection settings it uses, an ID for sending it notifications, and when it was added or removed. We use these to connect your devices and keep to your plan’s device limit. You can see, rename and remove your devices in your account.

05Subscriptions and payments.

Stripe takes payments on our website and Apple takes them in the App Store. They collect your card and billing details, and we never see your card number. We keep your subscription’s status and dates and your payments, refunds and disputes.

06Refund information shared with Apple.

If you paid in the App Store, asked Apple for a refund and turned on “Share refund information with Apple” in your account, we tell Apple a few facts from our billing records, such as whether the service was working during the period you paid for and what our refund policy would give. We never tell Apple how you used Orli VPN.

07Emails.

We email you codes, security notices and notices about your subscription. We may also send you tips, news and offers about Orli VPN; stop them at any time with the link in each one or in Settings. If you ask to hear when Orli VPN comes to another device, we keep your address only until we’ve told you. When you email us, we keep the conversation for two years after your last message.

08Connecting an AI assistant.

If you connect an AI assistant, such as ChatGPT or Claude, it can read and act on your account within what you allowed. The company that runs it handles what it receives under its own privacy policy. You can disconnect it at any time in Settings.

09Analytics and the app.

Our website, account pages and app use Google Analytics to count visits and the main steps people take, such as signing up, subscribing or connecting. It never learns who you are: we don’t give it your name, email address, account or payment details, and never the websites you visit. On our website, where the law asks for your consent, it runs only if you accept, and you can change your choice at any time with Cookie settings at the bottom of each page. See how Google uses information from sites or apps that use its services.

The app also uses a crash reporting service to find and fix problems, not linked to your account. Signing in on our website uses only the cookies it needs to work.

10Technical records.

To keep the service working, our systems keep technical records, such as a sign-in succeeding or how long a request took, for up to 30 days, and totals made from them for up to 13 months. They never include your email address, IP address, passwords, keys or anything about what you do through Orli VPN. We also keep a history of changes to accounts, devices and payments, so the service stays correct and secure.

11How we keep your data safe.

We follow recognised industry standards to keep your data secure, with strong encryption and strict access controls. We share it only with the companies that help us run Orli VPN, such as our hosting, payment, email, analytics and support providers, each for that work alone and under data protection terms, and with services you choose to use, such as Apple, Google or an AI assistant. Some of them work from the United States, under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, with the UK’s addendum for data from the United Kingdom. We don’t sell your data or share it for advertising. If a breach ever puts your data at risk, we tell you and the authorities, as the law requires.

12Why we use your data.

• To provide the service you signed up for.
• To keep accounts and the service safe and working, to improve it and to tell you about Orli VPN now and then, which are our legitimate interests.
• To meet legal duties, such as keeping payment records for tax.
• With your consent where the law asks for it, such as for analytics in some countries, refund information shared with Apple and “Tell me when” emails. You can withdraw it at any time.

13How long we keep it.

• Your account and devices: until you remove them or delete your account, except the records described under Deleting your account.
• Each sign-in: until it signs out, or within a few days of it expiring.
• Payment records: 10 years from the end of their financial year, as Romanian accounting law requires.
• Google Analytics data: 14 months.
• Support emails and technical records: as stated above.

14Deleting your account.

You can delete your account in Settings. We remove your devices and their access, delete your email address, name, sign-in methods and settings, and sign you out everywhere. It also cancels a subscription you pay for by card on our website, so it doesn’t renew; cancel an App Store subscription in iOS Settings. We keep, without your email address or name, the records we need for security and to keep the service correct, and payment records for as long as the law requires.

15Your rights.

Under data-protection law, including the GDPR and the UK GDPR, you can ask to see, correct, delete or take a copy of your data, and limit or object to how we use it, including for direct marketing at any time. You can do much of this yourself in your account; for anything else, email help@orlivpn.com and we answer within one month. You can also complain to a data-protection authority, such as the one where you live. Ours is Romania’s National Supervisory Authority for Personal Data Processing, ANSPDCP (dataprotection.ro).

16Children.

Orli VPN is not for children under 13, and we don’t knowingly keep their data.

17Changes to this policy.

The version and date at the top of this page say which policy applies. Before a change that matters takes effect, we email you, and the version goes up.