PixVPN privacy policy

Version 2026-09-29.3 · Brazilian General Data Protection Law (LGPD, Law 13.709/2018)

This is a translation provided for convenience. The Portuguese version is the one that governs; if the two differ, the Portuguese text prevails.

1. Who processes your data

The data controller is ESIM SERVIÇOS E INTERMEDIAÇÕES DE NEGÓCIOS LTDA, CNPJ 09.605.228/0001-80, Av. Presidente Vargas, 3131, sala 603, Cidade Nova, Rio de Janeiro/RJ, Brazil, CEP 20210-030, which operates PixVPN. Data subject requests and data protection officer: privacidade@pixvpn.net.

2. What we don't collect

We apply data minimization by design: we don't log the sites you visit, the content of your traffic, the files you transfer or your DNS queries (the ad and scam blocker works without any history). So we can show how many blocks PixVPN makes (for example, in a weekly summary), the blocker keeps, for at most 24 hours, aggregate statistics for all customers together (number of queries and blocks and the most blocked addresses), without identifying who made each query, because the IP address is anonymized. From those statistics we keep only one number: the total blocks of the day.

3. Data we process, why, and for how long

• Account — name, email, WhatsApp number and CPF (Brazilian taxpayer ID). To issue the Pix charge (the CPF is required by the payment institution), deliver access, send expiry reminders and provide support. Legal basis: performance of a contract (art. 7, V). Kept while you are a customer and for 5 years after your last paid period, to defend against possible claims (art. 7, VI).
• Payments — amount, plan, date, status and charge identifier. Legal basis: compliance with legal and tax obligations (art. 7, II). Retention: 5 years.
• Acceptance of the terms — version accepted and date and time of acceptance. Legal basis: regular exercise of rights (art. 7, VI). Retention: 5 years.
• Subscription and access — plan, validity period and identifiers of the access certificates for each location. Legal basis: performance of a contract. Retention: same as the account.
• Connection records — date and time each session starts and ends, duration, source IP address and port, internal IP assigned in the VPN and certificate identifier. The source port makes it possible to correctly identify a connection when your provider shares one IP among many customers. Legal basis: compliance with a legal obligation (Internet Civil Framework, Law 12.965/2014). Retention: 1 year, with automatic daily deletion after that. Stored on each VPN server, with restricted access.
• Streaming exit usage — on the US server, access to streaming services (login, catalog and licensing) goes out through a shared residential IP address. We only keep the minute and the internal VPN IP of whoever used this exit, without recording which service or site. To work, the system keeps this exit's destinations in memory only, for at most 1 hour, and then discards them. Legal basis: compliance with a legal obligation (Marco Civil da Internet), to correctly identify an access made through this shared IP. Retention: 1 year, together with the connection records.
• WhatsApp messages — record of the service messages sent (type, date and status). Legal basis: performance of a contract. Retention: same as the account.
• Weekly summary — the date you agreed to receive the weekly summary (total blocks across all customers and a scam alert). Legal basis: consent (art. 7, I), which you can withdraw at any time by email. Retention: until you leave the summary or close your account.
• Abuse reports — history of warnings and terminations linked to your account. Legal basis: regular exercise of rights and legitimate interest in the security of the service (art. 7, VI and IX). Retention: 5 years.
• Site analytics — pages viewed, device type (phone or computer) and where the visit came from (ad, campaign or referring site), to learn which pages and ads work. We don't store IP addresses or identify visitors. Legal basis: legitimate interest (art. 7, IX). Retention: 180 days. If your browser sends a "do not track" signal (Do Not Track or Global Privacy Control), none of this is recorded.

4. Cookies and browser storage

We don't use advertising or third-party cookies. We only use: a functional cookie with the language you chose (valid for 1 year); the browser's local storage for your light/dark theme choice and for where your visit came from (for 30 days, sent along with your order); and a random session identifier that disappears when you close the tab. You can delete all of this in your browser settings.

5. Who we share data with

We don't sell data. We share only what is needed to provide the service, with the following processors:

• Asaas Gestão Financeira (Brazil) — payment institution that issues and receives the Pix payment (name, CPF, email and WhatsApp);
• Hetzner Online (Germany) — hosts the site, the customer database and the German VPN server;
• DigitalOcean (United States) — hosts the US VPN server;
• WhatsApp (Meta) — delivers service messages to your number;
• a backup storage provider, which receives encrypted files only.

Authorities. Connection records are only disclosed under a court order (Marco Civil, art. 10, §1). Registration data (personal details and address) may be provided to administrative authorities with legal power to request it (Marco Civil, art. 10, §3). We disclose only what is required.

6. International transfer

To provide the service you purchased, which involves VPN servers outside Brazil, data is processed in Germany and the United States, under art. 33, IX, of the LGPD (transfer necessary to perform a contract to which you are a party). The providers we use maintain recognized security controls, and we apply the same protections described in this policy.

7. Security

Access files are stored encrypted in the database, backups are encrypted, server access is restricted and key-based, and the VPN servers hold no account data. If a security incident may cause significant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as required by law.

8. Your rights

At any time, by email at privacidade@pixvpn.net, you may ask for: confirmation that we process your data; access to it; correction of incomplete or inaccurate data; anonymization, blocking or deletion of unnecessary data; portability; information about who we share it with; and objection to processing based on legitimate interest. We reply within 15 days. Data the law requires us to keep (tax data and connection records) is kept until the legal period ends. You may also file a complaint with the ANPD (gov.br/anpd).

9. Minors

The service is intended for people aged 18 or over. We don't knowingly collect data from children or adolescents; if we identify an account belonging to a minor, it will be closed and the data deleted, except what the law requires us to keep.

10. Changes

If this policy changes materially, we will announce it on the site and by WhatsApp before the change takes effect.

ESIM SERVIÇOS E INTERMEDIAÇÕES DE NEGÓCIOS LTDA · CNPJ 09.605.228/0001-80 · Av. Presidente Vargas, 3131, sala 603, Cidade Nova, Rio de Janeiro/RJ, Brazil, CEP 20210-030