1. Data controller
Individual entrepreneur Andrey Valeryevich Popov (the "Controller"), INN 650115694385, OGRNIP 326650000015430, processes personal data when providing the Dracon VPN website and mobile application. Postal address: Сахалинская область, Анивский район, с. Новотроицкое, ул. Рижская, 1. Privacy requests can be sent to support@dracons.ru or to @draconvpnbot on Telegram.
2. Data we process
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration and sign-in | Email, login and password hash; Telegram ID and username or Google account identifier and email when those sign-in methods are used. | Performance of the service agreement | Until account deletion, then up to 3 years where needed for claims and legal obligations |
| Subscription delivery | Order status, selected plan, access period and dates; versions and timestamps of accepted terms and recurring-payment consent. | Performance of the service agreement and consent where required | Up to 5 years, or longer where required by law or an ongoing dispute |
| Payment | YooKassa payment and payment-method identifiers, transaction status and amount, masked card details, selected-plan snapshot and recurring-consent record. We do not receive or store the full card number or CVC/CVV. | Performance of the agreement and legal obligations | Up to 5 years, or longer where required by law or an ongoing dispute |
| Application operation | Hashed device identifier, platform, application and operating system versions, device model, IP address and installation source. | Legitimate interest in reliable and secure operation | Up to 12 months after the last activity |
| Technical diagnostics | Connection and disconnection event, connection duration, application errors and server load indicators. This does not include traffic content. | Legitimate interest in diagnostics | Up to 90 days |
| Support | Email, request content and correspondence history. | Performance of the agreement or consent | Up to 3 years after the last request |
| Security and fraud prevention | IP address, user agent and API request security logs. | Legitimate interest and legal obligations | Up to 90 days |
3. Traffic content and VPN logs
Dracon VPN does not record, store or analyze the content of your network traffic and does not keep a history of websites or resources you visit. Limited connection events and duration may be processed for technical diagnostics without linking them to transferred content.
4. Data recipients
- YooKassa (NKO “YooMoney” LLC) provides the card-linking form and processes payments. Card details are entered directly with YooKassa; it returns a payment-method identifier, masked card details and transaction result to the Controller.
- Hosting and cloud infrastructure providers host the systems used to deliver and protect the Service.
- Telegram and Google process data under their own policies when you choose the corresponding sign-in or communication method.
- Public authorities may receive data only in cases and through procedures required by applicable law.
Each recipient receives only the data reasonably necessary for its function. We do not sell personal data.
5. International transfers
Some service infrastructure or third-party providers may operate outside the Russian Federation. Where an international transfer applies, the Controller uses the safeguards and procedures required by Article 12 of Federal Law No. 152-FZ. Personal data of Russian citizens is localized as required by Article 18.1.
6. Cookies and analytics
The website uses necessary cookies for sessions, sign-in, security and language settings. Optional analytics or marketing cookies, if introduced, will be used only with consent. The Dracon VPN application does not use third-party analytics SDKs such as Firebase or AppMetrica. Details are in the Cookie Policy.
7. Security measures
- Passwords are stored as secure hashes, not as readable text.
- Connections between applications and servers use HTTPS/TLS encryption.
- Device identifiers are stored in hashed form where stated.
- Production access is restricted to authorized personnel.
- Infrastructure integrity and security events are monitored.
8. Your rights
Subject to applicable law, you may request confirmation and a copy of your data, correct inaccurate data, restrict or object to processing, request deletion, withdraw consent, and lodge a complaint with the competent data protection authority.
Send a request titled "Personal data" to support@dracons.ru. We may need to verify your identity. Requests are normally reviewed within 10 business days; where necessary, the period may be extended by up to 5 business days.
9. Account deletion
You may request deletion of your account and associated personal data by emailing support@dracons.ru with the subject "Delete my account" and identifying your login or account email. Information that must be retained for tax, accounting, fraud prevention or legal claims will be deleted when the applicable retention period ends.
10. Age requirement
The Service is intended for users aged 18 or older. We do not knowingly collect personal data from people under 18. If such data is identified, it will be deleted within a reasonable period.
11. Policy changes
We may update this Policy when the Service, processing practices or legal requirements change. The current version and update date are always published on this page. Material changes may also be announced through the website, application or account contact details.